Mock Exam — CompTIA Security+ SY0-701 (65 Questions + 5 PBQs)

Instructions

This mock exam simulates the real CompTIA Security+ SY0-701 exam experience.

• Format: 65 multiple-choice questions plus 5 performance-based questions (PBQs)
• Time limit: 90 minutes
• Scoring: Each multiple-choice question is worth 1 point. Each PBQ is worth 5 points. Total: 90 points.
• Passing score: 750 out of 900 on the real exam scale, which is approximately 83% of the points here — you need about 75 out of 90 points to pass this mock.
• Rules: Closed book. Do not look at the answer key until you finish. For "Select TWO" questions, you must choose both correct options to earn the point.
• Question mix: Weighted like the real exam — General Security Concepts (12%), Threats, Vulnerabilities, and Mitigations (22%), Security Architecture (18%), Security Operations (28%), and Security Program Management and Oversight (20%).

When you finish, grade yourself with the answer keys at the end, review every explanation — including the questions you got right — and note which domains cost you the most points. Study those domains again before attempting another mock.

Questions

1. A security team wants to verify that data has not been altered in transit, but does not need to hide the contents of the data. Which technique BEST meets this requirement?

A. Symmetric encryption
B. Hashing
C. Tokenization
D. Data masking

2. Which of the following BEST describes the purpose of a salt when storing passwords?

A. It encrypts the password so it can be decrypted during login
B. It makes each password hash unique so precomputed rainbow tables cannot be used
C. It increases the password length requirement for users
D. It compresses the hash to save database storage space

3. A company deploys a system that records video of everyone entering the server room and posts a guard at the door. Which control types are these, respectively?

A. Technical and managerial
B. Detective and physical
C. Corrective and deterrent
D. Managerial and technical

4. In a zero trust architecture, which component is responsible for making access decisions based on identity, device health, and context before a session is established?

A. Policy engine
B. Data plane
C. Syslog collector
D. Certificate authority

5. Which TWO of the following are examples of managerial (administrative) controls? (Select TWO)

A. Acceptable use policy
B. Intrusion prevention system
C. Annual security awareness training program
D. Full-disk encryption E. Bollards at a building entrance

6. A web application exchanges session tokens with users. An attacker who steals a token can impersonate a user because the token is a bearer token. Which additional control BEST reduces this risk?

A. Increasing the token length
B. Binding the token to the user's device or IP context and using short expiration times
C. Storing tokens in the URL query string
D. Using the same token for the entire browser session lifetime of 30 days

7. Which cryptographic concept ensures that a sender cannot later deny having sent a signed message?

A. Confidentiality
B. Obfuscation
C. Non-repudiation
D. Diffusion

8. A certificate for a company's web server will expire in 10 days. Which process ensures users continue to trust the site without interruption?

A. Key escrow
B. Certificate renewal and deployment before the expiration date
C. Revoking the certificate and adding it to a CRL
D. Generating a self-signed certificate with a longer validity period

9. An employee receives an email that appears to come from the CEO asking for an urgent wire transfer. The email address domain is one letter different from the real company domain. Which attack is this?

A. Whaling combined with typosquatting
B. Watering hole attack
C. Credential harvesting via a fake captive portal
D. Brand impersonation through a malicious advertisement

10. A vulnerability scan reports that a server is missing a critical patch. Before patching, the administrator wants to confirm the finding is real and not a scanner error. Which technique validates the finding by attempting actual exploitation in a controlled way?

A. Credentialed scanning
B. Penetration testing
C. Threat feed correlation
D. Configuration review

11. Which of the following is the BEST description of a zero-day vulnerability?

A. A vulnerability that has been patched for zero days
B. A vulnerability unknown to the vendor with no patch available when it is discovered or exploited
C. A vulnerability with a CVSS score of 0.0
D. A vulnerability found on the first day of a penetration test

12. An attacker floods a company's DNS servers with traffic from tens of thousands of compromised IoT devices so customers cannot reach the website. Which attack is occurring?

A. DNS poisoning
B. Distributed denial of service using a botnet
C. ARP spoofing
D. On-path attack

13. A user reports that after connecting to a coffee shop Wi-Fi and logging into a fake "Wi-Fi terms" page with corporate credentials, strange logins appeared on their account. Which attack MOST likely occurred?

A. Evil twin
B. Jamming
C. Bluejacking
D. RFID cloning

14. Which indicator would MOST strongly suggest a system is infected with a rootkit rather than ordinary malware?

A. The antivirus keeps finding the same file after each cleanup and reboot
B. Operating system tools report no malicious processes while network traffic shows beaconing to an unknown server
C. The user reports the system is running slowly
D. A browser toolbar was installed without permission

15. An attacker calls the help desk pretending to be an executive's assistant and pressures the technician to reset a password immediately, claiming the executive is about to present to the board. Which influence techniques are being used?

A. Consensus and scarcity
B. Authority and urgency
C. Liking and reciprocity
D. Fear and curiosity

16. Which TWO actions are the MOST effective mitigations against successful phishing campaigns? (Select TWO)

A. User security awareness training with simulated phishing
B. Blocking all external email
C. Email authentication and filtering with DMARC enforcement
D. Disabling all email attachments permanently E. Requiring users to change passwords every 30 days

17. A threat hunter finds a PowerShell process launched by a Word document that downloads a payload entirely in memory, leaving almost no files on disk. This technique is known as:

A. Living off the land / fileless malware execution
B. Logic bomb
C. Keylogging
D. Pass-the-hash

18. An organization's public website was defaced after an attacker used a list of previously breached username and password pairs to log in to an administrator account that had no MFA. Which attack succeeded?

A. Brute force
B. Password spraying
C. Credential stuffing
D. Rainbow table attack

19. Which threat actor type is MOST likely to be motivated by espionage, have essentially unlimited resources, and remain undetected in a network for months?

A. Hacktivist
B. Organized crime group
C. Nation-state advanced persistent threat
D. Insider threat

20. A security analyst sees repeated authentication failures from a single external IP address, each attempt using a different username but the same common password. Which attack is this?

A. Credential stuffing
B. Password spraying
C. Brute force against a single account
D. Dictionary attack against the password hash database

21. Which of the following is an example of a supply chain attack?

A. An employee plugging an unknown USB drive into a workstation
B. A software vendor's update server being compromised so a signed update delivers malware to customers
C. An attacker guessing a weak service account password
D. A user reusing their corporate password on a personal site

22. A penetration tester gains access to a workstation and then uses the captured NTLM hash of a domain admin — without cracking it — to authenticate to other servers. Which technique is this?

A. Kerberoasting
B. Pass-the-hash
C. Golden ticket forgery
D. LLMNR poisoning

23. A company is designing a new application environment using three network segments: a public-facing segment for web servers, a segment for application servers, and a segment for databases. Traffic rules only allow each layer to talk to the next. This design is an example of:

A. A flat network with VLAN tagging
B. Network segmentation using a tiered (multi-zone) architecture
C. A peer-to-peer mesh topology
D. Port mirroring for monitoring

24. Which architecture consideration is MOST important when a company moves a workload containing regulated health data into a public cloud?

A. Choosing the cloud region with the lowest latency
B. Understanding the shared responsibility model and which controls remain the customer's duty
C. Using the largest available instance sizes
D. Enabling public IP addresses for easier management

25. A bank wants customers to confirm high-value transactions using something they have in addition to their password. The bank sends a one-time code to the customer's registered phone. This is an example of:

A. Single sign-on
B. Multifactor authentication
C. Federation
D. Biometric enrollment

26. Which technology BEST protects data at rest on a stolen laptop?

A. TLS 1.3
B. Full-disk encryption
C. A host-based firewall
D. Secure boot

27. A developer needs an API key for a production application. Which storage practice is MOST secure?

A. Hard-coding the key in the application source code
B. Storing the key in a dedicated secrets management vault with rotation
C. Keeping the key in a plaintext file in the application's install folder
D. Emailing the key to the team so everyone has a copy

28. Which TWO controls BEST reduce the impact of a compromised web server in a segmented network? (Select TWO)

A. Placing the web server in a screened subnet (DMZ)
B. Allowing the web server to initiate connections to the internal database on any port
C. Applying the principle of least privilege to the web service account
D. Giving the web server domain administrator rights for easier management E. Storing customer records directly on the web server

29. A company wants to ensure that even if an attacker records encrypted traffic today, they cannot decrypt it years later with a stolen private key. Which property provides this protection?

A. Perfect forward secrecy
B. Key stretching
C. Certificate pinning
D. Symmetric key reuse

30. Which of the following BEST explains why a company would implement a jump server (bastion host) for administrative access to a production environment?

A. It reduces the number of servers that need patching
B. It creates a single hardened, monitored entry point for administrative connections
C. It allows administrators to bypass MFA for faster access
D. It stores backups of the production servers

31. An organization wants to replace passwords for workstation login with cryptographic keys stored on the device, unlocked by a PIN or fingerprint. This passwordless approach is based on:

A. FIDO2 / WebAuthn credentials
B. CHAP authentication
C. RADIUS accounting
D. Kerberos ticket granting

32. Which backup strategy provides the BEST protection against ransomware that encrypts everything it can reach on the network?

A. Hourly snapshots on the same storage array
B. Backups stored on a mapped network drive
C. Immutable or air-gapped backups that the production network cannot modify or delete
D. RAID mirroring on the file server

33. A cloud architect wants development, testing, and production workloads to run in the same cloud provider without being able to reach each other directly. Which design achieves this?

A. One shared virtual network for all environments
B. Separate accounts/subscriptions and virtual networks per environment with controlled peering
C. Public subnets for all environments
D. A single security group applied to every resource

34. Which load-balancing consideration is MOST relevant to security when a session must always return to the same server?

A. Round-robin scheduling
B. Session persistence can complicate patching because a vulnerable server stays in rotation for active sessions
C. Layer 4 versus Layer 7 balancing
D. Health check intervals

35. A security operations analyst receives an alert that a workstation's EDR agent has been disabled by a local administrator account at 3:00 AM, followed by mass file renames with a new extension. Which incident response step should happen FIRST?

A. Eradication of the malware
B. Recovery from backups
C. Containment of the affected workstation
D. Lessons learned meeting

36. Which log source would BEST help an analyst reconstruct exactly which commands an attacker ran on a compromised Linux server?

A. NetFlow records
B. Shell history and authentication/syslog records forwarded to the SIEM
C. DNS query logs only
D. Physical access logs for the data center

37. A company requires that any employee accessing the CRM from a personal device must use a device that is enrolled, encrypted, and running a supported OS version. Which technology enforces these checks at sign-in?

A. Conditional access policies tied to device compliance
B. A VPN concentrator
C. Port security on office switches
D. An email gateway

38. Which TWO settings should be hardened on a newly deployed wireless network for a corporate office? (Select TWO)

A. Use WPA3 (or WPA2/WPA3 transition) with a strong passphrase or 802.1X
B. Broadcast the SSID with the company name and floor number
C. Disable WPS
D. Use the default administrator password for the access points during the first month E. Enable open authentication for guest convenience on the corporate SSID

39. An analyst is tuning a SIEM rule that fires 400 times per day, almost always for a legitimate software update service. What is the BEST approach?

A. Disable the rule entirely
B. Create a narrowly scoped exception for the known service while keeping the rule active for other behavior
C. Raise the alert severity so analysts notice it more
D. Delete the logs from the update service

40. Which of the following describes the PRIMARY security benefit of endpoint detection and response (EDR) over traditional signature-based antivirus?

A. It uses less memory on endpoints
B. It detects and enables investigation of suspicious behavior and techniques, including attacks with no known signature
C. It removes the need for patching
D. It encrypts endpoint disks automatically

41. A security team wants to automatically isolate any endpoint that the EDR flags with a high-confidence malware verdict, then create a ticket. Which capability set provides this?

A. SOAR playbook integrating EDR and the ticketing system
B. A scheduled vulnerability scan
C. A proxy server with content filtering
D. Manual review of daily reports

42. During an investigation, an analyst must preserve a disk image of a suspect system in a way that proves it was not modified after collection. Which practice accomplishes this?

A. Compressing the image to save space
B. Computing a cryptographic hash of the image at collection and verifying it before analysis
C. Storing the image on the suspect system itself
D. Opening the image on the analyst's workstation to rename the files

43. Which order of volatility is correct when collecting evidence from a running system — collect FIRST to LAST?

A. Hard disk, RAM, network connection state, cache
B. Cache, RAM and network connection state, hard disk
C. Cache, hard disk, RAM, network connection state
D. Network connection state, hard disk, cache, RAM

44. Which TWO identity controls BEST reduce the risk of privileged account abuse? (Select TWO)

A. Just-in-time privilege elevation with automatic expiry
B. Shared administrator accounts for the whole team
C. Privileged access management (PAM) with session recording
D. Permanent standing domain admin rights for senior engineers E. Passwords that never expire for service administrators

45. A user in the finance department needs access to the payroll application for a two-week project, after which access must end automatically. Which IAM concept BEST supports this?

A. Permanent role assignment
B. Time-bound (temporary) access grant with an expiration date
C. Group nesting
D. Federation with a social identity provider

46. A company deploys a DLP solution and configures it to block emails containing patterns that match credit card numbers from leaving the organization. Which DLP method is being used?

A. Watermarking
B. Content/pattern matching against known data formats
C. User behavior analytics
D. Endpoint agent tamper protection

47. An analyst notices a workstation making DNS queries for long, random-looking subdomains of a newly registered domain, thousands of times per hour. This MOST likely indicates:

A. A misconfigured NTP client
B. Data exfiltration or command-and-control using DNS tunneling
C. Normal CDN behavior
D. A software update check

48. Which metric BEST shows whether a vulnerability management program is actually reducing risk over time?

A. Total number of vulnerabilities the scanner can detect
B. Mean time to remediate critical vulnerabilities, trending downward
C. Number of scanners deployed
D. Percentage of systems scanned at least once

49. Which TWO hardening actions are MOST important before placing an IoT camera system on a corporate network? (Select TWO)

A. Change default credentials and disable unused services
B. Place the cameras on the same VLAN as executive workstations
C. Isolate the cameras on a dedicated segmented VLAN with restricted outbound access
D. Enable Telnet for easier remote administration E. Disable firmware updates so the configuration never changes

50. An organization performs an acquisition and discovers the acquired company allows split-tunnel VPN with local admin rights for all remote staff. Which risk is MOST increased by this configuration?

A. Attackers can pivot from a compromised home network into the corporate network while endpoint traffic bypasses inspection
B. VPN bandwidth costs increase
C. Users may forget their passwords more often
D. The acquired company's DNS servers respond more slowly

51. A forensic analyst needs to examine a mobile device that may contain evidence. Which step protects the evidence BEFORE analysis begins?

A. Charge the device using the suspect's cable at their desk
B. Place the device in a Faraday bag to block network signals and prevent remote wipe
C. Unlock the device and browse its photos to confirm it is the right phone
D. Connect the device to the corporate Wi-Fi to back it up to the cloud

52. A company wants a single dashboard that correlates alerts from its firewall, EDR, cloud workloads, and email gateway, and supports automated triage. Which solution BEST fits?

A. A syslog server with manual review
B. A SIEM with SOAR integration
C. A packet capture appliance
D. An asset inventory spreadsheet

53. A risk manager must decide what to do about a legacy application that cannot be patched but is still needed by one department. The application is moved to an isolated network segment with strict access rules and enhanced monitoring. Which risk treatment is this?

A. Accept
B. Transfer
C. Mitigate
D. Avoid

54. A company buys cyber insurance to cover part of the financial impact of a breach. Which risk treatment is this?

A. Mitigate
B. Transfer
C. Avoid
D. Accept

55. Which document defines the day-to-day security requirements, rules, and responsibilities that employees must follow — more specific than the high-level policy?

A. A standard (and its supporting procedures)
B. A risk register
C. A memorandum of understanding
D. A business impact analysis

56. Management asks for a report showing the single most likely annual financial loss from a specific threat scenario, using the asset value, exposure factor, and annual rate of occurrence. Which figures produce the annualized loss expectancy (ALE)?

A. ALE = asset value × exposure factor
B. ALE = single loss expectancy × annual rate of occurrence
C. ALE = annual rate of occurrence ÷ single loss expectancy
D. ALE = asset value + exposure factor + annual rate of occurrence

57. Which TWO elements must an effective third-party vendor risk assessment include? (Select TWO)

A. Review of the vendor's security certifications and audit reports (such as SOC 2)
B. The vendor's marketing case studies
C. Assessment of the sensitivity of the data and access the vendor will have
D. The vendor's office location and interior design E. Automatic approval for vendors used by competitors

58. A project team is deploying a new customer portal. Before go-live, leadership asks for an analysis of which business functions would be harmed most if the portal failed, and how long the business could tolerate an outage. This is a:

A. Penetration test
B. Business impact analysis
C. Tabletop exercise
D. Risk assessment

59. Which statement BEST describes the difference between a vulnerability scan and a penetration test for audit and compliance purposes?

A. A vulnerability scan attempts exploitation; a penetration test only lists weaknesses
B. A vulnerability scan identifies and reports potential weaknesses; a penetration test actively attempts to exploit weaknesses to prove impact
C. A penetration test is always automated; a vulnerability scan is always manual
D. There is no difference; the terms are interchangeable

60. An organization must demonstrate PCI DSS compliance for its card payment environment. Which action is REQUIRED on a recurring basis by the standard?

A. Daily full penetration tests
B. Quarterly external vulnerability scans by an approved scanning vendor
C. Monthly password changes for cardholders
D. Annual renewal of all TLS certificates on the same day

61. A security manager is building a data classification scheme. Customer payment data is accidentally stored in a folder labeled "Public." Which additional control BEST prevents disclosure if classification labels fail?

A. A second review of folder names
B. Access controls and DLP rules based on content inspection, not labels alone
C. Training users to be more careful
D. Renaming the folder to "Internal"

62. Which TWO metrics belong in a board-level security report on program effectiveness? (Select TWO)

A. Mean time to detect and mean time to respond to incidents, trending over time
B. The brand of firewall purchased
C. Percentage of critical patches applied within the agreed SLA
D. Number of security staff birthdays this quarter E. The office's average internet speed

63. A company is selecting a new email provider. The security team wants contractual guarantees about uptime, breach notification timelines, and security responsibilities. Which document should contain these terms?

A. The provider's marketing brochure
B. A service-level agreement with a security addendum / data processing agreement
C. The team's internal meeting notes
D. A non-disclosure agreement alone

64. During a change management review, a proposed firewall change has no rollback plan and no testing evidence. What should the change advisory board do?

A. Approve it quickly to avoid delaying the business
B. Reject or defer the change until testing evidence and a rollback plan are provided
C. Approve it if the requester is senior enough
D. Implement it on Friday evening so fewer people notice

65. Which statement BEST describes the purpose of a tabletop exercise?

A. To test whether backups can be restored within the RTO
B. To walk decision-makers through a simulated incident so they can practice roles, decisions, and communication without touching live systems
C. To scan the network for missing patches
D. To measure employee compliance with the clean desk standard

PBQs

PBQ 1 — Firewall ACL Rule Task

Your company runs a web application with this layout:

• Web server: 10.1.1.20 (in the screened subnet / DMZ)
• Application server: 10.2.1.30
• Database server: 10.3.1.40
• Internal user network: 192.168.10.0/24
• Administrator workstation: 192.168.10.5

The firewall between the zones currently has ONLY a default deny rule. Business requirements:

1. Anyone on the internet must be able to reach the web server on HTTPS (TCP 443) only.
2. The web server must be able to query the application server on TCP 8443 only.
3. The application server must be able to query the database server on TCP 5432 only.
4. Only the administrator workstation may manage the web server over SSH (TCP 22).
5. Internal users must NOT be able to reach the database server directly on any port.

Your task: Write the firewall ACL rule set — one line per rule — in the format: ALLOW or DENY | source | destination | port/protocol | purpose Order the rules so the firewall works correctly with a first-match policy, and keep the default deny at the end. Include exactly the rules needed; do not open any extra access.

PBQ 2 — Log Analysis

You are the on-call analyst. At 02:14 the SIEM raises an alert on workstation WS-4471 (user: m.okafor). You pull the following log excerpt:

02:03:11  WS-4471  powershell.exe started by WINWORD.EXE (parent: invoice_Q3.docm)
02:03:14  WS-4471  powershell.exe -enc aQBmACAAKABwAGEAcgBhAG0AcwApAA==  (base64, long string)
02:03:19  WS-4471  outbound connection to 185.220.101.47:4444 (no matching DNS query)
02:04:02  WS-4471  lsass.exe memory accessed by unsigned process "updsvc.exe"
02:04:37  WS-4471  updsvc.exe created scheduled task "WindowsUpdateCheck" (runs at logon)
02:05:10  WS-4471  authentication to FILESVR-02 as m.okafor — SUCCESS (source: WS-4471)
02:06:44  WS-4471  authentication to DBSVR-01 as m.okafor — SUCCESS (source: WS-4471)
02:07:31  WS-4471  large outbound transfer to 185.220.101.47 (212 MB over 4 minutes)

Your task:

1. Identify the initial access vector (how the attacker got in).
2. Identify TWO post-exploitation techniques visible in the log, and name what each one gives the attacker.
3. Explain why the successful logins to FILESVR-02 and DBSVR-01 are alarming even though the password was correct.
4. State the FIRST three response actions you will take, in order, and why order matters.

PBQ 3 — Network Diagram Labeling

A small company is rebuilding its network. The owner bought the following equipment and written on the plan are positions A–F:

                         [ Internet ]
                              |
                          (Position A)
                              |
        +---------------------+---------------------+
        |                                           |
   (Position B)                              (Position C)
   DMZ segment                               Internal switch
   172.16.1.0/24                             192.168.1.0/24
        |                                     |        |
   (Position D)                        (Position E)  (Position F)

Equipment to place: border firewall, public web server, mail relay (SMTP gateway), internal file server, workstation, IDS sensor (to watch traffic entering the internal network)

Requirements from the owner:

• The public web server must be reachable from the internet but must NOT sit on the internal network.
• Incoming email must pass through the mail relay before reaching internal systems.
• The file server holds payroll data and must only be reachable by internal users.
• The IDS sensor must see a copy of traffic as it enters the internal segment.

Your task: Assign each piece of equipment to exactly one position (A–F) and give a one-sentence justification for each placement. Every requirement above must be satisfied by your layout.

PBQ 4 — Incident Response Ordering and Containment Decision

At 09:12 on a Tuesday, the service desk receives three calls within ten minutes: users in Finance cannot open shared spreadsheets; files on the Finance file share are renamed with the extension .locked and a file named README_RESTORE.txt demands payment in cryptocurrency. The EDR console shows the same ransomware signature detonating on two Finance workstations. Finance's file server also hosts the month-end closing files; the company cannot finish payroll on Friday without them. The most recent verified backup of the file server completed at 01:00 last night and is stored on immutable backup storage.

Your task:

1. Put these incident response actions in the correct order (use the standard IR lifecycle): Lessons learned review, Recovery of the file server from the 01:00 backup, Identification/detection confirmation, Containment of affected systems, Eradication of the ransomware and its persistence mechanisms, Preparation (the step that should already have happened before today).
2. Make and justify the containment decision: exactly which systems do you isolate immediately, and do you power them off or keep them running while isolating? Explain your reasoning.
3. The CEO asks you to pay the ransom because payroll is Friday. State the position you recommend and give two reasons.
4. Name two things you must do before reconnecting the restored file server to the production network.

PBQ 5 — Risk Calculation and Treatment

A company's online store database server has an asset value (AV) of $400,000 (hardware, data reconstruction, and lost sales during an outage). Analysis shows a successful ransomware event would cause losses equal to 60% of the asset value (exposure factor, EF). Based on industry data for similar companies, such an event is expected once every 5 years (annual rate of occurrence, ARO).

Your task:

1. Calculate the Single Loss Expectancy (SLE). Show your formula.
2. Calculate the Annualized Loss Expectancy (ALE). Show your formula.
3. A proposed control set (EDR upgrade, immutable backups, and user training) costs $25,000 per year and is expected to reduce the ALE to $6,000 per year. Using the numbers, state whether the control set is financially justified, and show the comparison you used.
4. Even with the controls, some risk remains. Name the term for the risk that remains after controls are applied, and state which risk treatment the company is applying to that remaining risk if leadership signs a document acknowledging it.

Answer Key — Questions

1. B — Hashing produces a fixed-length digest that reveals any change to the data, providing integrity without needing to conceal the content.

2. B — A unique random salt per password means identical passwords produce different hashes, defeating precomputed rainbow tables.

3. B — Video surveillance is a detective control (it records and reveals events), and a posted guard is a physical control.

4. A — In zero trust, the policy engine evaluates identity, device posture, and context and makes the access decision; the policy enforcement point then carries it out.

5. A and C — Policies and a formal training program are managerial/administrative controls. The IPS and disk encryption are technical; bollards are physical.

6. B — Short-lived tokens bound to device/IP context limit the window and usefulness of a stolen bearer token. Lengthening or persisting tokens makes theft more valuable, not less.

7. C — A digital signature provides non-repudiation: the signer cannot credibly deny creating the signed message.

8. B — Renewing and deploying the certificate before expiry prevents trust errors and outages; revocation or self-signing would break trust.

9. A — Targeting the CEO (or impersonating the CEO to reach finance staff) is whaling, and the look-alike domain is typosquatting.

10. B — A penetration test goes beyond reporting a finding and attempts controlled exploitation to confirm the weakness is real and exploitable.

11. B — A zero-day is a vulnerability the vendor does not yet know about (or has not patched) when it is discovered or exploited.

12. B — Traffic from thousands of compromised devices overwhelming a service is a distributed denial of service delivered by a botnet.

13. A — A rogue access point imitating a legitimate one to harvest credentials is an evil twin attack.

14. B — Rootkits hide from the operating system's own tools, so "clean" local reports combined with suspicious network behavior (beaconing) are the classic indicator.

15. B — Impersonating an executive invokes authority, and the "about to present" deadline manufactures urgency to bypass procedure.

16. A and C — Training reduces click rates, and enforced DMARC with filtering stops spoofed mail reaching users. Blocking all external email or attachments is not operationally realistic, and password expiry does not stop phishing.

17. A — Malicious use of legitimate built-in tools (PowerShell) running in memory with few disk artifacts is living off the land / fileless execution.

18. C — Trying known breached username/password pairs against other services is credential stuffing; no MFA allowed it to succeed.

19. C — Nation-state APTs combine espionage motives, deep resources, and long dwell times.

20. B — One common password tried across many different usernames is password spraying — the mirror image of a single-account brute force.

21. B — Compromising a trusted vendor's update mechanism so customers install the malware themselves is a supply chain attack.

22. B — Reusing a captured NTLM hash directly for authentication, without knowing the password, is pass-the-hash.

23. B — Dividing the environment into zones where each tier can only reach the next is network segmentation with a tiered architecture.

24. B — Under the shared responsibility model the customer always retains duties (data, access, configuration); misunderstanding this is the top cause of cloud breaches.

25. B — Password (something you know) plus a code sent to a registered phone (something you have) is multifactor authentication.

26. B — Full-disk encryption protects data at rest; if the laptop is stolen while powered off, the data cannot be read.

27. B — A secrets vault provides protected storage, access control, auditing, and rotation — the secure way to handle API keys.

28. A and C — A screened subnet limits what a compromised web server can reach, and a least-privilege service account limits what the attacker gains. The other options increase exposure.

29. A — Perfect forward secrecy uses ephemeral session keys, so later theft of the server's private key cannot decrypt recorded sessions.

30. B — A jump server funnels all admin access through one hardened, logged, MFA-protected point instead of exposing every server.

31. A — FIDO2/WebAuthn uses device-stored cryptographic credentials unlocked locally by PIN or biometrics — the standard passwordless model.

32. C — Ransomware encrypts or deletes any backup it can reach; immutable or air-gapped backups are outside its reach and remain restorable.

33. B — Separate accounts/subscriptions and networks per environment, with only controlled connections between them, isolates development, test, and production.

34. B — Session persistence keeps users pinned to one server, which complicates taking that server out of rotation for patching or incident response.

35. C — With active ransomware behavior (EDR tampering plus mass file renames), containment comes first to stop the spread before eradication or recovery.

36. B — Shell history plus authentication/syslog records show the commands run and accounts used; flow data shows connections but not commands.

37. A — Conditional access evaluates device compliance signals (enrollment, encryption, OS version) at sign-in and can block or limit non-compliant devices.

38. A and C — Strong WPA3/802.1X authentication and disabling WPS are core wireless hardening steps; default passwords, open auth, and descriptive SSIDs weaken security.

39. B — A narrow exception for the known-benign service preserves the rule's detection value for everything else; disabling it creates a blind spot.

40. B — EDR's value is behavioral detection and investigation of attacker techniques, catching novel attacks that have no signature.

41. A — SOAR playbooks automate the response chain — here, EDR-triggered isolation plus automatic ticket creation.

42. B — Hashing the image at acquisition and re-verifying the hash before analysis proves the evidence was not altered (chain of custody).

43. B — Order of volatility: collect the most volatile data first — CPU cache, then RAM and network connection state, then disk storage.

44. A and C — Just-in-time elevation removes standing privilege, and PAM vaults credentials and records privileged sessions. Shared accounts and permanent admin rights do the opposite.

45. B — A time-bound grant with automatic expiration matches access to the temporary project and removes it without manual follow-up.

46. B — Detecting and blocking content that matches known sensitive data patterns (such as card-number formats) is content/pattern-matching DLP.

47. B — High volumes of long, random subdomain queries are the signature of DNS tunneling, used for command-and-control or exfiltration because DNS is rarely blocked.

48. B — Falling mean time to remediate critical vulnerabilities shows real risk reduction; scan counts and coverage alone do not.

49. A and C — Changed default credentials and a dedicated, restricted VLAN contain the well-known risks of IoT devices. Telnet, shared VLANs with executives, and disabling updates all increase risk.

50. A — Split tunneling plus local admin lets an attacker who compromises the home network or endpoint pivot into the corporate network while traffic bypasses corporate inspection.

51. B — A Faraday bag blocks all radio signals, preventing remote wipe or location/evidence alteration while the device awaits analysis.

52. B — A SIEM correlates events across all those sources, and SOAR adds automated triage and response — matching every element of the requirement.

53. C — Isolation, strict access rules, and monitoring reduce the risk of the unpatched application: that is mitigation (the risk is reduced, not removed or transferred).

54. B — Insurance shifts part of the financial impact to a third party: risk transfer. The underlying risk of an incident still exists.

55. A — Standards (supported by procedures) translate high-level policy into specific, mandatory day-to-day requirements.

56. B — ALE = SLE × ARO: the single loss expectancy multiplied by how often the loss is expected per year.

57. A and C — A vendor assessment must examine independent evidence of the vendor's controls (e.g., SOC 2 reports) and how sensitive the data/access involved is. Marketing material and office décor prove nothing.

58. B — Analyzing which functions are harmed, and tolerable outage durations, is a business impact analysis — it feeds continuity and recovery planning.

59. B — Scans identify and report potential weaknesses, usually without exploiting them; penetration tests actively exploit weaknesses to demonstrate real impact.

60. B — PCI DSS requires quarterly external vulnerability scans by an Approved Scanning Vendor (ASV) for internet-facing cardholder environments.

61. B — Content-based controls — access rules and DLP that inspect the data itself — still protect the data when a human applies the wrong label.

62. A and C — Detection/response times and patch-SLA compliance are outcome metrics a board can act on. Vendor brands, birthdays, and internet speed are not security outcomes.

63. B — Binding commitments on uptime, breach notification, and security duties belong in the SLA and its security/data-processing terms — not in brochures or an NDA alone.

64. B — Change management exists to control risk: without testing evidence and a rollback plan, the board should reject or defer the change regardless of the requester's seniority.

65. B — A tabletop exercise is a discussion-based rehearsal of an incident — roles, decisions, escalation, and communication — with no impact on live systems.

Answer Key — PBQs

PBQ 1 — Firewall ACL Rule Task (5 points)

Model rule set:

What earns the points:

• 1 point: Rule 1 present with port 443 only (an answer allowing any port to the web server loses this point).
• 1 point: Rules 3 and 4 present with the exact ports, in the correct direction — the web server must not be able to reach the database directly.
• 1 point: Rule 2 restricts SSH to the single administrator address 192.168.10.5, not the whole user network.
• 1 point: Requirement 5 satisfied — no rule allows user-network-to-database traffic, and the default deny is retained (an explicit deny rule is the clearest way to show this).
• 1 point: No extra broad rules (no any/any allows, no RDP/SMB exposure, no internet access to the app or database tiers).

PBQ 2 — Log Analysis (5 points)

Model answer:

1. Initial access: A phishing/social-engineering document — the user opened invoice_Q3.docm, a malicious Word macro document, which launched PowerShell. (1 point)
2. Post-exploitation techniques (any two, 1 point total for both, with what each provides):

• Credential dumping — the unsigned process updsvc.exe accessed LSASS memory, which gives the attacker the user's password hashes/credentials for reuse.
• Persistence — the scheduled task "WindowsUpdateCheck" set to run at logon keeps the malware alive across reboots.
• Command and control — the encoded (-enc, base64) PowerShell connected directly to an external IP on port 4444 with no DNS lookup, a classic reverse-shell/C2 pattern.

1. Why the server logins are alarming (1 point): The attacker almost certainly stole m.okafor's credentials from LSASS and is now moving laterally with legitimate credentials. A correct password proves nothing about who is typing it — and the 212 MB outbound transfer to the same external IP indicates likely data theft (exfiltration) has already occurred.
2. First three actions, in order (2 points — order and reasoning both matter):
3. Isolate WS-4471 from the network immediately (EDR network containment or switch port shutdown) — do NOT power it off, so volatile memory evidence is preserved. This stops the C2 channel, the exfiltration, and further lateral movement.
4. Disable m.okafor's account / force a password reset and revoke active sessions — the attacker holds working credentials, so containment of one machine is not enough.
5. Preserve evidence and escalate — declare an incident, capture memory/disk images, and hunt across the environment for the C2 IP 185.220.101.47 and the "WindowsUpdateCheck" task to find any other compromised hosts; also treat FILESVR-02 and DBSVR-01 as potentially compromised and scope what data was accessed.

PBQ 3 — Network Diagram Labeling (5 points)

Model answer:

What earns the points:

• 1 point: Firewall at A (the only position between the internet and everything else).
• 1 point: Web server in the DMZ (B) and NOT on the internal network — placing it at E or F fails the core requirement.
• 1 point: Mail relay in the DMZ (D), in the inbound mail path.
• 1 point: File server on the internal segment (E or F) — payroll data must never sit in the DMZ.
• 1 point: IDS sensor at C watching the internal segment's traffic (via SPAN/mirror), with the workstation in the remaining internal position.

PBQ 4 — Incident Response Ordering and Containment Decision (5 points)

Model answer:

1. Correct order (1 point):
2. Preparation — policies, backups, tooling, and training that must exist before an incident (already done: note the verified immutable backup).
3. Identification / detection — confirm the alerts and reports are a real ransomware incident (done at ~09:12 via EDR and user reports).
4. Containment — stop the spread now (see step 2 below).
5. Eradication — remove the ransomware, its persistence, and the initial access vector; reset compromised credentials.
6. Recovery — restore the file server from the verified 01:00 immutable backup and return systems to service with monitoring.
7. Lessons learned — post-incident review to improve preparation.

1. Containment decision (2 points): Immediately network-isolate — via EDR containment or switch/VLAN isolation — the two Finance workstations, the Finance file server, and any other host showing the same signature; also freeze the Finance share so nothing else can be encrypted. Keep the machines powered on while isolated: powering off destroys volatile memory evidence (and any chance of capturing encryption keys or attacker artifacts) and does nothing isolation doesn't already do. Speed matters more than completeness here — isolate the Finance segment first and widen if the hunt finds more.

1. Ransom position (1 point): Recommend do not pay. Reasons (any two): payment gives no guarantee working decryption keys will be provided; the company has a verified immutable backup from 01:00, so recovery without payment is realistic; paying marks the organization as a payer and funds/further invites criminal activity (and may create legal/sanctions exposure).

1. Before reconnecting the restored server (1 point): (a) Eradicate first — identify and close the initial access vector and reset credentials (especially privileged and service accounts), confirming no persistence remains; and (b) verify the restored data and server are clean — scan with AV/EDR, confirm the EDR agent is healthy, and reconnect in a monitored state so any recurrence is detected immediately.

PBQ 5 — Risk Calculation and Treatment (5 points)

Model answer:

1. SLE (1 point): SLE = AV × EF = $400,000 × 0.60 = $240,000
2. ALE (1 point): ARO = once every 5 years = 0.2 per year. ALE = SLE × ARO = $240,000 × 0.2 = $48,000 per year
3. Cost-benefit (2 points): The controls reduce the ALE from $48,000 to $6,000 — a risk reduction of $48,000 − $6,000 = $42,000 per year. The controls cost $25,000 per year. Because $42,000 (benefit) > $25,000 (cost), the control set is financially justified, with a net benefit of $42,000 − $25,000 = $17,000 per year.
4. Remaining risk (1 point): The risk that remains after controls are applied is residual risk. If leadership formally signs a document acknowledging that remaining $6,000/year risk, the company is applying risk acceptance to the residual risk.