Practice Exam B · Security+

This second full-length practice exam uses entirely new questions, again 90 questions in 90 minutes, weighted to match the SY0-801 domains. Take it under the same conditions as Practice Exam A: one sitting, a timer, and no notes or references. Ideally, leave a few days between the two exams and spend that time reviewing the objectives you missed on Exam A, so that this exam measures whether that review worked rather than whether you remember specific answers. Most questions present a short scenario and ask for the BEST, MOST likely, or FIRST response; roughly one in ten asks you to select TWO answers, and you earn credit only when both choices are correct. Because the real exam also includes performance-based questions and is scored on a 100-900 scale, treat your percentage as an estimate. Target 83 percent (75 of 90) or better on this exam, consistent with your Exam A result, before you book your exam appointment. Each explanation names the objective tested so you can go straight to the relevant chapter.

Questions

1. Employees receive an email that appears to come from the IT department saying their MFA enrollment will expire. The email contains no links, only an image of a QR code to "re-enroll." Users who scan it with their phones are taken to a credential-harvesting page. Which attack is this?

A. Smishing
B. Quishing
C. Vishing
D. Whaling

2. An administrator orders a single certificate for *.example.com. Which of the following hostnames will the certificate secure?

A. example.com and mail.example.com
B. www.example.com and vpn.east.example.com
C. www.example.com and portal.example.com
D. www.example.org and www.example.com

3. A company's antivirus failed to detect an attack in which a legitimate administrative tool was used to dump credentials from memory. The security team wants a solution on each endpoint that continuously records process, file, and network behavior, detects suspicious sequences of activity, and allows analysts to isolate a host remotely. Which solution BEST meets these needs?

A. Endpoint detection and response (EDR)
B. Signature-based antivirus with daily updates
C. A host-based firewall
D. Full disk encryption

4. A college student downloads a ready-made DDoS tool from a forum and launches it against his former high school's website to show off to friends. He has no programming experience. Which threat actor BEST describes him?

A. Hacktivist
B. Nation-state
C. Unskilled attacker
D. Organized crime

5. A web application runs on two servers. When one server fails, users are automatically directed to the other, and during normal operation, traffic is distributed between both to improve performance. Which technology provides both of these benefits?

A. A UPS
B. A cold site
C. Tape backups
D. A load balancer with health checks

6. A production deployment introduces a bug that corrupts a small number of customer records. Rolling back would require restoring the database and losing six hours of legitimate orders. The development team has a tested one-line fix ready and the CAB approves deploying it immediately. Which approach is the team taking?

A. Fail forward
B. Backout plan
C. Standard operating procedure
D. Legacy application isolation

7. An employee uses a public chatbot and enters a carefully crafted role-play scenario that convinces the model to ignore its safety rules and provide step-by-step instructions it is designed to refuse. Which AI threat is this?

A. Jailbreaking
B. Model poisoning
C. Bias
D. Data loss

8. A photo editing website asks a user to "Sign in with Google" and then requests permission to read the user's Google Drive photos. The website never sees the user's Google password and receives a token that only allows reading photos. Which technology is being used?

A. LDAP
B. RADIUS
C. Kerberos
D. OAuth 2.0

9. During an access review, a security analyst finds 140 active accounts belonging to contractors whose projects ended more than a year ago. Several of the passwords have never been changed, and one account was used to log in last week from an unfamiliar IP address. Which vulnerability does this represent?

A. Zero-day vulnerability
B. Unmanaged or stale credentials
C. Misconfigured public object storage
D. Race condition

10. A business impact analysis for a hospital's pharmacy system determines that after 6 hours of downtime, patient safety would be at risk. Which value has the BIA established?

A. Recovery point objective
B. Maximum tolerable downtime
C. Mean time between failures
D. Annualized rate of occurrence

11. A firewall protecting a payment processing network experiences a hardware fault. The security policy requires that if the firewall fails, no traffic should pass, even if this causes an outage. Which failure mode is required?

A. Fail open
B. Fail forward
C. Fail closed
D. Fail over to bypass

12. A vulnerability scanner reports few findings on the company's Windows servers, but a penetration test later finds dozens of missing patches and weak local settings. The scans were run without any account on the target systems. What should the team change to improve scan accuracy?

A. Run credentialed scans using a dedicated scanning account
B. Scan only during business hours
C. Switch to passive network monitoring only
D. Reduce the number of plugins enabled

13. An organization's RADIUS server records when each user connects to the corporate Wi-Fi, how long the session lasts, and how much data was transferred. Which security function does this represent?

A. Identification
B. Authentication
C. Authorization
D. Accounting

14. An attacker sends employees a message through the company's collaboration platform from an external tenant named "IT Help Desk," with a profile picture copied from the internal service desk portal. The message asks users to approve an MFA prompt to "complete a mailbox migration." Which threat vector is being used?

A. Email-based phishing
B. Collaboration tool messaging from an external account
C. SMS-based smishing
D. Malicious QR code

15. A network engineer suspects that a VoIP problem is caused by malformed SIP packets. She needs to capture traffic and inspect individual packet headers and payloads. Which tool is MOST appropriate?

A. NetFlow collector
B. Packet analyzer such as Wireshark
C. SIEM dashboard
D. Vulnerability scanner

16. A retailer keeps its payment systems in its own data center but runs its marketing website and seasonal analytics workloads in a public cloud, with the two environments connected and managed together. Which cloud model is this, and what is a key security challenge?

A. Hybrid cloud; maintaining consistent identity, policy, and monitoring across both environments
B. Community cloud; sharing the environment with competitors
C. Private cloud; lack of provider-managed services
D. Public cloud only; no on-premises responsibilities

17. A former developer's code contains a routine that checks the HR database each night. If his employee ID is ever marked as terminated, the routine deletes the company's production backups. Which type of malicious code is this?

A. Worm
B. Trojan
C. Spyware
D. Logic bomb

18. A hotel wants guests to accept the terms of service and enter their room number and last name before using the guest Wi-Fi. Guest traffic must remain separate from the hotel's business systems. Which solution meets the authentication requirement?

A. WPA3-Enterprise with certificates on each guest device
B. 802.1X with a RADIUS server for each guest
C. A captive portal on an isolated guest network
D. MAC address filtering

19. A company is exploring options for a new security operations platform but has not yet defined detailed requirements. It sends several vendors a document asking them to describe their capabilities, deployment models, and general approach. Which document has the company issued?

A. Request for proposal
B. Request for quotation
C. Statement of work
D. Request for information

20. An administrator generates a certificate signing request (CSR) on a web server to obtain a TLS certificate from a public CA. Which statement about this process is correct?

A. The CA generates the private key and emails it with the certificate
B. The private key is generated and remains on the server; only the public key and identifying information are sent in the CSR
C. The CSR contains both the private and public keys, encrypted with the CA's public key
D. A CSR is only needed for self-signed certificates

21. The security team gathers department heads in a conference room and walks through a hypothetical scenario in which the company's ERP system is encrypted by ransomware, discussing who would make which decisions. No systems are touched. What type of exercise is this?

A. Tabletop exercise
B. Full-scale simulation
C. Failover test
D. Penetration test

22. A SOC subscribes to a free threat feed. Analysts find that many of the listed IP addresses were reassigned to legitimate cloud customers months ago, causing the firewall to block business partners. Which feed quality attribute is MOST lacking?

A. Encryption
B. Volume
C. Timeliness and accuracy
D. Format compatibility

23. A company processes credit card transactions in memory while the payment application calculates fees. Security architects want to protect the card data even while it is being processed, so that a compromised operating system cannot read it. Which data state and protection BEST apply?

A. Data at rest; full disk encryption
B. Data in use; a hardware-based secure enclave or trusted execution environment
C. Data in transit; TLS 1.3
D. Data at rest; tokenization

24. A company is redesigning administrator access to its cloud tenant. Which TWO practices BEST protect privileged accounts? (Select TWO.)

A. Sharing a single global administrator account among the five-person IT team
B. Maintaining two monitored emergency access accounts excluded from conditional access, with credentials stored in a safe
C. Using administrators' everyday email accounts for administrative tasks
D. Requiring separate privileged accounts used only for administration, protected by phishing-resistant MFA
E. Disabling logging for administrator sign-ins to reduce noise

25. Attackers compromise a network monitoring software vendor's build environment and insert a backdoor into the product. The vendor then signs and distributes the backdoored version through its normal update channel to thousands of customers. Which vulnerability does this represent?

A. Malicious update
B. Race condition
C. Unsafe exception handling
D. Rogue device

26. A payment processor's major client terminates its contract early after an audit reveals the processor violated the agreement's data protection clauses. Which type of non-compliance consequence is this?

A. Contractual
B. Loss of license
C. Sanctions
D. Reputational only

27. A security architect is categorizing proposed controls. Which TWO are technical controls? (Select TWO.)

A. Full disk encryption on laptops
B. A security awareness training program
C. An access control list on a router
D. A visitor sign-in log at reception
E. A background check policy for new hires

28. A company is retiring laptops that use self-encrypting SSDs. It wants to reuse the drives in a donation program but must ensure no data can be recovered. Overwriting is unreliable on SSDs because of wear leveling. Which sanitization method is MOST appropriate?

A. Degaussing the drives
B. Cryptographic erase
C. Formatting the drives
D. Deleting user profiles

29. A web application log shows a login request in which the username field contains: admin' OR '1'='1' --. Which attack is being attempted?

A. Cross-site request forgery
B. Directory traversal
C. SQL injection
D. Buffer overflow

30. Administrators currently connect directly from their laptops to production servers over RDP. The security team wants a single hardened, monitored system through which all administrative sessions must pass. What should be deployed?

A. A jump server (bastion host)
B. A honeypot
C. A load balancer
D. A proxy auto-configuration file

31. A company's information security policy requires that sensitive data be encrypted at rest. A separate document requires AES with 256-bit keys for all databases classified as confidential and states that this is mandatory. What type of document is the second one?

A. Standard
B. Guideline
C. Reference architecture
D. Advisory

32. After a security baseline is defined in a configuration management tool, servers that drift from the baseline, for example when someone enables a disabled service, are automatically returned to the defined settings within 30 minutes. Which automation use case is this?

A. Ticket management
B. User provisioning
C. Desired state management
D. Anomaly detection

33. An accounts payable clerk receives an email with an attached Word document titled "Overdue Invoice." When opened, the document displays a banner saying "Enable Content to view this invoice." Enabling it runs code that downloads malware. Which threat vector is this?

A. Malicious QR code
B. Watering hole
C. Browser extension
D. Attachment with an embedded macro

34. A company's recovery plan states that the e-commerce platform will be failed over to the secondary region twice a year by actually switching production traffic and confirming operations. Which type of testing is this?

A. Failover testing
B. Tabletop exercise
C. Parallel processing test
D. Simulation

35. A forensic examiner must acquire a suspect's hard drive for a case that may go to court. Which procedure BEST preserves evidence integrity?

A. Boot the suspect's computer and copy the user's documents to a USB drive
B. Use the operating system's file copy function to back up the drive
C. Scan the drive with antivirus before imaging to remove malware
D. Use a hardware write blocker to create a bit-level image and record hash values of the original and the image

36. An engineer at a rival manufacturer is paid by his employer to obtain the design files for a competitor's new battery technology through a phishing campaign. Which actor and motivation BEST describe the threat?

A. Competitor; intellectual property theft
B. Hacktivist; ideological
C. Insider; revenge
D. Unskilled attacker; notoriety

37. A company wants receiving mail servers to verify that the content of its outgoing messages was not altered in transit and that the messages were authorized by the domain. Which mechanism adds a cryptographic signature to each message header for this purpose?

A. SPF
B. BIMI
C. MX records
D. DKIM

38. After a network redesign moves the payment servers to a new VLAN and adds a firewall, an incident responder working a weekend outage relies on the network diagram and spends two hours looking for servers in the wrong subnet. Which change management step was MOST likely skipped?

A. Test results review
B. Backout planning
C. Updating diagrams and documentation
D. Stakeholder approval

39. A user receives dozens of push notifications from her authenticator app late at night asking her to approve a sign-in. Eventually she taps Approve to make them stop. The next morning, the security team sees a successful login from a foreign IP. Which attack occurred?

A. SIM swapping
B. MFA fatigue (push bombing) to bypass MFA
C. Password spraying
D. Session replay

40. A university wants to share student performance data with outside researchers. Names, student IDs, and birth dates must be removed or transformed so that individuals cannot reasonably be identified, while keeping the data useful for statistics. Which method BEST meets this need?

A. Encryption with a key provided to the researchers
B. Data masking on the student portal
C. Tokenization with the token vault shared with researchers
D. Deidentification (anonymization)

41. A vulnerability bulletin refers to "CVE-2026-31337." What does this identifier provide?

A. A severity score from 0 to 10
B. The vendor's patch download link
C. A list of affected organizations
D. A unique, standardized identifier for a publicly disclosed vulnerability

42. A hospital creates groups named Nurse, Physician, and Pharmacist, assigns permissions to each group based on job duties, and places staff in the group matching their position. When a nurse transfers to pharmacy, IT simply moves her to the Pharmacist group. Which access control model is in use?

A. Role-based access control
B. Mandatory access control
C. Discretionary access control
D. Rule-based access control

43. A company plans to achieve ISO/IEC 27001 certification next year. Before hiring an external auditor, it compares its current controls against the standard's requirements to identify what is missing. What is this activity called?

A. Penetration test
B. Gap analysis
C. Regulatory examination
D. Benchmarking against competitors

44. A company splits its monolithic e-commerce application into dozens of small, independently deployable services that communicate through APIs. Which security implication is MOST significant?

A. A single vulnerability will always compromise the entire application
B. The attack surface shrinks because there are fewer network connections
C. Service-to-service communication must be authenticated and encrypted, and each API becomes a potential entry point
D. Patching becomes impossible because services cannot be updated individually

45. A company deploys monitoring software on each server to collect logs, file integrity data, and process information and send it to the SIEM. A colleague suggests polling some network appliances instead because software cannot be installed on them. What is the distinction being discussed?

A. Active versus passive scanning
B. Alerting versus archiving
C. Agent-based versus agentless monitoring
D. NetFlow versus IPFIX

46. A hospital still runs several workstations on an operating system version that reached end of support three years ago. The workstations control legacy imaging equipment. What is the PRIMARY security concern?

A. The workstations cannot connect to the network
B. Users cannot log in with domain accounts
C. The vendor no longer releases security patches, so newly discovered vulnerabilities remain unfixed
D. The workstations' data is automatically deleted at end of support

47. A company is building an internal certificate authority. The security architect insists that the root CA's private key be generated and stored in a tamper-resistant device that never allows the key to be exported. Which device meets this requirement?

A. A USB flash drive stored in a safe
B. A password-protected PFX file on a file server
C. A hardware security module (HSM)
D. A self-signed certificate

48. Without any alert being triggered, a security analyst forms a hypothesis that attackers may be using DNS tunneling and searches DNS logs for unusually long subdomains and high query volumes to rare domains. What activity is she performing?

A. Vulnerability scanning
B. Threat hunting
C. Penetration testing
D. Eradication

49. A company must deliver security onboarding training to 4,000 new and existing employees across six time zones, let them complete it at their own pace, and produce completion reports for auditors. Which delivery method BEST fits?

A. A learning management system (LMS)
B. One-to-one coaching sessions
C. A single live presentation at headquarters
D. Posters in the break rooms

50. During a review of a retail store's security incidents, investigators find two physical attacks. Which TWO are physical attack types listed below? (Select TWO.)

A. A card reader overlay placed on a self-checkout terminal to capture customers' card data
B. A text message claiming to be from the store's bank
C. A DNS cache poisoning attack against the store's resolver
D. SQL injection against the store's loyalty website
E. A person following an employee through a badge-controlled stockroom door without badging

51. A team is building a new Linux web server. The base image includes an FTP service, a printing service, and a sample application, none of which the server needs. What should the team do, and why?

A. Leave them running in case they are needed later
B. Remove or disable them to reduce the attack surface
C. Move them to a non-standard port
D. Document them in the asset inventory and leave them unchanged

52. Before a major release of an online banking application, the security team has two experienced developers manually examine the authentication and session-handling modules line by line, looking for logic flaws that automated tools may miss. Which vulnerability identification method is this?

A. Network vulnerability scanning
B. Cloud security posture management
C. Source code review
D. Dynamic penetration testing

53. A user installs a free browser extension that promises to find discount coupons. It requests permission to "read and change all your data on all websites." Weeks later, the user's webmail session is hijacked. What is the MOST likely vector?

A. The extension captured session cookies and sent them to the attacker
B. A malicious USB device
C. A rogue access point
D. A logic bomb in the webmail server

54. A company's web application connects to its database using an account that has database owner rights, although the application only needs to read product prices. An attacker exploits a flaw and drops several tables. Which principle, if applied, would have MOST limited the damage?

A. Defense in depth
B. Least privilege
C. Non-repudiation
D. Availability

55. A security team automates user onboarding: when HR enters a new hire in the HR system, accounts are created, group memberships are assigned by job code, and a laptop request ticket is opened. Which intended outcomes does this automation MOST directly deliver?

A. Increased complexity and higher process risk
B. Elimination of the need for access reviews
C. Removal of all manual steps from offboarding
D. Time savings and consistent enforcement of access baselines

56. A server has a mean time between failures (MTBF) of 50,000 hours, and when it fails, technicians take an average of 4 hours to restore it. What does the 4-hour figure represent?

A. RPO
B. MTTR
C. RTO
D. MTD

57. While logged in to her bank, a user opens another tab and visits a forum post that contains a hidden image tag whose source URL is the bank's transfer endpoint with the attacker's account number. The bank processes the transfer using the user's session cookie. Which attack is this?

A. Cross-site scripting
B. Directory traversal
C. SQL injection
D. Cross-site request forgery

58. A risk team estimates that laptop theft costs $4,000 per incident (SLE) and occurs 10 times per year. A full disk encryption and tracking solution costing $12,000 per year would reduce the ARO to 6 and the SLE to $1,500. What is the annual benefit of the solution after its cost?

A. $9,000
B. $31,000
C. $28,000
D. $19,000

59. An administrator configures a Linux server so that even if the web server process is compromised, it cannot read files outside the web content directory, regardless of standard file permissions. Which technology enforces this mandatory policy?

A. Group Policy
B. SELinux in enforcing mode
C. A host-based IDS in detection mode
D. Antivirus

60. A help desk employee pastes a customer's account details and an internal network diagram into a public generative AI chatbot to draft a troubleshooting email. The chatbot provider's terms allow it to use submitted content to improve its models. Which AI-related risk is MOST directly illustrated?

A. Model evasion
B. Hallucination
C. Bias
D. Data loss and privacy exposure

61. A government agency classifies its information. Which classification describes information whose unauthorized disclosure could reasonably be expected to cause exceptionally grave damage to national security?

A. Top secret
B. Secret
C. Confidential
D. Public

62. A change request to replace an aging HR application server is submitted. The CAB asks who is accountable for the change and who will be affected, including payroll, benefits administrators, and the help desk. Which two change management concepts does the CAB's question address?

A. Version control and allow lists
B. Downtime and service restart
C. Test results and backout plans
D. Ownership and stakeholders

63. An analyst reviewing Windows security logs on a domain controller finds 2,300 events with ID 4625 for the same username within ten minutes, followed by a single event ID 4624 for that username from the same source IP. What does this pattern MOST likely indicate?

A. A successful brute-force attack against that account
B. A normal user who forgot a password
C. Log manipulation to hide activity
D. A legitimate service account authenticating once

64. A network administrator mistakenly applies a firewall rule that exposes an internal database to the internet while troubleshooting a connectivity problem. There was no malicious intent. Which threat actor type does this represent?

A. Malicious insider
B. Accidental or unintentional insider
C. Hacktivist
D. Shadow IT

65. A company requires that all new network equipment be purchased only from authorized resellers, that the vendor be assessed for security practices, and that firmware integrity be verified on receipt. Which asset life cycle phase do these requirements address?

A. Acquisition/procurement
B. Assignment/accounting
C. Monitoring/asset tracking
D. Disposal/decommissioning

66. A company connects two branch offices to headquarters over the internet. The network team wants the entire original IP packet, including its internal source and destination addresses, encrypted and encapsulated between the sites' firewalls. Which solution meets this requirement?

A. IPsec in transport mode between individual hosts
B. A clientless SSL VPN portal
C. GRE tunnels without encryption
D. Site-to-site IPsec VPN in tunnel mode

67. A security team is mapping its controls to the CIA triad. Which TWO controls PRIMARILY protect integrity? (Select TWO.)

A. File integrity monitoring that compares system files against known-good hashes
B. A redundant power supply in each server
C. Encrypting backup tapes with AES-256
D. Digitally signing software releases
E. A load balancer in front of the web servers

68. Before a penetration testing firm begins work, the company and the firm sign a document specifying which IP ranges are in scope, testing hours, prohibited techniques such as denial of service, and emergency contacts. What is this document?

A. Rules of engagement
B. Non-disclosure agreement
C. Service-level agreement
D. Master service agreement

69. A company issues laptops to traveling consultants. If a laptop is stolen, all data including the operating system, temporary files, and swap space must be unreadable without the user's credentials. Which encryption level BEST meets this requirement?

A. File-level encryption
B. Database encryption
C. Record-level encryption
D. Full disk encryption tied to a TPM and pre-boot authentication

70. A breach exposes the personal information of 40,000 customers in several US states. Legal counsel states that state laws require notifying affected individuals and, in some states, the attorney general, within specific time frames. Which incident response activity does this describe?

A. Eradication
B. Lessons learned
C. Mandatory notification and external reporting
D. Threat hunting

71. A risk manager wants to present risks to the board using quantitative analysis. Which TWO values would appear in a quantitative risk analysis? (Select TWO.)

A. A heat map rating likelihood as "high"
B. An impact rating of "moderate"
C. A single loss expectancy of $85,000
D. A risk owner's opinion that the risk is "unlikely"
E. An annualized rate of occurrence of 0.2

72. A company runs its customer database on VMs in a public IaaS cloud. Which security responsibility belongs to the company rather than the cloud provider?

A. Physical security of the data center
B. Maintaining the hypervisor
C. Replacing failed storage hardware
D. Patching the guest operating systems and configuring security groups

73. A bank opening a new online account asks the applicant to photograph a government-issued ID and take a live selfie, then compares the two and checks the ID against an issuing authority's database before creating credentials. What is this process called?

A. Federation
B. Access review
C. Identity proofing
D. Privilege escalation

74. A company wants to stop employees from uploading files containing customer Social Security numbers to personal webmail and cloud storage, whether employees are in the office or working remotely. Which TWO approaches would MOST directly accomplish this? (Select TWO.)

A. An agent-based DLP solution on endpoints
B. A honeypot on the internal network
C. A NIDS monitoring the data center
D. Full disk encryption on laptops
E. A centralized proxy with DLP inspection that remote traffic is routed through

75. A scanner reports a CVSS 3.1 base score of 8.1 for a vulnerability on an internal HR server. The organization updates the score using its own environmental metrics, noting that the server is accessible only from a management subnet and contains no regulated data. What is the purpose of this adjustment?

A. To change the CVE identifier for the vulnerability
B. To reflect the vulnerability's actual risk in the organization's specific environment for prioritization
C. To report the lower score to the vendor as the official base score
D. To eliminate the need to remediate

76. A state banking regulator finds that a money transmitter has repeatedly failed to implement required anti-money-laundering and security controls despite earlier warnings. The regulator revokes the company's authorization to operate in the state. Which consequence of non-compliance is this?

A. Reputational damage
B. Contractual penalty
C. Acknowledgement failure
D. Loss of license

77. An online retailer expects traffic to triple during a holiday sale and wants the application to remain available even if a server fails. Which TWO capabilities BEST meet these goals? (Select TWO.)

A. Cold site
B. Weekly tape backups
C. Autoscaling of web servers based on load
D. Clustering of database servers with automatic failover
E. A larger single server

78. A security analyst finds a JPEG image in an employee's outbound email whose size is much larger than expected. Analysis shows a spreadsheet of customer data hidden within the image's pixel data. Which technique was used to conceal the data?

A. Hashing
B. Steganography
C. Tokenization
D. Key stretching

79. A company's SIEM keeps logs searchable for 90 days, but regulations require that security logs be retained for seven years. What should the company implement?

A. Alert tuning to reduce log volume
B. Deleting older logs to stay within license limits
C. Increasing the number of correlation rules
D. Log archiving to lower-cost, protected storage with integrity controls

80. A company's employees can reach internal servers from home through a VNC service exposed directly to the internet on TCP 5900, protected only by an eight-character password. Which threat vector does this create?

A. Supply chain
B. Watering hole
C. Remote access service exposed to the internet
D. Embedded macro

81. During a major breach, the incident response team needs to disconnect a business unit's servers, but the business unit's manager refuses, saying the team has no authority over his systems. Which governance artifact should establish the IR team's authority in advance?

A. Acceptable use policy
B. Data classification policy
C. Incident response policy
D. Implementation guide

82. A security team runs scans and discovers devices on the network that are not in the asset inventory. It wants an authoritative record of IP address assignments, DHCP leases, and DNS records to help identify unknown devices. Which tool should it use?

A. CSPM
B. IPAM
C. SOAR
D. DLP

83. After an incident, analysts document each adversary action, such as phishing for initial access, credential dumping, and lateral movement over SMB, and map each to standardized tactic and technique IDs to identify detection gaps. Which reference source are they using?

A. CVSS
B. The Diamond Model of Intrusion Analysis
C. MITRE ATT&CK
D. ISO/IEC 27001

84. A company's data retention policy requires that customer support recordings be kept for 18 months and then destroyed. Which phase of the data life cycle does the destruction requirement address?

A. Creation
B. Distribution
C. Disposal
D. Management

85. A Canadian health insurer is selecting a SaaS claims-processing platform. Provincial law requires that personal health information be stored and processed in Canada, and the insurer classifies claims data as restricted. Which TWO business considerations should MOST influence the choice of provider? (Select TWO.)

A. The compute instance types the provider uses internally
B. Data sovereignty and the location of the provider's data centers and support staff
C. Whether the provider publishes its source code
D. Data classification and the controls required for restricted data
E. The environmental requirements of the provider's corporate offices

86. After malware infects a workstation, the IT team reimages it from a known-good image and restores the user's files from backup. Which control type do these actions represent?

A. Detective
B. Corrective
C. Deterring
D. Directive

87. An employee finds a USB charging cable in a hotel business center and uses it to charge her company laptop. The security team explains that some cables contain hidden chips that can act as a keyboard or wireless implant. Which awareness training topic covers this risk?

A. Business email compromise
B. Removable media and cables
C. Password management
D. Anti-bribery

88. An organization relies on a legacy inventory application that runs on an unsupported database version. A planned database upgrade would break the application, which cannot be modified because the vendor is out of business. What is the MOST significant technical implication for change management?

A. The change can proceed without testing because the database vendor supports the new version
B. The dependency must be identified and addressed before the change, possibly by isolating the legacy system or delaying the upgrade
C. The change should be classified as a standard change
D. The application can be added to the deny list

89. A security review of a company's network finds several issues. Which TWO represent vulnerabilities in wireless and low-powered communications? (Select TWO.)

A. Warehouse barcode scanners that only support WEP
B. Bluetooth-enabled badge printers using default pairing PINs
C. A file server missing a Windows patch
D. A web application vulnerable to SQL injection
E. An expired TLS certificate on the intranet

90. A company protects its internet perimeter with two firewalls in series: one from Vendor X at the edge and one from Vendor Y between the screened subnet and the internal network. What security concept does using different vendors provide?

A. Fail-open protection
B. Port mirroring
C. Out-of-band management
D. Vendor diversity, so a single vulnerability is less likely to defeat both layers Answers and Explanations

1. B. (Objective 2.5) Quishing is phishing using QR codes. Embedding the malicious URL in an image helps the message evade email link scanning, and scanning it on a personal phone moves the victim outside the protection of corporate web filtering. Smishing uses SMS, vishing uses voice calls, and whaling targets senior executives.
2. C. (Objective 1.3) A wildcard certificate covers any single label in the position of the asterisk, so www.example.com and portal.example.com are valid. It does not cover the bare domain example.com (unless that name is added as a subject alternative name), it does not cover a second level of subdomain such as vpn.east.example.com, and it never covers a different domain such as example.org.
3. A. (Objective 4.1) EDR agents collect detailed endpoint telemetry, use behavioral analytics to detect techniques that signature-based antivirus misses, and provide response actions such as host isolation, process termination, and forensic data collection. More frequent signature updates still miss abuse of legitimate tools. A host firewall controls network connections but does not analyze process behavior. Full disk encryption protects data at rest on a lost device.
4. C. (Objective 2.2) An unskilled attacker (sometimes called a script kiddie) uses tools and exploits created by others without deep understanding, often for notoriety or curiosity, and has few resources. A hacktivist acts for a political or social cause. A nation-state is highly resourced and pursues strategic objectives. Organized crime is profit-driven and well organized.
5. D. (Objective 3.4) A load balancer distributes traffic across multiple servers for performance and scalability and uses health checks to stop sending traffic to a failed server, providing high availability. A UPS provides short-term power. A cold site is an alternate facility with minimal equipment. Tape backups support restoring data, not real-time traffic distribution.
6. A. (Objective 1.2) Failing forward means resolving a problem by deploying a new change (a fix) rather than reverting to the previous state. It is chosen when rolling back would cause more harm than moving ahead, as with the loss of six hours of orders here. A backout plan reverts the change. An SOP is a documented routine procedure. Isolating a legacy application is unrelated to the decision.
7. A. (Objective 2.6) Jailbreaking uses crafted prompts, such as role-play, hypothetical framing, or encoding tricks, to bypass the safety guardrails built into a model. Poisoning corrupts training data. Bias produces systematically unfair outputs. Data loss involves sensitive information leaving the organization, such as an employee pasting confidential data into a chatbot.
8. D. (Objective 4.5) OAuth 2.0 is an authorization framework that lets a user grant a third-party application limited (scoped) access to resources at another service, using access tokens instead of sharing the password. OpenID Connect adds an authentication layer on top of OAuth for the sign-in part. LDAP queries directories. RADIUS provides network access AAA. Kerberos is a ticket-based authentication protocol within enterprise realms.
9. B. (Objective 2.4) Accounts that remain active after they are no longer needed, with unchanged passwords, are stale credentials that attackers can use without being noticed because no legitimate owner is watching. Deprovisioning processes and regular access reviews prevent them. A zero-day is an unknown software flaw. Public object storage and race conditions are unrelated.
10. B. (Objective 5.2) The maximum tolerable downtime (MTD) is the longest a business function can be unavailable before causing unacceptable harm. The BIA identifies MTD, and the RTO must be set below it. RPO is the acceptable data loss window. MTBF measures reliability. ARO is the expected number of occurrences of a risk per year.
11. C. (Objective 3.2) A fail-closed (fail-secure) device blocks all traffic when it fails, prioritizing confidentiality and integrity over availability. Fail-open allows traffic to pass unfiltered, prioritizing availability, which is sometimes chosen for life-safety systems or non-critical IPS deployments. Fail forward is a change management concept. A bypass would send traffic around the firewall, which violates the policy.
12. A. (Objective 4.3) Non-credentialed scans see only what is exposed over the network, such as open ports and service banners. Credentialed scans log in and inspect installed software, patch levels, registry settings, and configurations, producing far more accurate results and fewer false negatives. The scanning account should be dedicated, tightly controlled, and monitored. Timing, passive monitoring, and fewer plugins would not reveal missing local patches.
13. D. (Objective 1.1) Accounting tracks what users do and the resources they consume, such as session start and end times and data transferred, producing records used for auditing, billing, and investigations. Identification is claiming an identity, authentication is proving it, and authorization determines what an authenticated user may do.
14. B. (Objective 2.3) The attacker is abusing external access in a collaboration tool (such as chat in Microsoft Teams or Slack) to impersonate the help desk. Users often trust these messages more than email, and they may bypass email filtering. Organizations can restrict external federation and label external senders. The message did not arrive by email, SMS, or QR code.
15. B. (Objective 4.4) A packet analyzer captures full packets and decodes protocol fields so an analyst can examine headers and payloads in detail. NetFlow provides only flow metadata (who talked to whom, how much) without packet contents. A SIEM dashboard summarizes events from logs. A vulnerability scanner identifies weaknesses but does not capture live traffic.
16. A. (Objective 3.1) A hybrid cloud combines on-premises (or private cloud) and public cloud environments. Its main security challenges include consistent identity management, security policies, logging, and secure connectivity across environments with different tools. A community cloud is shared among organizations with common requirements. The retailer is not using a private or public cloud exclusively.
17. D. (Objective 2.5) A logic bomb is malicious code that remains dormant until a specific condition is met, such as a date, an event, or (here) a change in employment status. Code review and separation of duties help detect them. A worm self-replicates across networks. A Trojan masquerades as legitimate software. Spyware secretly collects information.
18. C. (Objective 4.1) A captive portal intercepts a new user's web traffic and presents a page where they must accept terms or enter information before gaining access. Combined with an isolated guest VLAN, it meets both requirements. Certificates or 802.1X credentials for every guest are impractical. MAC filtering requires knowing devices in advance and is easily spoofed.
19. D. (Objective 5.3) A request for information (RFI) gathers general information about vendors and their capabilities early in the selection process, before detailed requirements exist. A request for proposal (RFP) asks vendors for a detailed solution against defined requirements. A request for quotation (RFQ) asks for pricing on a well-defined product or service. A statement of work defines tasks and deliverables after a vendor is chosen.
20. B. (Objective 1.3) When a CSR is generated, a key pair is created locally. The CSR contains the public key and subject details (such as the common name and SANs) and is signed with the private key to prove possession, but the private key itself never leaves the server. The CA signs a certificate binding the public key to the identity. A CA that generates and sends private keys undermines their secrecy. Self-signed certificates are generated without submitting a CSR to an external CA.
21. A. (Objective 4.7) A tabletop exercise is a discussion-based session in which participants talk through their roles and responses to a scenario, revealing gaps in plans, communication, and decision-making at low cost and with no impact on systems. A full simulation involves performing actions in a realistic environment. A failover test switches systems to backups. A penetration test actively attacks systems.
22. C. (Objective 2.1) Threat intelligence is useful only if it is timely, accurate, and relevant. Stale indicators, especially cloud IP addresses that are frequently reassigned, cause false positives and business disruption. Indicators should carry confidence scores and expiration dates. Encryption, volume, and format compatibility do not address outdated data; a larger volume of stale data makes the problem worse.
23. B. (Objective 3.3) Data in use is being processed in memory or by the CPU. Secure enclaves and trusted execution environments isolate processing so that even the operating system or hypervisor cannot read the data. Full disk encryption and tokenization protect stored data at rest. TLS protects data moving across a network.
24. B, D. (Objective 4.5) Break-glass (emergency access) accounts ensure that administrators can regain access if MFA, federation, or conditional access fails; they must be tightly secured and every use monitored. Separate privileged accounts with strong MFA limit exposure, since everyday accounts are exposed to phishing and web browsing. Shared accounts destroy accountability. Using everyday accounts for admin work increases risk. Disabling admin sign-in logging removes visibility into the most sensitive activity.
25. A. (Objective 2.4) A malicious update abuses a trusted software update mechanism to deliver malicious code. Because the update is properly signed and comes from the legitimate vendor, customers' controls trust it. Defenses include vendor risk assessment, monitoring new versions' behavior, staging updates, and limiting the privileges of management tools. Race conditions and unsafe exception handling are coding flaws, and a rogue device is unauthorized hardware.
26. A. (Objective 5.4) Contractual consequences arise when non-compliance breaches the terms of an agreement, allowing the other party to terminate, withhold payment, or claim damages. Loss of license is revocation of a regulatory permission to operate. Sanctions are penalties imposed by governments or regulators. Reputational damage may follow, but the direct consequence described is contract termination.
27. A, C. (Objective 1.1) Technical (logical) controls are implemented through technology: encryption and router ACLs both qualify. Awareness training is an operational control carried out by people. A visitor log is an operational or physical control. A background check policy is managerial (administrative).
28. B. (Objective 4.2) Cryptographic erase destroys the media encryption key on a self-encrypting drive, rendering all data unreadable instantly while leaving the drive reusable. Degaussing does not affect SSDs, which store data in flash memory rather than magnetically. Formatting and deleting profiles leave data recoverable.
29. C. (Objective 2.5) The single quote breaks out of the SQL string, OR '1'='1' makes the condition always true, and -- comments out the rest of the query, a classic SQL injection authentication bypass. Parameterized queries (prepared statements) prevent it. CSRF tricks a browser into submitting requests. Directory traversal uses ../ sequences. A buffer overflow sends excessive data to overwrite memory.
30. A. (Objective 3.2) A jump server or bastion host is a hardened system that sits between administrators and sensitive servers; all administrative access flows through it, enabling strong authentication, session recording, and a single point to control access. A honeypot is a decoy. A load balancer distributes user traffic. A PAC file configures browser proxy settings.
31. A. (Objective 5.1) A standard defines specific, mandatory requirements that implement a policy, such as approved algorithms and key lengths. A guideline is recommended but optional. A reference architecture is a model design for a solution. An advisory communicates information about a threat or vulnerability.
32. C. (Objective 4.6) Desired state management (desired state configuration) defines how systems should be configured and continuously enforces that state, correcting drift automatically. This enforces baselines at scale. Ticket management automates creation and routing of tickets. User provisioning creates and modifies accounts. Anomaly detection identifies unusual behavior but does not itself restore configurations.
33. D. (Objective 2.3) Office documents can contain macros (VBA code) that run when the user enables content, and social engineering lures persuade users to do so. Blocking macros in files from the internet and filtering attachments are key defenses. No QR code, compromised website, or browser extension is involved.
34. A. (Objective 3.4) Failover testing actually switches operations to backup systems or sites to prove they work. It provides the most realistic assurance but carries some risk of disruption. A tabletop exercise is a discussion only. A parallel processing test runs the backup system alongside production with the same inputs without cutting over. A simulation walks through a scenario in a controlled setting without switching production.
35. D. (Objective 4.8) A write blocker prevents any changes to the original drive. A bit-level (forensic) image captures every sector, including deleted files and slack space. Matching hash values of the original and the image prove the copy is exact. Booting the computer and copying files changes metadata and misses unallocated space. Antivirus scanning can alter or delete evidence.
36. A. (Objective 2.2) A competitor seeking another company's designs is pursuing intellectual property for business advantage (corporate espionage). Hacktivists act for causes, insiders act from inside the target organization, and unskilled attackers lack the focus and resources to pursue specific trade secrets.
37. D. (Objective 4.1) DomainKeys Identified Mail (DKIM) signs selected headers and the body with a private key; receivers retrieve the public key from DNS to verify the signature, confirming the message came from the domain and was not modified. SPF lists authorized sending IP addresses but does not sign anything. BIMI displays a brand logo. MX records direct inbound mail delivery.
38. C. (Objective 1.2) Change management includes updating documentation, such as network diagrams, policies, and procedures, after a change is implemented so that others can rely on accurate information. Outdated diagrams slow incident response and troubleshooting. Test results, backout planning, and approvals are important but do not address the outdated diagram.
39. B. (Objective 2.5) MFA fatigue (push bombing) floods a user with approval requests after the attacker has obtained the password, hoping the user will approve one out of annoyance or confusion. Number matching, additional context in prompts, and phishing-resistant MFA mitigate it. SIM swapping hijacks a phone number to intercept SMS codes. Password spraying is the guessing that may have preceded this. Session replay reuses a captured session token without any MFA prompt.
40. D. (Objective 3.3) Deidentification removes or alters identifiers so that data can no longer reasonably be linked to individuals, which supports research use and reduces privacy obligations. Encrypting the data and giving researchers the key, or sharing a token vault, would give them identifiable data. Masking on the portal affects only what is displayed, not the dataset being shared.
41. D. (Objective 2.1) The Common Vulnerabilities and Exposures (CVE) system assigns unique identifiers to publicly known vulnerabilities so that vendors, scanners, and defenders can refer to the same issue consistently. Severity is expressed separately with CVSS. CVE records contain descriptions and references but are not patch download links or lists of victims.
42. A. (Objective 4.5) Role-based access control assigns permissions to roles that reflect job functions, and users get permissions through role membership. Moving the user between roles changes her access cleanly and helps prevent privilege creep. Mandatory access control uses labels and clearances. Discretionary access control lets data owners grant access. Rule-based access control applies conditions, such as time or source address, that apply to everyone.
43. B. (Objective 5.5) A gap analysis compares the current state with a target state, such as a standard's requirements, and identifies the gaps that must be closed. A penetration test actively attacks systems. A regulatory examination is conducted by a regulator. Benchmarking compares performance with peers or best practices rather than a specific set of requirements.
44. C. (Objective 3.1) Microservices increase the number of network interfaces and APIs, so each must be secured with authentication, authorization, and encryption (often via an API gateway or service mesh with mutual TLS). On the positive side, a compromise of one service can be contained, so it does not always compromise everything. The attack surface grows rather than shrinks, and services can be patched independently.
45. C. (Objective 4.4) Agent-based monitoring installs software on the host, enabling deep visibility such as local logs and process data. Agentless monitoring uses remote methods, such as syslog, SNMP, APIs, or remote queries, for systems where agents cannot be installed, at the cost of less detail. Active versus passive scanning concerns how scanners interact with targets. Alerting and archiving are monitoring activities. NetFlow and IPFIX are flow export formats.
46. C. (Objective 2.4) Unsupported (end-of-life) products no longer receive security updates, so every vulnerability discovered after the end-of-support date remains permanently exploitable. Organizations should replace them or, where that is not yet possible, isolate them and apply compensating controls. End of support does not prevent network connections, domain logins, or delete data.
47. C. (Objective 1.3) An HSM is a dedicated, tamper-resistant hardware device that generates, stores, and uses cryptographic keys without exposing them; it serves as a hardware root of trust for a PKI. Keys on flash drives or in PFX files can be copied. A self-signed certificate is how a root CA certificate is typically created, but it is not a protected storage mechanism for the private key.
48. B. (Objective 4.7) Threat hunting is a proactive, hypothesis-driven search for threats that have evaded automated detection. A vulnerability scan looks for weaknesses, not active attackers. A penetration test simulates attacks. Eradication removes a threat after it is found and contained.
49. A. (Objective 5.6) An LMS delivers self-paced courses to large, distributed audiences, tracks completion and quiz scores, and generates reports that serve as compliance evidence. One-to-one coaching is effective for individuals, such as repeat phishing clickers, but does not scale to thousands. A single live session cannot accommodate six time zones. Posters reinforce awareness but cannot track completion.
50. A, E. (Objective 2.5) Skimming uses a hidden device, such as a card reader overlay, to capture card data at the point of sale. Tailgating is following an authorized person through a controlled door without using credentials. Both are physical attacks with physical indicators, such as tampered terminals and doors held open. A text message is smishing (social engineering), and DNS poisoning and SQL injection are network and application attacks.
51. B. (Objective 3.2) Every running service and open port is a potential entry point, so hardening removes or disables anything not required, reducing the attack surface. Leaving them running or simply documenting them keeps the exposure. Moving services to non-standard ports is security through obscurity; scanners still find them.
52. C. (Objective 4.3) Manual source code review examines the code itself and is especially good at finding business logic and authentication flaws that automated scanners miss. It is often combined with static analysis tools. Network scanning probes running systems, CSPM assesses cloud configurations, and penetration testing attacks the running application rather than reading its code.
53. A. (Objective 2.3) Browser extensions with broad permissions can read page content, form data, and cookies, including session tokens, allowing an attacker to hijack authenticated sessions without needing the password or MFA. Organizations should restrict extensions to an approved list. Nothing suggests USB, a rogue AP, or code planted on the mail server.
54. B. (Objective 1.1) Least privilege grants only the access required to perform a function. A read-only account could not drop tables, limiting the impact of the compromise. Defense in depth layers controls but does not specifically address excessive rights. Non-repudiation proves who performed an action. Availability is the CIA attribute affected, not a principle that limits damage.
55. D. (Objective 4.6) Automated provisioning saves time and applies the same role-based access every time, reducing errors and privilege inconsistencies. Automation can add complexity, but that is a consideration to manage, not an intended outcome. Access reviews are still needed to catch privilege creep and exceptions. Onboarding automation does not by itself address offboarding.
56. B. (Objective 3.4) Mean time to repair (MTTR) is the average time required to restore a failed component to service. RTO is the target set by the business for restoring a service after disruption, not a measured average. RPO is acceptable data loss, and MTD is the maximum tolerable downtime. A high MTBF and a low MTTR indicate a reliable, quickly repairable system.
57. D. (Objective 2.5) Cross-site request forgery (CSRF) tricks a browser into sending an authenticated request to a site where the user is logged in, using the browser's automatically included cookies. Anti-CSRF tokens, SameSite cookies, and requiring re-authentication for sensitive actions mitigate it. XSS injects script into a trusted site. Directory traversal and SQL injection target the server's file system and database.
58. C. (Objective 5.2) Current ALE = $4,000 x 10 = $40,000. New ALE = $1,500 x 6 = $9,000. The reduction in ALE is $31,000 (a tempting but incomplete answer). Subtracting the $12,000 annual cost of the control gives a net annual benefit of $19,000. The $9,000 option is the new ALE, not the benefit. Because the benefit is positive, the control is cost-justified.
59. B. (Objective 4.1) SELinux (Security-Enhanced Linux) applies mandatory access control policies that confine processes to defined domains, limiting what they can access even if they run as root and even if standard (discretionary) permissions would allow it. Enforcing mode blocks violations; permissive mode only logs them. Group Policy manages Windows settings. A HIDS in detection mode only alerts. Antivirus scans for malware.
60. D. (Objective 2.6) Entering sensitive or personal data into a public AI service can expose it outside the organization's control, and it may be retained or used for training. This is a data loss and privacy risk that organizations address with AI usage policies, approved enterprise AI tools, and DLP. Evasion manipulates model inputs to avoid detection. Hallucination is fabricated output. Bias is systematic unfairness.
61. A. (Objective 3.3) In government classification schemes, top secret applies to information whose disclosure could cause exceptionally grave damage; secret applies to serious damage; and confidential applies to damage. Public information can be released without harm. Commercial organizations use similar tiers with labels such as restricted, confidential, sensitive, and public.
62. D. (Objective 1.2) Ownership identifies who is accountable for a change and its outcome. Stakeholders are the people and groups affected by or interested in the change, whose input and communication are part of the approval process. Version control, allow lists, downtime, restarts, test results, and backout plans are all relevant to change management but are not what the CAB asked about.
63. A. (Objective 4.8) Event ID 4625 records failed logons and 4624 records successful logons. Thousands of failures for one account in minutes, followed by a success from the same source, indicate a password-guessing attack that eventually succeeded. A user who forgot a password does not make thousands of attempts. Nothing suggests logs were altered, and a legitimate service account would not generate thousands of failures.
64. B. (Objective 2.2) Unintentional insiders cause harm through mistakes, misconfigurations, or negligence rather than malice, and they are among the most common causes of security incidents. Change management, peer review, and automated configuration checks reduce the risk. A malicious insider acts deliberately. Hacktivists are external. Shadow IT is unsanctioned technology, not an actor type.
65. A. (Objective 4.2) Security requirements during acquisition and procurement reduce supply chain risk: buying from authorized sources limits counterfeit or tampered equipment, vendor assessments evaluate security practices, and firmware verification confirms integrity. The other phases deal with assigning assets to owners, tracking them in use, and retiring them.
66. D. (Objective 3.2) IPsec tunnel mode encrypts the entire original packet and wraps it in a new IP header between gateways, which is how site-to-site VPNs hide internal addressing. Transport mode encrypts only the payload and is typically used host to host. A clientless SSL portal is for individual remote users. GRE encapsulates traffic but provides no encryption on its own.
67. A, D. (Objective 1.1) Integrity ensures data and systems are not altered without authorization. File integrity monitoring detects unauthorized changes by comparing hashes, and digital signatures let recipients verify that code was not modified after signing (and who signed it). Redundant power and load balancing support availability. Encrypting backup tapes protects confidentiality.
68. A. (Objective 5.3) Rules of engagement define how a penetration test will be conducted: scope, authorized targets and techniques, timing, communication, and how to handle sensitive findings or problems. They provide written authorization for activity that would otherwise be illegal. An NDA protects confidential information. An SLA defines service levels. An MSA sets general terms governing future work between the parties.
69. D. (Objective 1.3) Full disk encryption encrypts the entire drive, including the operating system, temporary files, hibernation and swap files, so a thief cannot read anything without unlocking it. A TPM protects the key, and pre-boot authentication prevents automatic unlocking. File, database, and record-level encryption protect only selected data and may leave copies in temporary or swap files unencrypted.
70. C. (Objective 4.7) Many laws and regulations impose mandatory breach notification to affected individuals, regulators, or law enforcement within set deadlines. Incident response plans should identify these obligations in advance, with legal counsel guiding the process. Eradication removes the threat. Lessons learned follows the incident. Threat hunting searches for undetected threats.
71. C, E. (Objective 5.2) Quantitative analysis assigns numeric, usually monetary, values: asset value, exposure factor, SLE, ARO, and ALE. A $85,000 SLE and an ARO of 0.2 are both quantitative. Heat maps and ratings such as high, moderate, and unlikely are qualitative, which is faster and easier to communicate but less precise. Many organizations combine both approaches.
72. D. (Objective 3.1) In infrastructure as a service, the provider secures the physical facilities, hardware, and virtualization layer, while the customer is responsible for the guest operating system, applications, data, identities, and network configurations such as security groups. A responsibility matrix in the contract clarifies the division for each service.
73. C. (Objective 4.5) Identity proofing verifies that a person is who they claim to be before an account and credentials are issued, often through documents, biometrics, and authoritative data checks. Federation shares authentication across organizations. Access reviews periodically confirm that existing permissions are still appropriate. Privilege escalation is an attack.
74. A, E. (Objective 4.1) Data loss prevention identifies sensitive content, such as patterns matching Social Security numbers, and blocks or alerts on transfers. Endpoint agents enforce policy wherever the device is, and a centralized (or cloud) proxy with DLP inspects web uploads for all users routed through it. A honeypot attracts attackers. A data center NIDS would not see uploads from remote laptops. Full disk encryption protects lost devices, not uploads.
75. B. (Objective 2.1) CVSS environmental metrics let an organization modify the score based on its own context, such as compensating controls, reachability, and the importance of confidentiality, integrity, and availability for the affected asset. This supports accurate prioritization. It does not change the CVE identifier or the official base score, and a lower score lowers priority but does not eliminate the need to remediate.
76. D. (Objective 5.4) Loss of license occurs when a regulator revokes the permission an organization needs to conduct regulated business, which can effectively shut down operations in that jurisdiction. Reputational damage is harm to public trust. Contractual penalties arise from agreements between parties. Acknowledgements are employee confirmations of policies, not a consequence.
77. C, D. (Objective 3.4) Autoscaling adds and removes compute capacity automatically as demand changes, handling peak traffic. Database clustering with failover keeps the data tier available if a node fails. A cold site takes too long to activate. Weekly tape backups support recovery but not real-time availability. A single larger server is still a single point of failure.
78. B. (Objective 1.3) Steganography hides data within another file, such as an image, audio, or video, so that the existence of the hidden data is not obvious. It is a form of obfuscation that can be used for data exfiltration. Hashing creates a fixed-length digest. Tokenization substitutes values. Key stretching strengthens passwords.
79. D. (Objective 4.4) Archiving moves older logs to cheaper long-term storage while preserving them for compliance and investigations; immutability and hashing protect their integrity. Alert tuning affects alerts, not retention. Deleting logs violates the requirement. More correlation rules do not address retention.
80. C. (Objective 2.3) Remote desktop and remote control services such as RDP and VNC exposed directly to the internet are heavily scanned and attacked with password guessing and exploits. They should be placed behind a VPN or ZTNA with MFA. The other options describe vendor compromises, compromised websites, and malicious document code.
81. C. (Objective 5.1) An incident response policy, approved by senior management, defines the IR team's scope and authority, including the power to isolate systems during an incident, along with roles and reporting requirements. An AUP governs user behavior. A data classification policy defines labels and handling. An implementation guide explains how to deploy a product or control.
82. B. (Objective 4.3) IP address management (IPAM) tracks address allocations, DHCP leases, and DNS records, making it easier to identify unknown or rogue devices and keep inventory accurate. CSPM assesses cloud configurations. SOAR automates response workflows. DLP prevents data leakage.
83. C. (Objective 5.5) MITRE ATT&CK is a knowledge base of adversary tactics and techniques with standardized IDs (for example, T1003 for OS credential dumping), widely used to map incidents and assess detection coverage. The Diamond Model analyzes relationships among adversary, capability, infrastructure, and victim. The Cyber Kill Chain (not listed) describes phases of an attack. CVSS scores vulnerabilities. ISO/IEC 27001 is a management system standard.
84. C. (Objective 3.3) Disposal is the final life cycle phase, in which data that has reached the end of its retention period is securely destroyed. Retaining data longer than necessary increases exposure and legal discovery obligations. Creation, distribution, and management are earlier phases covering when data is generated, shared, and maintained.
85. B, D. (Objective 3.1) Data sovereignty means data is subject to the laws of the country where it is stored or processed, so the provider must keep data (and ideally support access) within Canada. The restricted classification drives requirements for encryption, access control, and logging that the provider must meet. Internal instance types and source code availability matter little for a SaaS purchase. Corporate office environmental requirements do not affect where or how claims data is protected.
86. B. (Objective 1.1) Corrective controls restore systems to normal operation and limit damage after an incident, such as reimaging and restoring from backup. Detective controls identify incidents. Deterring controls discourage attacks. Directive controls instruct people what to do.
87. B. (Objective 5.6) Removable media and cables training warns employees that unknown USB drives and even cables can contain malicious hardware, and teaches them to use only company-issued or trusted accessories and to report found devices. BEC concerns fraudulent payment requests. Password management addresses credentials. Anti-bribery covers corruption risks.
88. B. (Objective 1.2) Legacy applications and their dependencies are key technical implications in change management. The upgrade would break a business-critical application, so the team must plan for it, perhaps by isolating and compensating for the legacy system, finding a replacement, or postponing. Skipping testing ignores the known dependency. A standard change is pre-approved and low risk, which this is not. Deny-listing the application would cause an outage.
89. A, B. (Objective 2.4) WEP is a broken wireless encryption protocol that can be cracked quickly, and Bluetooth devices with default or fixed pairing PINs can be paired by attackers within range. Both are wireless and low-power communication weaknesses common in IoT and legacy devices. A missing OS patch, SQL injection, and an expired certificate are other vulnerability types.
90. D. (Objective 3.2) Diversity (here, vendor diversity) means a flaw or misconfiguration specific to one product is less likely to compromise every layer. It complements defense in depth but adds management complexity and cost. Fail-open is a failure mode. Port mirroring copies traffic. Out-of-band management uses a separate administrative path.

Score Interpretation

Count your correct answers. A Select TWO question counts as correct only if you chose both correct options. Then use the guidance below.

Score Percentag
e
What It Means

75-90 83% or higher

Exam-ready. Review every miss, confirm that your Exam A score was similar, and book your exam.

63-74 70-82% Close. You understand most concepts but have weak areas. Spend a week on the domains where you scored lowest, then retake.

50-62 55-69% Foundational gaps. Reread the chapters for your two weakest domains and redo their review questions before retesting.

Below 50 Under 55%

Return to the study plan in the front of this guide and work through the chapters systematically before attempting another full exam.

Use the table below to tally your results by domain. Because the exam weights domains differently, a weak score in Domain 4.0 (27 percent of the exam) or Domain 2.0 (24 percent) costs far more points than an equal weakness in Domain 5.0. Aim for at least 80 percent in every domain; any domain below 70 percent is a priority for review.

Domain Questions Count Your Score

1.0 General Security

Concepts

2, 6, 13, 20, 27, 38, 47, 54, 62, 67, 69, 78, 86, 88 14 ___ / 14

2.0 Threats, Vulnerabilities,

and Attacks
1, 4, 7, 9, 14, 17, 22, 25, 29, 33, 36, 39, 41, 46, 50, 53, 57, 60,
64, 75, 80, 89
22 ___ / 22

3.0 Security Architecture 5, 11, 16, 23, 30, 34, 40, 44, 51, 56, 61, 66, 72, 77, 84, 85, 90 17 ___ / 17

4.0 Security Operations 3, 8, 12, 15, 18, 21, 24, 28, 32, 35, 37, 42, 45, 48, 52, 55, 59, 63, 65, 70, 73, 74, 79, 82

24 ___ / 24

5.0 Security Program

Management and Oversight

10, 19, 26, 31, 43, 49, 58, 68, 71, 76, 81, 83, 87 13 ___ / 13

Domain Questions Count Your Score

Total All 90 ___ / 90

To pinpoint the exact chapter to revisit, find the objective for each question you missed in the table below. Chapter numbers follow objective order: objectives 1.1-1.3 are Chapters 1-3, 2.1-2.6 are Chapters 4-9, 3.1-3.4 are Chapters 10-13, 4.1-4.8 are Chapters 14-21, and 5.1-5.6 are Chapters 22-27.

Compare your domain scores on Practice Exams A and B side by side. A domain that is weak on both exams is a genuine knowledge gap and deserves another pass through its chapters and the PBQ workshop. A domain that is weak on only one exam may reflect a few specific topics; use the objective table above to find them. In the final days before the exam, review the explanations for every question you missed or guessed on, even those you answered correctly.