CompTIA Security+ SY0-701: 20 Practice Questions Explained

A user logs into a cloud console from an unfamiliar device; the same hour, an endpoint tries to stop its security service. A security team has several plausible next steps, but the most useful response depends on what the evidence actually proves, which actions the team may authorize, and how quickly the threat could spread. Security questions become more demanding when a familiar control is technically valid but aimed at the wrong immediate problem.

These twenty original practice scenarios test that distinction. They are built around ordinary administrative incidents, uncertain evidence, authorization boundaries, cloud workloads, recovery and business-risk decisions. Every case provides a complete rationale for the correct choice and examines why the other answers are weaker. Six questions require two selections; the rest require one. The examples are teaching exercises, not purported copies of a live assessment.

For candidates preparing for CompTIA Security+ SY0-701, the cases are grouped under the five current official domains. Two cover General Security Concepts, four cover Threats and Mitigations, four cover Security Architecture, six cover Security Operations, and four cover Security Program Management. This distribution broadly reflects the 12/22/18/28/20 domain emphasis; it is not a prediction of how a particular exam form will distribute or score questions.

How to work through the explanations

Read each incident once without looking at the choices. Identify the asset, the desired security outcome, the known facts, the assumptions you would need to verify, and the consequence of choosing the wrong control. Then select an answer. For multiple-select questions, both selections must satisfy the stated constraints. Only afterward should you read the rationales: notice especially when an incorrect answer would be useful in a different situation but fails this case.

Control purpose, cryptography and trust

Question 1: A change that must be detected and prevented

An online retailer requires advance approval before a production firewall rule changes. It also needs a record of any changes made outside the approved process. Which pair of control purposes addresses those different needs?

1. Deterrent approval and compensating logging
2. Preventive approval and detective configuration monitoring
3. Corrective approval and preventive inventory
4. Physical approval and deterrent vulnerability scanning

Correct Answer: B

Explanation: Approval enforced before a change is a preventive control: it is intended to stop unauthorized work. Configuration monitoring is detective because it reveals a deviation after or during a change. Both controls need an accountable owner and evidence of which rule changed. A monitoring alert is not a substitute for an authorization gate; conversely, an approval workflow cannot prove that nobody bypassed it. The categories of technology and management may overlap, but the control purposes are distinct.

Incorrect Answers:

• A: Approval should actually prevent unauthorized execution, not merely discourage it. Logging shows what happened; it does not compensate automatically for a failed permission boundary.
• C: Inventory makes the changed resource identifiable but does not enforce prior approval or detect a specific configuration change. Corrective controls repair a failure after it occurs.
• D: Neither requirement is primarily physical. Vulnerability scanning detects weaknesses, not necessarily changes to a named firewall rule or their authorization state. A physical access rule may support infrastructure security, but it does not establish authorized configuration changes in this case.

Question 2: Proving that a downloaded file came from the release team

A software team publishes application packages through a mirror it does not fully control. Users need evidence that the file is unmodified and was signed by the authorized release key. Which TWO controls best support that goal? Select TWO.

1. Encrypt the package with a shared password circulated in the README
2. Verify a digital signature using a previously trusted public key
3. Use a checksum displayed only on the same untrusted download page
4. Confirm the signing certificate or key trust path under the organization’s release policy
5. Require users to download over the fastest available connection

Correct Answer: B, D

Explanation: A verified digital signature binds the artifact to a signing key and detects modification of the signed content. That result is meaningful only if the verifier has a reliable basis for trusting the public key or its certificate chain. The organization must also protect its signing key and define what to do after compromise or expiration. Transport security is helpful, but it does not by itself prove that a mirror supplied the genuine release artifact.

Incorrect Answers:

• A: Shared-password encryption hides contents from someone without the password but does not independently establish the publisher’s signing identity or reliable public verification. The recipient still cannot verify that an untrusted mirror distributed the exact package the release team approved.
• C: A checksum published beside the attacker-controlled file can be changed with it. A checksum is useful only when the expected value arrives through a trusted channel.
• E: Connection speed does nothing to establish integrity, signing authority, or the provenance of the artifact being installed. A quick connection can carry a malicious replacement just as efficiently as the legitimate package.

Exposure, attacker behavior and proportionate mitigation

Question 3: The urgent email that changes the payment account

An accounts-payable clerk receives a message that appears to be from the finance director and urgently requests a supplier bank-account change. The visible display name matches, but the reply-to address is unfamiliar. What is the safest immediate action?

1. Make the change because the display name and urgency indicate executive priority
2. Send the supplier’s previous invoices to the new reply-to address to confirm its identity
3. Verify the request through a known independent contact channel and follow the approved change-control process
4. Add the sender to the company’s allow list so later requests are not delayed

Correct Answer: C

Explanation: The message combines business-email-compromise indicators: an authority claim, urgency, a sensitive payment change, and a reply path that does not match an established contact. The response should use a previously trusted telephone number or workflow to authenticate the request and enforce dual review where policy requires it. Merely replying within the suspicious thread does not provide independence. Preserve the message for reporting and investigation if malicious intent is suspected.

Incorrect Answers:

• A: A display name is easily spoofed. Time pressure makes an authorization exception more dangerous, not more legitimate. The requested bank-account change requires independent verification because an attacker can choose the apparent sender’s name.
• B: Sending invoices to the suspicious address could disclose sensitive vendor information while giving the adversary more convincing material for further fraud. The attacker can then reuse real invoice details to make a fraudulent banking request appear even more convincing.
• D: Allow-listing a suspicious identity reduces filtering and can make subsequent impersonation easier. It does not verify the requested banking change. Address verification and authorized payment-change approval are required before treating a newly supplied contact as trusted.

Question 4: One vulnerable server, two very different exposures

A scanner rates two servers with the same critical vulnerability severity. Server A is public-facing, has known exploit attempts, and holds customer sessions. Server B is isolated in a powered-off teaching lab with no route to business systems. Which remediation priority is most defensible?

1. Prioritize A, applying an approved containment control if the permanent patch requires maintenance
2. Prioritize B because the scanner lists it last, suggesting the newest discovery
3. Treat both as identical business risk because the severity number matches
4. Ignore A until a successful compromise is confirmed in logs

Correct Answer: A

Explanation: Risk-based remediation considers exploitable exposure, threat activity, asset value, and available mitigations in addition to a severity score. Server A combines external reachability, attack evidence, and consequential data, making its near-term risk materially higher. A narrow temporary restriction may reduce exposure while the tested patch is scheduled, followed by verification. Server B still needs management under policy, but its isolation changes likelihood and urgency. The scanner’s numeric severity is an input, not the whole decision.

Incorrect Answers:

• B: Ordering in a report is not an exposure or exploitability metric. A powered-off isolated lab does not become more urgent merely because it appears later.
• C: Common technical severity does not imply equal likelihood of exploitation, impact, or recovery difficulty across different systems. Risk treatment must also reflect real-world exposure, criticality, compensating controls and credible threat activity.
• D: Waiting for proof of compromise forfeits preventive mitigation when credible active exploitation and a reachable vulnerable asset are already known. The signs already establish a credible risk requiring mitigation; absence of a matching alert is not exculpatory evidence.

Question 5: Detecting the foothold before encrypting every server

A workstation opens an attachment and an attacker steals a valid administrative credential. Within minutes the account signs in to two servers at an unusual hour and attempts to stop endpoint protection. Which TWO observations most strongly support immediate investigation? Select TWO.

1. The attachment has a familiar PDF icon
2. Unusual privileged authentication correlated with the user’s normal work pattern
3. A scheduled backup completed earlier that day
4. A change to endpoint protection services following the suspicious login
5. The affected workstation has more than 50 GB of free storage

Correct Answer: B, D

Explanation: Privilege use that departs from the legitimate user’s normal location, device, schedule, or resource pattern is a meaningful detection signal—especially when followed by attempts to disable protection. Correlating identity events and endpoint service changes creates a stronger case than either in isolation. Containment and evidence collection should follow the organization’s incident process, with care not to destroy volatile evidence or disable essential systems indiscriminately. A recognizable file icon is not reliable proof that an attachment is harmless.

Incorrect Answers:

• A: Icons and file names can be misleading. They do not establish source authenticity, whether code executed, or whether a privileged identity was compromised. An adversary can disguise malicious content as a familiar document and use trusted-looking names to encourage opening.
• C: A completed backup is useful for recovery but does not independently indicate that privileged account behavior or service tampering is legitimate. Backup evidence may reduce potential loss, yet it does not explain the unauthorized administrative account activity.
• E: Available disk space has no meaningful causal connection to the identified privilege anomaly or endpoint protection interruption. Storage capacity tells an analyst little about the legitimacy of privileged activity or protection changes.

Question 6: A dependency update that changes behavior overnight

Several build agents begin contacting an unfamiliar external domain immediately after a third-party library update. The library was approved by name but its release checksum was never pinned. Which first investigative focus is most useful?

1. Raise the antivirus exception for the build agents so pipelines keep running
2. Assume the behavior is normal because the package manager installed it successfully
3. Compare the exact dependency artifact, provenance, build logs and outbound connections with a known-good release
4. Delete all historical package logs before rebuilding the environment

Correct Answer: C

Explanation: The timing and common dependency suggest a supply-chain investigation, not a conclusion of compromise. Identify the exact installed version and hashes, trace the source and distribution path, inspect what changed, and correlate outbound activity with processes on the agents. If evidence supports malicious behavior, contain the affected build path under an approved response plan and investigate downstream artifacts. Pinning and signed provenance help future prevention, but current evidence must be preserved before wholesale cleanup.

Incorrect Answers:

• A: Excluding the build agents from protection can conceal malicious behavior precisely when the evidence calls for investigation. A containment decision must preserve useful incident visibility and should never erase the signal being investigated.
• B: A package manager confirms an installation event, not that the retrieved artifact came from an authorized, uncompromised release. The registry, publisher account or dependency itself may have been compromised before delivery.
• D: Destroying logs eliminates provenance and incident evidence, making it harder to determine which builds or downstream users may be affected. An unexamined rebuild could also distribute the same affected dependency into later releases and repeat the incident.

Trust boundaries, data protection and resilience

Question 7: Segmenting a web application without breaking it

An application has an internet-facing reverse proxy, an internal application tier and a database. The proxy needs HTTPS to the app tier; the app tier needs one database port; administrators use a dedicated management network. Which design best reduces lateral movement while keeping the required service working?

1. Put all three tiers in the same unrestricted subnet to prevent routing failures
2. Permit all outbound traffic from the proxy to the database but deny inbound internet traffic
3. Enforce narrow proxy-to-app and app-to-database flows, separate management access, and verify denied connections
4. Allow any traffic between private addresses because internet firewalls provide the perimeter

Correct Answer: C

Explanation: The policy should reflect explicit application dependencies instead of broad trust based on private addressing. Restrict the proxy to the application listener and the application service to the required database destination and port. Keep administrator access on a separately governed path and test not only allowed flows but also prohibited east–west connections. A ruleset that passes a single happy-path test can still leave large lateral-movement opportunities if it fails to deny unneeded reachability.

Incorrect Answers:

• A: Operational simplicity does not justify an unrestricted trust space. A compromised proxy would gain unnecessary access to both internal tiers. A narrow east-west policy can still permit the legitimate application flow while limiting compromise from the public tier.
• B: An unrestricted proxy-to-database path bypasses the application tier and enlarges the consequences of a breached public service. The attacker could reach sensitive data without passing the intended intermediary controls.
• D: Private IP addresses are not a security guarantee. Insider compromise and lateral movement remain possible inside a network. Lateral movement often occurs between privately addressed services after the initial perimeter has already been breached.

Question 8: Protecting customer identifiers while analysts compare records

A data-analytics team must match customer cases across reports but should not see real account numbers. An authorized service must still be able to recover the original number for a regulated investigation. What is the most appropriate pattern?

1. Hash every number without a controlled lookup, assuming every account format has sufficient entropy
2. Publish the full account numbers only in a private Git repository
3. Use reversible tokenization with a protected mapping service and tightly scoped detokenization access
4. Replace only the first two characters of each account number

Correct Answer: C

Explanation: Tokenization can preserve stable references for joins while moving the sensitive mapping into a separately protected, audited service. Detokenization must require an authenticated, authorized purpose because reversal restores the sensitive data. Its design also needs controls against token enumeration and mapping leakage. A hash may be appropriate for some nonreversible comparisons, but predictable low-entropy account identifiers and a requirement for authorized recovery make blind hashing the weaker choice here.

Incorrect Answers:

• A: Predictable identifiers can be guessed against unsalted hashes, and nonreversible hashing cannot satisfy the stated authorized recovery requirement. A protected recovery mapping is needed, and unsalted hashes can expose identifiers from a small predictable range.
• B: A private repository is not an access-control architecture for business data and may spread sensitive records into developer workflows and history. Developer access and version control do not necessarily provide purpose-bound detokenization, auditability, or a safe business recovery process.
• D: Partial masking may leak enough structure or digits to identify accounts and does not create a controlled authorized recovery service. Partial disclosure can also remain visible in exported reports or logs, defeating the intended separation between analysts and sensitive records.

Question 9: A regional outage meets a deleted database

A retailer needs its order service to survive a regional outage and also restore data after an administrator accidentally deletes records. Which TWO capabilities should its recovery design include? Select TWO.

1. A second application deployment in the same availability zone
2. A tested regional failover or recovery plan with documented dependencies
3. A longer password-expiration policy for database administrators
4. A firewall that drops all traffic during outages
5. Protected recoverable copies or point-in-time restoration tested against logical deletion

Correct Answer: B, E

Explanation: A regional failure and a logical deletion are different threats. Regional recovery requires service/data availability in an alternate location and an orchestrated cutover that accounts for routing, identity and dependencies. Deleted records require a protected recovery mechanism that can restore an earlier consistent state; replication alone may faithfully replicate deletion. Both paths need real tests against business recovery time and recovery point objectives. Combining the controls addresses distinct failure modes, not simply duplicate infrastructure.

Incorrect Answers:

• A: Two deployments in the same availability zone may withstand a particular host failure but still share the same regional exposure. They do not establish an alternate regional recovery path.
• C: Password age policies do not provide alternate regional capacity or restore deleted records after a permitted or compromised action. Account security still matters, but it cannot create a second region or restore deleted transaction history.
• D: Blocking every request can limit exposure during an incident but does not restore service or recover lost data. A total traffic block can interrupt users further and offers no means to reconstruct a working workload.

Question 10: Accessing a SaaS application from unmanaged devices

A contractor must view a sensitive SaaS dashboard from a personally owned laptop. The organization cannot manage the laptop fully, but it can control identity, session conditions and download permissions. Which first design is most defensible?

1. Give the contractor a permanent administrator account to avoid access prompts
2. Require strong authenticated access, limit permissions, apply session/device restrictions, and audit the access
3. Trust the device because the connection is encrypted with HTTPS
4. Export the full dashboard data to email so the contractor does not need a SaaS account

Correct Answer: B

Explanation: The contractor’s business role and device risk should shape authorization. Use an identity verified with an appropriate strong authentication method, grant only necessary viewing rights, apply supported conditional/session restrictions to manage unmanaged-device exposure, and log relevant access. A precise policy may block downloads or require a managed device for more sensitive operations. Network encryption protects traffic in transit; it does not establish that the endpoint, user authorization, or subsequent data handling is safe.

Incorrect Answers:

• A: Permanent administrator access is disproportionate to a contractor’s read-only task. It expands the impact of stolen credentials and makes it harder to isolate the precise data access the business authorized.
• C: HTTPS does not verify business authorization, remove malicious local software, or control what happens to downloaded data. A compromised or unmanaged endpoint may still copy sensitive content or misuse its authenticated session.
• D: Emailing sensitive exported data creates additional copies and distribution risks instead of governing access through the application. This bypasses the application’s session restrictions and creates uncontrolled copies outside the approved SaaS audit trail.

From evidence to containment, control and recovery

Question 11: One unusual login does not tell the entire story

A cloud console records a privileged login from an unfamiliar location at 03:14. The same account was used normally from an office device an hour earlier. There is no approved maintenance ticket. What is the most useful initial investigative step?

1. Reset every employee account without examining related events
2. Correlate identity-provider sign-in details, device/session context, privileged actions and recent legitimate changes
3. Disable all cloud logging until the event is resolved
4. Assume the login was a traveler because the password was correct

Correct Answer: B

Explanation: A suspicious location and time justify rapid investigation, but they do not by themselves prove account compromise. Authentication records, token/session indicators, device identity, recent permission changes and actions performed after login help distinguish authorized travel, VPN behavior, stolen credentials and malicious privileged activity. The response team should follow its containment thresholds while preserving useful evidence. A valid password does not authenticate the human intent behind a session; risk depends on correlated behavior.

Incorrect Answers:

• A: Mass resets can interrupt essential work and obscure the original session trail. Scope the suspected identity and apply the incident playbook according to evidence and urgency.
• C: Disabling logs destroys visibility precisely when investigators need to connect authentication to subsequent administrative actions and possible lateral movement. Without identity and administrative logs, responders cannot establish which privileges were exercised after the event.
• D: A successful password check does not distinguish the rightful user from an attacker holding stolen credentials or a session token. A stolen session token may even bypass a fresh password prompt while continuing to use the legitimate account’s identity.

Question 12: An alert that repeats after every patch Tuesday

The SOC receives hundreds of detections after an approved patch-management job changes signed system files. Analysts confirm the file versions match the authorized baseline. How should the detection rule be improved?

1. Disable file-integrity monitoring on every server indefinitely
2. Suppress every security event generated during business hours
3. Use change evidence and a narrowly bounded exception or baseline adjustment, then test that unauthorized changes still alert
4. Ignore the alert because signed files can never be malicious

Correct Answer: C

Explanation: Effective tuning preserves the reason for the control. The operations team can correlate change tickets, affected file paths, authorized hashes, signed publisher and time window before applying a narrow exclusion or refreshed baseline. Then it should verify that an unauthorized modification still triggers detection. Blanket suppression creates a gap that an attacker can exploit under cover of routine maintenance. Record the rationale and owner so the exception can be reviewed after the change.

Incorrect Answers:

• A: Removing monitoring across the fleet would conceal unauthorized changes unrelated to this known patch job and undermine the original control objective. Instead, the exception should refer to the specific approved change and an expiry or reevaluation point.
• B: Business hours are not a reliable proxy for legitimacy. Attackers and mistakes both occur during approved operating periods. The time of day is an unreliable indicator of maliciousness and can suppress genuinely suspicious production events.
• D: A digital signature supports origin and integrity claims under trust assumptions; it cannot prove that every signed file or deployment is appropriate. Malicious or unauthorized software can be signed; the relevant question remains whether the observed change was approved.

Question 13: Ransomware is spreading and evidence can disappear

A responder confirms active encryption on one workstation and sees connections from it to two file servers. The team needs to limit harm and understand the entry path. Which TWO actions should be part of the immediate authorized response? Select TWO.

1. Isolate the affected endpoint or its hostile network paths using the incident playbook
2. Reimage the workstation before preserving any useful evidence
3. Collect or preserve relevant volatile telemetry, session information and event evidence as practical under the containment plan
4. Email the suspected malware sample to every employee for awareness
5. Disable all backups so encryption cannot reach them

Correct Answer: A, C

Explanation: Active malicious activity calls for proportionate containment while investigators preserve evidence that could be lost through shutdown or cleanup. Network isolation limits further propagation and may be coordinated with protecting reachable file services. Volatile process, connection and session data plus central logs can reveal how access began and what was affected. The exact order depends on urgency, approved responder authority and the ability to collect safely; preserving every byte is not a reason to leave destructive encryption spreading.

Incorrect Answers:

• B: Immediate reimaging can destroy memory and local evidence before investigators establish scope, even though a rebuild may be appropriate later in recovery. Containment and preservation must be coordinated so the response does not trade the immediate threat for avoidable evidence loss.
• D: Distributing a suspicious executable increases exposure and is not an approved method of warning staff. Use established secure reporting and awareness channels. A secure isolated analysis system and designated incident responders should handle suspect files rather than general mail distribution.
• E: Turning off protected backup systems can reduce recoverability. Instead, protect backups and administrative access according to the incident plan while isolating affected paths. The team should secure copies and isolate compromised access, not undermine the ability to restore clean systems.

Question 14: An application token appears in a public repository

A developer accidentally commits a cloud API token that can read customer records. The repository was public for several hours. Which TWO actions directly reduce the near-term risk and establish what may have happened? Select TWO.

1. Rename the repository without changing the token
2. Revoke or rotate the exposed token, replacing it through an approved secret-management path
3. Ask users to avoid the application until the next monthly security meeting
4. Inspect provider audit logs and actual scope of the token for suspicious use, preserving relevant evidence
5. Delete the README and assume copies of the previous commit no longer exist

Correct Answer: B, D

Explanation: An exposed live credential should be treated as compromised regardless of whether abuse has been observed. Revoke it and issue a replacement with the narrow permissions required, then investigate its grants, lifetime and use in provider logs. Coordinate with application owners to avoid breaking a critical workflow during rotation, but do not leave broad access in place merely for convenience. Repositories, forks, caches and cloned commits can retain a secret even after its visible file is removed.

Incorrect Answers:

• A: Renaming a repository does not invalidate a credential, prevent earlier clones, or address the credential’s excessive permissions. The exposed token remains usable until the provider invalidates it, regardless of where the repository is hosted.
• C: Delaying action extends the period in which an exposed token may be used, even when incident scope remains uncertain. Time matters because a leaked read credential could be exercised by an unknown party before the meeting.
• E: Deleting a file does not reliably erase public version history, previously cloned repositories, or copies held by third parties. Anyone who fetched the original commit may still have the token even after the public file disappears.

Question 15: A firewall rule passes the application test but fails segmentation

An engineer adds a policy so a web proxy can reach an application service on TCP 443. The application works, but the same proxy can now open administrative sessions to unrelated servers. What must be corrected?

1. Replace the narrow application port with an allow-any rule so troubleshooting is easier
2. Disable traffic logs so only application logs are collected
3. Add the unrelated servers to the application’s trust zone
4. Restrict source, destination, protocol and management access to the flows actually approved, then test both allowed and denied paths

Correct Answer: D

Explanation: A working application connection only proves that one intended flow succeeds. The rule set must also enforce the negative requirement that a compromised proxy cannot reach unrelated administrative services. Use precise source and destination identities, required transport ports and separate management access with accountable ownership. Test intended HTTPS traffic and denied administrative paths from the correct origin. This distinguishes functional troubleshooting from security validation and makes the outcome observable rather than merely assumed.

Incorrect Answers:

• A: A wider allow-any rule increases attack surface and contradicts the stated segmentation requirement. It would let a compromise reach services outside the originally approved application path.
• B: Removing logs weakens the ability to investigate misuse and does not constrain the proxy’s actual network reachability. Logs remain important for reconstructing whether the disallowed traffic was attempted or successfully reached a destination.
• C: Expanding a trust zone merely makes the unintended lateral access appear administratively normal; it does not reduce risk. The additional allowed flows would persist and could give a compromised proxy access to sensitive administration surfaces.

Question 16: A recovery job succeeds but the data is still encrypted

After a ransomware incident, the backup dashboard shows a successful restore, but the restored volume contains encrypted files created after compromise. What should the recovery team verify next?

1. Consider the service recovered because the restore operation returned success
2. Select and test a known-clean restore point, validate integrity and business function, and investigate the protection/recovery timeline
3. Connect the restored volume immediately to production without checking accounts or malware state
4. Assume replication is equivalent to retaining a clean historical copy

Correct Answer: B

Explanation: A successful restore operation means a selected restore point was applied, not that its contents represent a trustworthy pre-incident state. The team should identify the last known-clean point from investigation evidence, restore into a controlled environment, validate data and application behavior, and confirm that compromised credentials or persistence do not cause reinfection. Recovery time and point objectives also matter. Replication can preserve corrupted or encrypted changes, so versioned, protected and tested recovery copies serve a different purpose.

Incorrect Answers:

• A: Operation success is a process signal, not proof that recovered records are usable, complete or free from the incident’s effects. The application may still be unusable or unsafe because the selected point contained corrupted or attacker-encrypted files.
• C: Restoring unvalidated data and connections into production can reintroduce malicious artifacts or allow an attacker to resume activity. Recovery must first establish that the restored data, identities and systems are trustworthy enough to reconnect.
• D: Replication may copy an unwanted deletion or encryption event, whereas a protected recoverable snapshot can preserve an earlier valid state. The team needs evidence of a pre-incident point and proof that restoring it meets the recovery requirement.

Accountable risk, vendor obligations and reliable security governance

Question 17: A vendor can access customer data but has no incident notice deadline

A company uses an outsourced support platform with access to customer contact records. The contract defines availability but is silent on security-event notification and secure disposal. Which governance response best addresses the gap?

1. Assume the vendor will use the company’s internal incident policy
2. Rely entirely on the platform’s marketing security badge
3. Document the missing requirements, assign contract and risk owners, and agree measurable access, notification and disposal obligations
4. Turn off internal audit logging because the vendor holds the data

Correct Answer: C

Explanation: Security requirements across organizational boundaries need explicit ownership and enforceable terms. The customer can perform due diligence, assess data access and retention, and work with procurement, security and legal owners to include appropriate notification timelines, handling obligations, evidence and exit/disposal conditions. Availability SLAs are not automatically security incident agreements. The organization must then monitor whether the vendor actually meets the agreed controls and record residual risk rather than assuming a signed contract solves every operational problem.

Incorrect Answers:

• A: A third party is not automatically bound by an internal policy it did not agree to or receive in a contractually enforceable form. The contract should assign explicit obligations to the vendor and specify how performance and incidents are reported.
• B: A badge or claim may inform vendor assessment but cannot substitute for the exact access, response and data-lifecycle requirements. The organization still needs vendor-specific commitments that define notification, access, retention and control evidence.
• D: Removing the organization’s audit visibility would make it harder to detect or reconstruct events involving the external service. A customer remains accountable for monitoring its own obligations even when processing has been outsourced.

Question 18: The risk owner chooses not to patch a critical service immediately

A hospital cannot immediately patch a clinical system because the manufacturer has not validated the update. The team has isolated the system and enabled additional monitoring. Management asks who may formally accept the remaining risk. Which answer is most appropriate?

1. The engineer who discovered the vulnerability automatically accepts the enterprise risk
2. The authorized business or risk owner evaluates and documents the residual risk, controls, review date and decision
3. The vendor’s help desk accepts the hospital’s operational risk without local review
4. No risk remains once a compensating network filter is deployed

Correct Answer: B

Explanation: The technical team can quantify exposure, explain limits of compensating controls and recommend actions; formal acceptance belongs to the organizational role authorized to own the affected business risk. That decision should record the reason patching is delayed, remaining likelihood and impact, controls in place, evidence, review period and trigger for reconsideration. Operational safety and availability may matter heavily in healthcare, but a written acceptance does not erase the vulnerability or remove the obligation to monitor it.

Incorrect Answers:

• A: Finding a defect does not confer executive authority to accept its financial, patient-safety or operational consequences on behalf of the organization. Risk acceptance needs documented business accountability, not merely technical responsibility for discovering or temporarily mitigating the vulnerability.
• C: A supplier can provide technical advice or support terms but cannot unilaterally assume the hospital’s internally governed risk decision. The healthcare organization must evaluate safety consequences and authorize residual risk through its own designated owner.
• D: A compensating control reduces some exposure under defined assumptions; it seldom removes every route or consequence of exploitation. Further exposure or an untested control path can remain, and the accepted risk requires periodic reassessment.

Question 19: Turning a board directive into repeatable access reviews

A board states that privileged access must be controlled and reviewed. The security team needs a binding requirement for reviews and clear steps for administrators to perform them. Which TWO document types best fill those specific roles? Select TWO.

1. A standard that defines the required review frequency and evidence
2. A marketing brochure that highlights the company’s commitment
3. A procedure explaining who retrieves access records, approves exceptions and records completion
4. A voluntary opinion poll on whether privileged accounts feel necessary
5. An incident ticket created only after an access violation occurs

Correct Answer: A, C

Explanation: A high-level policy communicates management direction, while an enforceable standard defines measurable requirements such as scope, frequency, and acceptable evidence. A procedure then tells practitioners how to carry out the required review, obtain approval, deal with exceptions and retain records. Both should identify responsible owners and link to each other. An incident ticket documents an event after the fact; it cannot replace a defined recurring control that operates before misuse is detected.

Incorrect Answers:

• B: Promotional materials may describe intent but do not create enforceable requirements or tell administrators how an evidence-based review should be completed. The actual risk-control program requires a dated rule and a practical method that generates auditable evidence.
• D: Employee preferences may inform control design but cannot substitute for the organization’s defined privileged-access standard and operating procedure. The answer calls for documented mandatory obligations and steps, not merely feedback about preferences.
• E: A reactive ticket documents a specific problem, while the requirement calls for a recurring and independently reviewable access-control process. It also provides no instructions for preventing privilege accumulation before an incident occurs.

Question 20: Security awareness measured by more than a phishing-click rate

After a phishing simulation, the team reports that click rates fell. However, employees are still sending suspicious messages to an unmonitored mailbox, so security does not receive timely reports. What is the strongest program improvement?

1. Declare the program finished because fewer employees clicked
2. Publish the names of everyone who clicked without evaluating whether this helps reporting
3. Deliver the same presentation more often without changing the reporting workflow
4. Make reporting easy and monitored, train on the actual indicators, and measure timely reporting and response as well as clicks

Correct Answer: D

Explanation: A program should build behavior that helps the organization detect and respond to real threats. Lower click rates can be encouraging, but the unmonitored mailbox means staff effort does not reach responders. Fix reporting channels, clarify what constitutes a reportable message, provide constructive feedback and measure prompt, usable reports alongside exposure. A blame-focused dashboard can discourage reporting. Effective awareness is a cycle of training, behavior measurement, feedback and workflow improvement, not an annual slide deck.

Incorrect Answers:

• A: Click rates alone miss whether employees recognize, escalate and help contain suspicious activity through the organization’s actual response channel. The program must evaluate whether suspicious activity reaches responders in time to support an actual investigation.
• B: Public shaming can reduce trust, suppress voluntary reporting and discourage candid follow-up after mistakes. It also does nothing to deliver reports to the security team reliably.
• C: Repeating unchanged training does not repair an unmonitored mailbox or demonstrate that practical reporting and response behavior improved. The reporting process needs an owned inbox, monitored intake and tested escalation path before more slides are useful.

Turn wrong answers into a practical review plan

A missed question about access control might reflect confusion between authenticating a user and authorizing an action. A missed segmentation case may mean you verified an allowed application connection without testing the paths that should be denied. In both cases, the improvement is a small, observable exercise rather than another page of memorized terminology. Record the original requirement and the specific control that would enforce it.

If suspicious events and recovery decisions were harder, revisit security-operations evidence and monitoring and the distinction between containment, preservation, and recovery in incident-response evidence handling. An alert is a reason to investigate, not automatically a verdict; a completed restore operation is not proof that the data is trustworthy. Good preparation teaches you to seek the missing evidence and understand the authority for the next action.

For certificate-chain failures and identity controls, compare the underlying trust assumptions in PKI and certificate verification. For cases about business ownership, vendor contracts or exceptions to policy, inspect risk governance and accountability. A device setting, contractual obligation and authorized risk decision are not interchangeable merely because all improve security in some way.

On a second attempt, change one fact in a case—make the server isolated rather than internet-facing, or make an approval already recorded rather than missing—and explain whether the correct answer changes. That is a stronger measure of readiness than remembering the letters above. Work from CompTIA’s current objective list and use your practical results to identify which domain deserves the next focused exercise.