CompTIA Security + SY0-701 (V7) Exam Practice Test 1

A hot site is fully equipped and continuously running with real-time data replication, allowing it to take over operations almost immediately if the primary site fails, representing the fastest but also most expensive disaster recovery site option. A cold site instead provides only basic infrastructure with no active systems or current data, requiring significant time and effort to become operational, which is a much slower but less costly alternative. A warm site falls between these two extremes, offering partially configured systems and periodically updated data, providing a middle ground between recovery speed and ongoing cost.

A known environment penetration test gives the tester full access to network diagrams, source code, and system credentials beforehand, which allows for a deeper, more thorough assessment since the tester does not need to spend time on reconnaissance to discover this information themselves. An unknown environment test instead gives the tester no prior information at all, more closely simulating a genuine external attacker's starting position, though it may not achieve the same depth of coverage within a limited testing timeframe. A partially known environment falls between these two extremes, providing some but not complete information, which is a common practical compromise balancing realism against thoroughness.

Loss of license specifically results in the organization losing its legal ability to operate in a given market or industry, which is one of the most severe possible consequences of non-compliance, since it can halt business operations entirely. Reputational damage instead results from negative public perception, such as press coverage, which can persist and affect customer trust well beyond any immediate financial or regulatory penalty. Recognizing that non-compliance carries multiple distinct consequence categories, not just financial fines, helps build a more complete business case for genuinely prioritizing compliance rather than treating it as merely a checkbox exercise.

A right-to-audit clause specifically grants the organization the contractual ability to conduct its own independent security assessment of a vendor's environment, providing ongoing verification rather than relying solely on the vendor's own self-reported assurances. A non-disclosure agreement instead protects confidential information shared between the parties, which is a different contractual concern from the ability to independently verify a vendor's security posture. Including a right-to-audit clause in vendor contracts reflects a proactive approach to third-party risk management, rather than trusting vendor security claims without any means of independent verification.

A risk register tracks each identified risk along with its assigned owner, a defined risk threshold that would trigger further action, and key risk indicators used to monitor that specific risk over time, serving as the central living record for an organization's risk management program. A business impact analysis instead focuses specifically on understanding the operational impact of a disruption, including metrics like RTO and RPO, which is a related but distinct risk management artifact from the broader risk register. Maintaining an accurate, actively used risk register, rather than a document created once and then ignored, is central to genuinely managing risk rather than merely documenting it.

The data custodian, or steward, is responsible for the day-to-day handling and technical protection of data, such as applying appropriate access controls and backups, which is a distinct role from the data owner or controller who decides how and why the data may be used in the first place. This division of responsibility ensures that someone with genuine day-to-day technical expertise is accountable for a dataset's practical protection, separate from the higher-level strategic decisions about its use. Clearly defining these roles helps avoid a situation where everyone assumes someone else is responsible for a specific data protection task.

A packet capture records raw network traffic at a specific point, allowing an analyst to reconstruct in detail exactly what data was exchanged between systems, which provides far more granular insight than summary logs alone can offer. This level of detail makes packet captures especially valuable for investigating sophisticated attacks where summary logs might not reveal the full content or context of suspicious traffic. Because packet captures can be very large and may contain sensitive data, they are typically retained selectively and handled with appropriate access controls during an investigation.

Recovery restores affected systems to normal operation after containment and eradication have already addressed the immediate threat, and lessons learned follows afterward to document what was learned from the incident for future improvement. This sequence reflects the standard incident response process order, where recovery must occur before a team can step back and reflect on lessons learned, since the incident is not yet actually resolved during recovery itself. Skipping or rushing the lessons learned phase, even after a technically successful recovery, forfeits valuable insight that could improve the organization's response to a similar future incident.

DMARC builds on top of SPF and DKIM by telling receiving mail servers exactly what to do with messages that claim to be from the organization's domain but fail those underlying authentication checks, such as rejecting or quarantining them. This provides a stronger, more actionable email security posture than SPF or DKIM alone, since without DMARC's explicit policy instruction, receiving servers might simply deliver an unauthenticated message anyway despite a failed check. Implementing DMARC alongside SPF and DKIM is a foundational email security practice specifically aimed at reducing domain spoofing and business email compromise attacks.

A SIEM centralizes log correlation and alerting across many sources, such as firewalls, servers, and applications, allowing it to detect patterns spanning multiple sources that would be invisible if each log source were reviewed in isolation. A vulnerability scanner instead identifies weaknesses in systems, and DLP focuses specifically on preventing sensitive data from leaving the organization, both of which serve different, more specialized purposes than a SIEM's broad log correlation and alerting function. A well-tuned SIEM is often considered the central nervous system of a security operations center, since it is where disparate signals from across the environment actually come together for correlated analysis.

A false positive occurs when a scan incorrectly flags a system as vulnerable when it is not actually vulnerable, wasting remediation effort investigating a non-issue. A false negative instead occurs when a scan fails to flag a system that actually is vulnerable, which is generally considered the more dangerous outcome, since the organization remains unaware of a genuine risk. Regularly reviewing both false positive and false negative rates helps a security team assess and improve the actual reliability of its vulnerability scanning tools and processes over time.

Disposal and decommissioning includes sanitization, ensuring data is irrecoverably destroyed before a device leaves the organization's control, and certification, retaining documentation proving this was done correctly, which is essential for both security and regulatory compliance purposes. This differs from acquisition or procurement, which instead addresses how assets enter the organization, occurring at the opposite end of the asset lifecycle from disposal. Maintaining proper certification documentation for sanitized devices provides an auditable record that can be critical evidence if a data breach is ever alleged to have originated from improperly disposed hardware.

Secure baselines establish a standard, hardened configuration that servers are deployed with, and then that same baseline is maintained over time by periodically checking existing servers for configuration drift away from the established standard. Sandboxing instead isolates a program's execution environment to contain potentially malicious behavior, which is a different security technique from defining and maintaining a configuration standard. Establishing secure baselines and then actively maintaining them, rather than only defining them once, is what actually prevents gradual configuration drift from silently eroding an organization's security posture over time.

A compensating control addresses the risk posed by a vulnerability without directly fixing the underlying flaw itself, which is exactly what added monitoring and restricted access accomplish when the legacy application cannot actually be patched. A preventive control instead aims to stop an incident before it occurs through direct means, and a corrective control acts after an incident to restore normal operations, both of which are different control types from a compensating control's indirect risk-reduction approach. Recognizing when a compensating control is genuinely needed, rather than assuming every vulnerability can simply be patched away, reflects a practical understanding of real-world constraints in security operations.

Data at rest refers to data stored on a persistent medium, such as records stored on disk, which encryption at that layer directly protects against unauthorized access if the storage medium itself is ever compromised or stolen. Data in transit instead refers to data actively moving across a network connection, such as query results being transmitted to an application server, which requires a different protection mechanism like TLS to secure the connection itself. Recognizing that data requires different protection mechanisms depending on its current state is foundational to designing a comprehensive data protection strategy that does not leave any single state unprotected.

A jump server serves as a single, tightly monitored intermediary that administrators must pass through before reaching production systems, rather than connecting directly from their own workstations, which centralizes logging and access control onto one well-secured chokepoint. A load balancer instead distributes incoming traffic across multiple servers for performance and availability, which is a different function entirely from providing a secure administrative access chokepoint. Requiring all administrative access to route through a jump server significantly reduces the direct exposure of production systems to potentially compromised administrator workstations.

Physical isolation, specifically an air-gapped configuration, physically disconnects a system from any other network entirely, eliminating any possibility of a remote network-based attack reaching it, which is reserved for the most sensitive systems where this level of isolation is justified by the risk. Logical segmentation instead still maintains network connectivity but restricts traffic flow through rules like firewalls or VLANs, which is a weaker isolation guarantee than true physical air-gapping. Air-gapping is not without operational tradeoffs, since legitimate data transfer to and from an air-gapped system typically requires manual processes like removable media, which introduces its own distinct security considerations.

Resources and funding distinguish a well-funded nation-state group, which can sustain long-term, well-resourced campaigns, from an unskilled attacker with minimal financial or technical backing. Level of sophistication and capability similarly distinguishes the nation-state's advanced, long-term campaign from the unskilled attacker's basic, publicly available tooling and minimal technical understanding. Recognizing these attribute differences helps a security team calibrate its defenses appropriately, since the controls needed to deter an unskilled opportunistic attacker differ significantly from those needed to meaningfully slow a well-resourced, sophisticated nation-state campaign.

An application allow list only permits a specific, pre-approved set of applications to run, blocking anything not explicitly included, which is a strong preventive mitigation against unauthorized or malicious software since only known-good applications are permitted by default. This differs from segmentation, which instead isolates network zones from each other, addressing a different attack surface than controlling exactly which applications can execute on an endpoint. Allow listing requires more upfront maintenance than a simpler block list approach, since every legitimate application must be explicitly approved, but it provides significantly stronger protection against unknown or novel malicious software.

Impossible travel flags logins from geographically distant locations within a timeframe that would be physically impossible to travel between, such as New York and Singapore twenty minutes apart, strongly suggesting the account credentials are being used from two different locations simultaneously, likely indicating compromise. Concurrent session usage instead flags simultaneous active sessions without necessarily analyzing geographic feasibility, which is a related but distinct indicator. Many identity providers now automatically flag impossible travel patterns, since this specific indicator is both highly reliable and relatively easy to calculate from login timestamp and location data alone.

Time-of-check refers to the moment a program verifies a condition, such as a file's safety, while time-of-use refers to the later moment the program actually acts on that condition, such as using the file. A race condition vulnerability exploits the gap between these two moments, allowing an attacker to swap in a malicious file after the check has already passed but before the file is actually used. Understanding this TOC/TOU gap is essential for recognizing why certain checks must be performed atomically, with no window for external interference, to be genuinely secure.

Business email compromise involves an attacker impersonating a trusted figure, such as a CEO, typically through a spoofed or compromised email account, to manipulate an employee into taking a harmful action like an unauthorized wire transfer. A watering hole attack instead compromises a website the target is likely to visit, and typosquatting registers domains with common misspellings, both of which are different attack techniques from directly impersonating an executive in an email. Business email compromise attacks often succeed specifically because they exploit urgency and authority, making user awareness training around this specific tactic particularly valuable.

Shadow IT refers to technology, such as an unauthorized cloud storage account, that is used within an organization entirely outside official IT department approval or visibility, which creates security risk since the organization has no ability to monitor, secure, or ensure compliance for that unmanaged resource. This differs from a nation-state actor or organized crime group, both of which are external threat actors with malicious intent, rather than an internal employee's well-intentioned but unauthorized workaround. Shadow IT often emerges when official IT-approved tools are perceived as too slow or restrictive, which is why addressing the underlying friction, not just blocking the workaround, is often part of an effective long-term response.

Key stretching deliberately runs a password or key through a slow, computationally expensive algorithm multiple times, which significantly increases the time and resources required for a brute-force attack against the stored value, even if the original password itself was relatively weak. This differs from simple hashing alone, which by itself can still be attacked relatively quickly with modern hardware unless deliberately slowed down through stretching. Algorithms like PBKDF2 are specifically designed to implement key stretching for exactly this purpose, making them a standard choice for securely storing password-derived values.

The policy enforcement point sits directly in the path of a connection request and actually enforces the access decision, acting as the gatekeeper that allows or denies traffic based on a decision made elsewhere in the architecture. The policy engine instead evaluates policy and makes the actual access decision, and the policy administrator communicates that decision to the enforcement point, both of which are logically separate components from the enforcement point itself. Understanding this separation of decision-making from enforcement is fundamental to how Zero Trust architecture is actually structured across its control plane and data plane.