CompTIA Security + SY0-701 (V7) Exam Practice Test 4

People capacity planning ensures enough trained personnel are actually available to execute recovery procedures during an emergency, recognizing that even perfectly designed technology and infrastructure recovery plans fail if there are not enough qualified people available to actually carry them out. Technology and infrastructure capacity instead address having sufficient compute resources and physical facilities respectively, which are necessary but not sufficient conditions without also having adequate people capacity. Overlooking people capacity planning, such as by relying on a single key individual with no backup, is a common and often costly gap in otherwise well-designed recovery plans.

Offensive penetration testing actively attempts to breach systems and evade detection, focusing on demonstrating what an attacker could actually accomplish against the target environment. Defensive testing instead focuses on evaluating how well the organization's own defensive team, sometimes called the blue team, actually detects and responds to a simulated attack, which is a different evaluation goal from simply demonstrating successful breach techniques. Combining both offensive and defensive testing perspectives, sometimes through an integrated engagement involving both red and blue teams working together, provides a more complete picture of an organization's actual security readiness than either perspective alone.

Internal compliance reporting communicates compliance status to the organization's own executive leadership, supporting internal decision-making and accountability without necessarily satisfying any external legal reporting requirement. External compliance reporting instead submits a formal report to an outside party, such as a government regulator, which typically carries its own specific format and legal requirements distinct from purely internal reporting. Maintaining both internal and external reporting processes ensures the organization's own leadership stays informed while also satisfying whatever formal external reporting obligations actually apply to that organization.

Rules of engagement establish specific boundaries and procedures for an authorized test, such as a penetration test, ensuring both parties have a clear, agreed-upon understanding of what is and is not permitted during the engagement. A questionnaire instead is a detailed written survey sent to a vendor about its security practices, providing a structured way to gather self-reported information without requiring an active technical engagement like a penetration test. Both activities support third-party risk management, but they serve different purposes, one governing an active technical assessment and the other gathering structured self-reported information from the vendor.

Avoiding a risk means eliminating the underlying activity or exposure entirely, such as discontinuing a risky business activity altogether, which is often the most complete way to address a risk but can also mean forgoing whatever benefit that activity would have provided. Mitigating instead reduces a risk's probability or impact through additional controls while still continuing the underlying activity, which is a less drastic response than eliminating the activity entirely. Choosing avoidance over mitigation, transfer, or acceptance reflects a judgment that the risk associated with a specific activity outweighs any benefit that activity provides, at least given currently available options for managing it.

Monitoring and revision periodically reviews security policies to confirm they remain relevant given changes in technology, regulation, and business operations, updating them as needed rather than treating a policy as a static, one-time document. Without this ongoing review process, policies can quietly become outdated and increasingly disconnected from actual current practices and requirements, undermining their practical value even if they technically remain in effect. Building a regular policy review cadence into governance processes helps ensure the organization's documented policies continue to reflect its actual current risk environment and obligations.

A dashboard consolidates key security metrics and alerts from multiple systems into a single real-time visual summary, giving an analyst quick situational awareness during an investigation without needing to separately query each individual underlying system. This differs from raw log data or packet captures, which provide much more granular detail but require more time and expertise to interpret directly compared to a dashboard's pre-summarized visual presentation. Well-designed security dashboards strike a balance between providing enough summarized insight to be immediately useful while still allowing an analyst to drill down into underlying detailed data when a specific alert warrants closer investigation.

Passwordless authentication eliminates traditional passwords entirely, relying instead on factors like biometrics combined with a device-bound security key, which removes the risk of password-related attacks like credential stuffing or phishing that specifically target traditional password-based logins. Password vaulting instead still involves managing actual passwords, just doing so securely within a centralized vault, which is a different approach from eliminating passwords from the authentication process altogether. Passwordless authentication is increasingly favored specifically because it removes an entire category of common attack vectors that depend on a password existing somewhere in the first place, whether it can be guessed, stolen, or reused.

XDR extends beyond EDR's endpoint-focused monitoring and response, correlating data across multiple security domains such as network and email in addition to endpoints, providing broader visibility and more comprehensive detection than any single domain's tools could achieve alone. EDR by itself focuses specifically on endpoint-level monitoring and response, which is valuable but narrower in scope than XDR's cross-domain correlation capability. Adopting XDR reflects a recognition that sophisticated attacks often span multiple domains, such as an email-delivered payload that later exhibits network-level command-and-control activity, which siloed single-domain tools might correlate too slowly or miss entirely.

NetFlow captures summarized records of network traffic flows, including source, destination, and volume information, without capturing the actual full packet contents, providing a lightweight way to understand traffic patterns at scale compared to full packet capture. A vulnerability scanner instead identifies weaknesses in systems, which is a completely different monitoring purpose from summarizing network traffic flow patterns. NetFlow data is particularly useful for identifying unusual traffic volume patterns or unexpected communication between systems, even when the actual packet content itself is not available for deeper inspection.

An exception temporarily accepts a known, applicable vulnerability for a limited time due to a valid operational reason, typically with an expiration date and a plan to eventually address it. An exemption instead formally determines that a vulnerability does not actually apply to the specific environment at all, such as when the vulnerable component is not actually present or exploitable in that particular deployment. Both concepts provide a formal, documented way to handle a vulnerability without immediate remediation, but they reflect fundamentally different underlying justifications, temporary acceptance versus genuine inapplicability.

Sanitization securely wipes data from a drive while leaving the physical device intact and reusable, which is appropriate when the hardware itself still has value and the organization is confident the wiping process fully removes all recoverable data. Destruction instead physically shreds or otherwise permanently destroys the drive so it can never be used again, providing the strongest possible assurance against data recovery at the cost of losing any remaining hardware value. Choosing between sanitization and destruction often depends on the sensitivity of the data that was stored and the organization's risk tolerance for any residual chance of data recovery.

Secure cookies use attributes ensuring a cookie is only transmitted over encrypted HTTPS connections and cannot be accessed by client-side scripts, protecting session tokens and other sensitive cookie data from interception or theft through cross-site scripting attacks. Static code analysis instead examines application source code for vulnerabilities without executing it, which is a different application security practice from configuring how a specific cookie behaves at runtime. Properly configuring secure cookie attributes is a simple but often overlooked web application hardening step that directly mitigates several common cookie-based attack techniques.

A directive control instructs or mandates specific behavior through policy, such as requiring annual training, relying on the written directive itself rather than a technical mechanism to actually enforce compliance. A preventive control instead directly stops an incident through technical or physical means, which is a fundamentally different mechanism than simply issuing an instruction and expecting compliance. Directive controls often work best when paired with a verification mechanism, such as tracking training completion rates, since the directive alone provides no automatic enforcement of the required behavior.

Data sovereignty refers to the legal principle that data is subject to the laws of the country where it is physically located, and geolocation tracks exactly where that data actually resides, together explaining why a regulation might require certain citizen data to be physically stored within a specific country's borders. Tokenization, masking, encryption, and hashing instead address protecting data's content or format, which is a different concern from where the data is physically located and which country's laws apply to it. Organizations operating across multiple jurisdictions must carefully track data sovereignty requirements, since storing regulated data in the wrong physical location can create serious compliance violations regardless of how well that data is otherwise protected.

A screened subnet, sometimes still called a DMZ, isolates public-facing resources like a web server from both the public internet and the fully trusted internal network, allowing controlled traffic between all three zones through carefully defined firewall rules. This differs from a VLAN, which is a Layer 2 segmentation mechanism that could be used to implement a screened subnet but is not itself the broader security zone concept. Placing internet-facing resources in a screened subnet, rather than directly on the internal network, ensures that if the web server is ever compromised, the attacker still faces additional barriers before reaching fully trusted internal systems.

A hybrid cloud model runs some workloads on private infrastructure and others on a public cloud provider, with data and applications sometimes moving between the two environments, combining benefits of both approaches rather than committing exclusively to one. A purely public cloud model instead runs everything on a third-party provider's shared infrastructure, and a purely private cloud model runs everything on dedicated, organization-controlled infrastructure, both of which are simpler single-environment approaches compared to a hybrid model's combination. Hybrid cloud considerations specifically require attention to how the responsibility matrix and security boundaries shift as workloads move between the private and public portions of the environment.

Message-based threat vectors include SMS text messages as one specific channel alongside email and instant messaging, all of which can carry malicious links or content designed to trick a recipient into taking a harmful action. Removable device threat vectors instead exploit physical media, such as a deliberately left USB drive relying on human curiosity, which is a completely different delivery mechanism than any message-based channel. Both vectors ultimately rely on social engineering to succeed, since the attacker needs the target to actually click a link or plug in a device rather than exploiting a purely technical flaw.

Configuration enforcement automatically checks systems against a defined secure configuration standard and automatically reverts any unauthorized deviation back to the approved baseline, providing continuous, automated protection against configuration drift rather than relying solely on periodic manual audits. Monitoring alone instead might detect and alert on a deviation without automatically correcting it, which is a less proactive response than configuration enforcement's automatic reversion. Automating configuration enforcement significantly reduces the window during which an unauthorized or accidental configuration change could leave a system exposed before being caught and corrected.

Resource consumption flags abnormally high CPU or memory usage without a corresponding legitimate explanation, such as increased user traffic, suggesting something unexpected, potentially malicious, is consuming those resources. Resource inaccessibility instead describes a resource becoming unavailable entirely, which is a related but distinct indicator from elevated but still-functioning resource usage. Cryptomining malware is a common real-world cause of this specific indicator, since it deliberately consumes significant CPU resources for as long as it remains undetected on a compromised system.

SQL injection inserts malicious database commands into an application's input, exploiting improperly sanitized or parameterized queries so the database executes unintended commands, potentially exposing or corrupting data. Cross-site scripting instead injects malicious script code into a web page that then executes in other users' browsers when they view the compromised page, targeting the victim's browser session rather than the backend database directly. Both vulnerability types stem from insufficient input validation and output encoding, but they target fundamentally different layers, one the database backend and the other the client-side browser experience.

A client-based approach requires a dedicated software component, often called an agent, installed directly on each target system to perform its assessment, which can provide deeper visibility but requires ongoing agent deployment and maintenance across the environment. An agentless approach instead assesses systems remotely without installing anything locally, which is simpler to deploy broadly but may provide less depth of visibility than a locally installed agent can achieve. Choosing between client-based and agentless approaches often involves weighing deployment overhead against the depth of visibility each approach can realistically provide for a given environment.

A hacktivist is motivated by philosophical or political beliefs, which matches defacing a website specifically to protest environmental practices with no apparent financial motive, reflecting an ideologically driven rather than profit-driven attack. Organized crime instead is primarily motivated by financial gain, which does not match this scenario's clear absence of any apparent monetary objective. Recognizing hacktivist motivation helps predict likely targets, since hacktivists tend to select targets based on perceived ideological or political relevance rather than simply whichever target offers the highest financial payoff.

A root of trust is a hardware-based cryptographic foundation that is inherently trusted by the system, since every other layer of security, such as Secure Boot verification, ultimately depends on and is verified against this foundational anchor. If the root of trust itself were ever compromised, every security guarantee built on top of it would become unreliable, which is why this component typically receives the strongest possible physical and cryptographic protection, often through a dedicated hardware component like a TPM. Understanding the root of trust concept helps explain why hardware-based security foundations are considered fundamentally stronger than purely software-based trust mechanisms that lack this same hardware anchor.

A gap analysis compares current control implementation against a defined standard or framework's requirements, specifically identifying which required controls are missing or incomplete, providing a clear, prioritized roadmap for closing those identified gaps. This differs from simply reviewing authorization models, which addresses how access decisions are structured rather than comparing overall control coverage against an external framework. Conducting a gap analysis is a common and valuable first step when an organization is working toward a specific compliance framework or maturity target, since it clarifies exactly where effort needs to be focused.