CompTIA Security+ (SY0-701) Exam Questions

Correct answer: Confidentiality
Encryption protects confidentiality by ensuring only authorized parties who hold the decryption key can read the data, even if the storage media itself is stolen or physically accessed.

Why the other options are incorrect:
● Availability — Availability is about ensuring authorized users can access data and systems when needed; encrypting data at rest does not, by itself, keep systems accessible.
● Integrity — Integrity is about ensuring data has not been altered; encryption alone protects secrecy, not against unauthorized modification, which is typically addressed with hashing or digital signatures.
● Non-repudiation — Non-repudiation is not one of the three CIA triad principles; it refers to proof that an action or communication genuinely came from a specific party.

Source: NIST SP 800-12 Rev. 1, An Introduction to Information Security

Correct answer: Accounting
Accounting (sometimes called auditing) is the AAA element responsible for recording what a user did after being authenticated and authorized, creating a log trail that can be reviewed later for security monitoring or compliance.

Why the other options are incorrect:
● Authentication — Authentication verifies a user’s identity, such as with a password or token, before granting access; it does not itself record ongoing activity.
● Authorization — Authorization determines what an already-authenticated user is permitted to do; it defines permissions, not the logging of actions taken.
● Non-repudiation — Non-repudiation is a related security goal, proving an action can be tied to a specific actor, but it is not one of the three AAA elements.

Source: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

Correct answer: Zero Trust
Zero Trust is an architectural approach built on the principle of “never trust, always verify,” removing the assumption of implicit trust based on network location and instead requiring continuous verification of every access request.

Why the other options are incorrect:
● Defense in depth — Defense in depth refers to layering multiple, different security controls so that if one fails, others still provide protection; it is related but distinct from removing implicit trust based on location.
● Security through obscurity — Security through obscurity relies on hiding how a system works as its primary protection, which is discouraged as a standalone strategy and is unrelated to continuous verification.
● Least functionality — Least functionality is the practice of configuring systems to provide only essential capabilities, which is one hardening technique, not the overall “never trust, always verify” model.

Source: NIST SP 800-207, Zero Trust Architecture

Correct answer: Non-repudiation
Non-repudiation provides proof of the origin and integrity of data, preventing a party from credibly denying having sent a message or performed an action; digital signatures created with a private key that only the signer possesses are a primary mechanism for achieving this.

Why the other options are incorrect:
● Confidentiality — Confidentiality is about keeping information secret from unauthorized parties, not proving who originated a message.
● Availability — Availability is about ensuring systems and data are accessible when needed, which is unrelated to proving authorship.
● Obfuscation — Obfuscation is the practice of making something, such as code or data, more difficult to understand; it is not a mechanism for proving the origin of an action.

Source: NIST SP 800-57 Part 1 Rev. 5, Recommendation for Key Management

Correct answer: Deterrent control
A deterrent control is intended to discourage an attacker or bad actor from attempting a violation in the first place, such as warning signage about surveillance; its goal is prevention through psychological discouragement rather than detection or response after the fact.

Why the other options are incorrect:
● Detective control — A detective control identifies and records that a security event occurred, such as the cameras themselves capturing footage, but the signage’s primary purpose here is discouragement, not detection.
● Corrective control — A corrective control acts to limit damage and restore normal operations after an incident has already occurred, which does not describe posting a warning sign.
● Compensating control — A compensating control is an alternative safeguard used when a primary control cannot be implemented; it does not describe discouraging an attack through visible warnings.

Source: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

Correct answer: Change management
Change management is the formal process for proposing, reviewing, approving, testing, and documenting changes to production systems, including rollback planning, to minimize the risk of unintended disruption or security exposure.

Why the other options are incorrect:
● Vulnerability management — Vulnerability management focuses on identifying, prioritizing, and remediating known weaknesses, which may trigger a change but is a distinct process from the formal review-and-approval workflow for making changes.
● Onboarding — Onboarding is the process of provisioning access and resources for new employees or systems, unrelated to reviewing modifications to existing production systems.
● Data retention — Data retention governs how long data must be kept and when it should be disposed of, unrelated to the process of reviewing and approving system changes.

Source: NIST SP 800-128, Guide for Security-Focused Configuration Management of Information Systems

Correct answer: Authorization
Authentication (verifying the username and password) happens first, at login. Immediately afterward, authorization is applied to determine what that now-authenticated user is permitted to access or do on the system.

Why the other options are incorrect:
● Authentication — Authentication is the step that already occurred — logging in with a username and password is the authentication step itself, not what happens after it.
● Identification — Identification (claiming an identity, e.g., entering a username) happens before authentication, not after it.
● Accounting — Accounting records what a user does after they’re authenticated and authorized; it is an ongoing logging process, not the step applied immediately after login.

Source: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

Correct answer: Accounting
In the AAA (authentication, authorization, accounting) model, accounting is the function of logging and tracking what a user did — such as recording events in an audit log — for monitoring, billing, or forensic purposes.

Why the other options are incorrect:
● Non-repudiation — Non-repudiation ensures a party cannot deny having performed an action, typically supported by logs and digital signatures, but it is a broader security property, not the AAA function of logging itself.
● Authorization — Authorization determines what an already-authenticated user is permitted to do; it does not refer to recording those actions afterward.
● Authentication — Authentication verifies a user’s identity at login; it occurs before, and is distinct from, the logging of subsequent actions.

Source: NIST SP 800-53 Rev. 5, Audit and Accountability (AU) control family

Correct answer: Data stored on a persistent storage media
Data at rest refers to data that is stored on persistent storage media, such as hard drives, SSDs, or backup tapes, as opposed to data that is currently moving across a network or being actively processed in memory.

Why the other options are incorrect:
● Data present in volatile memory — Data in volatile memory (RAM) that isn’t persisted to storage is generally considered part of data in use, not data at rest.
● Data being transmitted over a network — Data being transmitted over a network is classified as data in transit, a distinct state from data at rest.
● Data being actively processed by a computer — Data being actively processed by a computer is classified as data in use, not data at rest.

Source: NIST SP 800-53 Rev. 5 Glossary, Data At Rest

Correct answer: Confidentiality
Confidentiality is the security property concerned with preventing unauthorized access to or disclosure of data, whether it is being stored or transferred — exactly the concern described in controlling access to critical data.

Why the other options are incorrect:
● Integrity — Integrity concerns whether data has been altered or tampered with, not whether unauthorized parties can access or transfer it.
● Social engineering — Social engineering is an attack technique that manipulates people into divulging information or granting access; it is a threat vector, not the security property being protected here.
● Availability — Availability concerns whether authorized users can access data and systems when needed, which is the opposite concern from restricting unauthorized access.

Source: NIST SP 800-53 Rev. 5 Glossary, Confidentiality

Correct answer: Disposal
The CIA triad defines the three core information security objectives as confidentiality, integrity, and availability. Disposal (securely destroying or sanitizing data and media at the end of their lifecycle) is an important security practice, but it is a data-handling activity, not one of the three foundational objectives the triad defines.

Why the other options are incorrect:
● Confidentiality — Confidentiality is one of the three CIA triad objectives, concerned with preventing unauthorized access to or disclosure of information, so it is not the exception being asked for.
● Integrity — Integrity is one of the three CIA triad objectives, concerned with ensuring data has not been improperly altered, so it is not the exception being asked for.
● Availability — Availability is one of the three CIA triad objectives, concerned with ensuring authorized users can access data and systems when needed, so it is not the exception being asked for.

Source: NIST SP 800-12 Rev. 1, An Introduction to Information Security

Correct answer: Advanced persistent threat (APT) / nation-state actor
An advanced persistent threat (APT), typically associated with nation-state actors, is characterized by significant funding, sophisticated tools, and a long-term, stealthy campaign aimed at a specific high-value target, exactly matching this scenario.

Why the other options are incorrect:
● Script kiddie — A script kiddie has limited skill and typically relies on pre-built tools for opportunistic, unsophisticated attacks, not a year-long, well-funded, stealthy campaign.
● Hacktivist — A hacktivist is motivated by political or social causes and often seeks public attention, such as defacement or leaks, rather than quiet, sustained espionage.
● Insider threat — An insider threat originates from someone with legitimate authorized access within the organization, whereas this scenario describes an external actor infiltrating the network.

Source: CISA, Nation-State Cyber Actors

Correct answer: Insider threat
An insider threat is a threat that originates from someone within the organization who has authorized access to systems and misuses that legitimate access for unauthorized or malicious purposes, exactly as described.

Why the other options are incorrect:
● External attacker — An external attacker has no legitimate access and must first breach the organization’s defenses; this employee already had authorized administrative access.
● Hacktivist — A hacktivist is externally motivated by political or social causes, not personal financial gain through misuse of one’s own job access.
● Shadow IT — Shadow IT refers to the use of unauthorized systems, applications, or devices by employees, not misuse of already-authorized access to an approved system.

Source: CISA, Insider Threat Mitigation

Correct answer: Pretexting
Pretexting is a social engineering technique in which an attacker fabricates a believable scenario, such as impersonating an executive under time pressure, to manipulate a victim into bypassing normal procedures.

Why the other options are incorrect:
● Phishing — Phishing is typically conducted through deceptive electronic messages, such as email or SMS, rather than a live phone impersonation scenario like this one.
● Tailgating — Tailgating is a physical security technique where an unauthorized person follows an authorized person through a secured door; it does not involve a phone-based impersonation.
● Typosquatting — Typosquatting involves registering domain names that are common misspellings of legitimate sites to trick users; it is unrelated to a live phone pretext.

Source: CISA, Malware, Phishing, and Ransomware

Correct answer: Business email compromise (BEC)
Business email compromise (BEC) is a form of targeted phishing in which an attacker impersonates a trusted executive or partner, typically through a spoofed or lookalike email address, to trick an employee into making an unauthorized wire transfer or disclosing sensitive information.

Why the other options are incorrect:
● Distributed denial-of-service (DDoS) — A DDoS attack overwhelms a system or service with traffic to make it unavailable; it has nothing to do with tricking someone into a fraudulent wire transfer.
● On-path (man-in-the-middle) attack — An on-path attack intercepts and potentially alters communications between two parties in transit; this scenario describes a deceptive email, not intercepted communications.
● Credential stuffing — Credential stuffing uses previously breached username and password pairs to attempt logins on other services; it does not describe impersonating an executive to request a wire transfer.

Source: CISA, Malware, Phishing, and Ransomware

Correct answer: Ransomware
Ransomware is malicious software that encrypts a victim’s files or locks them out of their systems, then demands a ransom payment, often in cryptocurrency, in exchange for restoring access, exactly matching the scenario described.

Why the other options are incorrect:
● Spyware — Spyware secretly monitors and collects user activity or data without the user’s knowledge; it does not encrypt files or demand a ransom.
● Adware — Adware displays unwanted advertisements; it is a nuisance rather than a data-encrypting, extortion-based attack.
● Logic bomb — A logic bomb is malicious code that lies dormant until triggered by a specific condition or date, and while it can cause damage, the ransom-demand behavior described here is specifically characteristic of ransomware.

Source: CISA, Malware, Phishing, and Ransomware

Correct answer: Rootkit
A rootkit is malware specifically designed to gain and maintain privileged, often kernel-level, access to a system while actively concealing its presence, hiding files, processes, and network activity from the operating system and security tools, matching this scenario precisely.

Why the other options are incorrect:
● Worm — A worm is malware that self-replicates and spreads across networks without needing to attach to a host file or program; concealment of kernel-level artifacts is not its defining trait.
● Keylogger — A keylogger records keystrokes to capture credentials or sensitive input; it does not necessarily manipulate kernel functions to hide system-wide artifacts.
● Trojan — A trojan disguises itself as legitimate software to trick a user into installing it; the defining behavior here, kernel-level concealment, is specifically characteristic of a rootkit rather than the trojan’s delivery method.

Source: NIST SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops

Correct answer: Worm
A worm is a standalone piece of malware that self-replicates and spreads autonomously across networks by exploiting vulnerabilities, without requiring any user interaction or a host file, unlike a virus.

Why the other options are incorrect:
● Virus — A virus requires attaching itself to a host file or program and typically needs some user action, like opening an infected file, to execute and spread, unlike the autonomous spreading described here.
● Trojan — A trojan relies on disguising itself as legitimate software to trick a user into installing it; it does not self-propagate across a network like a worm.
● Fileless malware — Fileless malware operates in memory and abuses legitimate system tools to avoid writing files to disk, which is a distinct evasion technique, not specifically defined by autonomous network-based self-propagation.

Source: NIST SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops

Correct answer: SQL injection
SQL injection occurs when unvalidated user input is inserted directly into a database query, allowing an attacker to alter the query’s logic, such as bypassing authentication or extracting data, exactly as described in this scenario.

Why the other options are incorrect:
● Cross-site scripting (XSS) — Cross-site scripting involves injecting malicious script into web pages viewed by other users’ browsers, not manipulating a backend database query.
● Buffer overflow — A buffer overflow occurs when a program writes more data to a memory buffer than it can hold, corrupting adjacent memory; it is unrelated to manipulating a SQL query’s logic.
● Cross-site request forgery (CSRF) — CSRF tricks an authenticated user’s browser into submitting unwanted requests to a site where they are already logged in; it does not involve injecting code into a database query field.

Source: NIST SP 800-115, Technical Guide to Information Security Testing and Assessment

Correct answer: Zero-day vulnerability
A zero-day vulnerability is a flaw that is unknown to the vendor, or for which no patch yet exists, at the time it is discovered or actively exploited, giving defenders “zero days” of advance notice to prepare a fix.

Why the other options are incorrect:
● Legacy vulnerability — A legacy vulnerability typically refers to a known weakness in outdated or unsupported systems that no longer receive vendor updates, not a brand-new, previously unknown flaw.
● Misconfiguration — A misconfiguration vulnerability results from improperly configured settings, such as default credentials or open permissions, not from an inherent, unpatched software flaw.
● Race condition — A race condition is a specific type of software flaw where the outcome depends on the timing of events; it is a possible root cause category but does not itself mean the flaw is unknown to the vendor.

Source: CISA, Known Exploited Vulnerabilities (KEV) Catalog

Correct answer: Buffer overflow
A buffer overflow occurs when a program writes more data into a fixed-size memory buffer than it was allocated to hold, corrupting adjacent memory and potentially allowing an attacker to execute arbitrary code or crash the application.

Why the other options are incorrect:
● Cross-site scripting — Cross-site scripting injects malicious script that executes in a victim’s browser through a web application; it is unrelated to overwriting memory buffers.
● Directory traversal — Directory traversal manipulates file path input to access files outside an intended directory; it does not involve overwriting a memory buffer.
● Insecure deserialization — Insecure deserialization occurs when untrusted serialized data is processed unsafely, potentially leading to code execution, but the specific mechanism described here, a fixed-size buffer overwritten by oversized input, defines a buffer overflow.

Source: NIST SP 800-115, Technical Guide to Information Security Testing and Assessment

Correct answer: Least privilege
The principle of least privilege states that a user, account, or process should be granted only the minimum access rights necessary to perform its required function, and no more, exactly as described for the database administrator’s scoped access.

Why the other options are incorrect:
● Separation of duties — Separation of duties divides critical tasks among multiple people so that no single individual can complete a sensitive process alone; it is a related but distinct control from limiting the scope of one person’s permissions.
● Job rotation — Job rotation periodically moves employees between roles or responsibilities, often to detect fraud or reduce dependency on one person; it does not describe scoping an account’s permissions.
● Mandatory vacation — Mandatory vacation requires employees to take time off, during which their duties are covered by someone else, helping surface fraudulent activity; it does not describe permission scoping.

Source: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

Correct answer: A credentialed scan, because it provides login rights for a more thorough analysis of potential vulnerabilities.
A credentialed scan authenticates to the target system using valid login credentials, letting the scanner inspect local configuration, installed software versions, and security settings from the inside — exactly what’s needed to find misconfigured applications and settings, not just externally visible weaknesses.

Why the other options are incorrect:
● A non-credentialed scan, because it provides login rights for a more thorough analysis of potential vulnerabilities. — This option is self-contradictory: a non-credentialed scan by definition does not use login rights, so it cannot provide the deeper visibility described.
● Both a credentialed and non-credentialed scan would be equally effective in this scenario. — A non-credentialed scan only sees what’s visible without authentication, missing local misconfigurations a credentialed scan would catch — the two are not equally effective here.
● Neither a credentialed nor a non-credentialed scan would be effective in this scenario. — A credentialed scan is well-suited to exactly this scenario, so dismissing both options is incorrect.

Source: NIST SP 800-115, Technical Guide to Information Security Testing and Assessment

Correct answer: Unsupported systems no longer receive vendor updates or patches, making their attack surfaces more susceptible to known exploits.
The defining risk of an unsupported system or application is that the vendor no longer issues patches or security updates for it. Any newly discovered vulnerability therefore stays open indefinitely, giving attackers a growing set of known, unpatched exploits to use against it.

Why the other options are incorrect:
● Unsupported systems are inherently more complex, thus presenting a larger attack surface. — Complexity isn’t what defines “unsupported” — a simple system can be unsupported too; the risk comes from the lack of patching, not inherent complexity.
● Unsupported systems often operate on obsolete hardware, increasing their vulnerability to physical threat vectors. — Obsolete hardware and physical threats are a separate concern from software support status; a system can run unsupported software on current hardware.
● Unsupported systems usually have outdated security measures, broadening the threat vectors. — This is vague and doesn’t identify the actual mechanism (no more patches for known vulnerabilities) that makes unsupported systems risky.

Source: NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning

Correct answer: Attack surface
The attack surface is the complete set of points where an unauthorized user (a threat actor) could try to enter or extract data from an environment — including systems, network ports, applications, and user interactions — exactly the collection this assessment mapped out.

Why the other options are incorrect:
● Attack vector — An attack vector is the specific path or method a threat actor actually uses to exploit a vulnerability, not the full inventory of potential exploitation points.
● Threat landscape — Threat landscape describes the broader, evolving collection of threats and threat actors an organization faces, not the organization’s own internal inventory of exploitable points.
● Threat vector — A threat vector, like an attack vector, refers to a specific delivery mechanism for a threat, not the complete mapped set of potential entry points.

Source: NIST SP 800-53 Rev. 5 Glossary, Attack Surface

Correct answer: Political change
This scenario describes hacktivism: the group is driven by disdain for the organization’s practices and is explicitly trying to raise awareness and force changes in its conduct, which is the defining, ideology-driven motivation of political/social change rather than personal profit or espionage.

Why the other options are incorrect:
● Financial gain — Financial gain describes attackers motivated by profit, such as ransomware or fraud operators; this scenario explicitly describes an ideological, not financial, motive.
● Espionage — Espionage is about covertly stealing information for intelligence purposes, typically staying hidden; this group is openly disruptive and seeking public awareness, the opposite of quiet espionage.
● Vandalism — Vandalism is destruction or defacement for its own sake without a stated cause; here the group has an explicit ideological objective of changing organizational conduct, which is hacktivism, not simple vandalism.

Source: CISA, Cyber Threats and Advisories

Correct answer: Layer 3
Layer 3 (the Network layer) is where logical IP addressing and routing occur; an unauthorized host obtaining a valid network address (for example, through DHCP or address spoofing) operates at this layer, and that address is what lets it route and communicate with hosts in other network zones.

Why the other options are incorrect:
● Layer 4 — Layer 4 (Transport) handles end-to-end connections and ports (TCP/UDP); it doesn’t govern how a host obtains a network address in the first place.
● Layer 1 — Layer 1 (Physical) covers raw electrical/optical signaling and cabling; it has no concept of addresses or spoofing.
● Layer 7 — Layer 7 (Application) is where application data and protocols like HTTP/DNS operate; address assignment and routing occur below it, at Layer 3.

Source: RFC 791, Internet Protocol

Correct answer: Insider threat
An insider threat originates from someone with legitimate, authorized access to an organization’s systems and data — such as an active employee — who misuses that access for unauthorized or malicious purposes, exactly as described here.

Why the other options are incorrect:
● Advanced persistent threat — An advanced persistent threat describes a sophisticated, typically external actor conducting a prolonged, stealthy campaign, not a single active employee’s misuse of legitimate access.
● Nation-state — A nation-state actor is a government-sponsored external threat group, not an internal employee acting alone for personal gain.
● Hacktivist — A hacktivist is motivated by ideology and typically operates externally to disrupt or embarrass an organization publicly, not to quietly sell stolen data for profit.

Source: CISA, Insider Threat Mitigation

Correct answer: On-path attack
An on-path (man-in-the-middle) attack occurs when an attacker intercepts communications between two parties — here, capturing the password hash as it was transmitted in transit during authentication — rather than guessing or computing the password offline.

Why the other options are incorrect:
● Dictionary attack — A dictionary attack tries common words or phrases against a stored or captured hash offline; it doesn’t describe intercepting a hash in transit.
● Brute force attack — A brute force attack systematically tries all possible password combinations; it also doesn’t describe intercepting data as it travels over the network.
● XSS attack — An XSS (cross-site scripting) attack injects malicious scripts into web content viewed by other users; it is unrelated to intercepting authentication traffic on the network.

Source: NIST SP 800-63-3, Digital Identity Guidelines

Correct answer: Ransomware
A lock screen demanding contact with an attacker-controlled email (or payment) to regain access to files and systems is the defining behavior of ransomware, which encrypts or locks data and extorts the victim for its release.

Why the other options are incorrect:
● Rootkit — A rootkit is malware designed to hide its presence and maintain privileged access; it does not typically lock the screen and demand contact to restore access.
● Spyware — Spyware secretly monitors and collects user activity or data without the user’s knowledge; it does not lock systems or demand payment/contact.
● Bloatware — Bloatware refers to unwanted pre-installed or unnecessary software that consumes resources; it is a nuisance, not an extortion-based attack.

Source: CISA, Malware, Phishing, and Ransomware

Correct answer: An external threat actor with high capability and high resources
Threat actors are commonly classified by location (internal or external), level of sophistication/capability, and resources/funding. This group has no internal access, making it external; its members are described as highly skilled and capable of creating advanced exploit techniques, making its capability high; and it has extensive funding, making its resources high.

Why the other options are incorrect:
● An internal threat actor with high capability and low resources — The scenario states the group has no internal access, which rules out “internal,” and it has extensive funding, which rules out “low resources.”
● An external threat actor with low capability and high resources — The group’s members are described as highly skilled and able to create advanced exploit techniques, which indicates high capability, not low capability.
● An internal threat actor with low capability and low resources — The scenario explicitly states the group has no internal access and extensive funding, so both “internal” and “low resources” are incorrect.

Source: CompTIA Security+ SY0-701 Exam Objectives

Correct answer: An external threat
Unsolicited port scans and service probes arriving from the public internet are reconnaissance activity carried out by threat actors outside the organization’s network perimeter, searching for open ports and exposed services to exploit. Hardening the server by closing unused ports and disabling unneeded services reduces this externally-facing attack surface.

Why the other options are incorrect:
● An internal threat — Insiders already have authorized access to the network and do not need to scan a server from the public internet to discover its exposed services; this scenario describes outside-originated reconnaissance.
● A zero-day threat — A zero-day threat refers to a vulnerability that is unknown to the vendor and has no available patch; it describes a type of flaw, not the source or location of a scanning threat actor.
● An isolated threat — “Isolated” describes a network segmentation state, such as an air-gapped system, not a category of threat actor conducting port scans over the public internet.

Source: NIST SP 800-115, Technical Guide to Information Security Testing and Assessment

Correct answer: Demilitarized zone (DMZ)
A demilitarized zone (DMZ) is a perimeter network segment that hosts public-facing services, isolated by firewalls from both the untrusted internet and the trusted internal network, limiting the exposure of the internal network if the public-facing server is compromised.

Why the other options are incorrect:
● Virtual private network (VPN) — A VPN creates an encrypted tunnel for remote connectivity between networks or users; it does not describe segmenting a public-facing server into its own isolated zone.
● Network address translation (NAT) — NAT translates private IP addresses to public ones, or vice versa, for routing purposes; it is a translation mechanism, not a network segmentation or isolation architecture.
● Air gap — An air gap physically isolates a system from all other networks, including the internet, which would prevent a public-facing web server from being reachable at all.

Source: NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy

Correct answer: Microsegmentation
Microsegmentation divides a network into very small, isolated zones, down to the individual workload or application level, and enforces strict authentication and authorization for traffic between them, a key architectural technique for implementing Zero Trust principles.

Why the other options are incorrect:
● Flat network design — A flat network design places all devices on a single broadcast domain with minimal segmentation, which is the opposite of the fine-grained isolation described here.
● Network address translation — Network address translation is an addressing and translation technique, not a segmentation or access-control architecture.
● Full-mesh VPN — A full-mesh VPN interconnects multiple sites with encrypted tunnels; it does not describe fine-grained, workload-level internal segmentation.

Source: NIST SP 800-207, Zero Trust Architecture

Correct answer: The guest operating system, applications, and data running on the virtual machines
Under the shared responsibility model for IaaS, the cloud provider secures the underlying physical infrastructure, hypervisor, and physical network, while the customer remains responsible for securing the guest operating system, any applications they install, and their own data.

Why the other options are incorrect:
● The physical security of the cloud provider’s datacenters — Physical datacenter security is retained by the cloud provider in every service model, including IaaS, PaaS, and SaaS, not shifted to the customer.
● The physical network cabling between the provider’s datacenters — Physical network cabling between the provider’s own datacenters is part of the provider’s infrastructure, which the customer never manages.
● The virtualization hypervisor itself — The hypervisor that enables virtualization is managed and secured by the cloud provider, not the customer, under IaaS.

Source: NIST SP 800-145, The NIST Definition of Cloud Computing

Correct answer: Infrastructure as Code (IaC)
Infrastructure as Code (IaC) is the practice of managing and provisioning infrastructure through machine-readable, version-controlled definition files, enabling consistent, repeatable, and auditable deployments instead of manual, error-prone configuration.

Why the other options are incorrect:
● Shadow IT — Shadow IT refers to systems or software used without organizational approval or oversight, unrelated to codified infrastructure provisioning.
● Virtual desktop infrastructure (VDI) — Virtual desktop infrastructure hosts virtualized end-user desktops centrally; it does not describe defining infrastructure in version-controlled code.
● Bare-metal provisioning — Bare-metal provisioning refers to deploying an operating system directly onto physical hardware without a hypervisor; it does not by itself describe the code-driven, version-controlled approach in this scenario.

Source: NIST SP 800-128, Guide for Security-Focused Configuration Management of Information Systems

Correct answer: Recovery Time Objective (RTO) and Recovery Point Objective (RPO)
The Recovery Time Objective (RTO) defines the maximum acceptable time to restore a system after a disruption, 4 hours in this scenario, while the Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, 15 minutes here.

Why the other options are incorrect:
● Recovery Point Objective (RPO) and Recovery Time Objective (RTO) — This reverses the order; the 4-hour restoration target is RTO, and the 15-minute data-loss tolerance is RPO, not the other way around.
● Mean Time Between Failures (MTBF) and Mean Time To Repair (MTTR) — MTBF and MTTR are reliability metrics describing how often a component fails and how long repairs typically take on average; they are not the planning targets defined in a disaster recovery plan for a specific outage.
● Service Level Agreement (SLA) and Service Level Objective (SLO) — An SLA or SLO defines agreed service performance commitments, often contractual, which is a different concept from the specific recovery targets described here.

Source: NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems

Correct answer: Operational Technology (OT) / Industrial Control Systems (ICS)
Operational Technology (OT) and Industrial Control Systems (ICS), such as SCADA systems used in water treatment and manufacturing, monitor and control physical processes and equipment; they often run legacy software, prioritize availability and safety over frequent patching, and were historically designed assuming physical or network isolation.

Why the other options are incorrect:
● Internet of Things (IoT) devices — IoT devices are typically consumer- or enterprise-connected smart devices such as sensors or cameras; while related to OT in some contexts, the scenario specifically describes industrial process-control equipment, the defining characteristic of OT/ICS.
● Software as a Service (SaaS) applications — SaaS refers to cloud-hosted software applications delivered over the internet, unrelated to physical process-control equipment.
● Bring Your Own Device (BYOD) endpoints — BYOD refers to employee-owned computing devices used for work purposes, unrelated to industrial process-control systems.

Source: CISA, Industrial Control Systems

Correct answer: Tokenization
Tokenization replaces sensitive data, such as a credit card number, with a non-sensitive substitute value, a token, that has no exploitable value on its own, while the real data is stored separately in a secure vault and can only be mapped back to the token by an authorized system.

Why the other options are incorrect:
● Hashing — Hashing produces a one-way, fixed-length representation of data that cannot be reversed to recover the original value, whereas a tokenization system can map a token back to the original value through the secure vault, which is not how hashing is used here.
● Steganography — Steganography hides data within other, unrelated data, such as embedding a message in an image file; it is unrelated to protecting structured payment data like a card number.
● Data compression — Compression reduces data size but is not a data protection or masking technique in itself, and does not securely separate sensitive values from their substitutes.

Source: NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)

Correct answer: Container security
Container security encompasses practices such as scanning container images for known vulnerabilities before deployment, hardening the container runtime, and enforcing isolation between containers and the host operating system to reduce the attack surface of containerized applications.

Why the other options are incorrect:
● Virtual desktop infrastructure — Virtual desktop infrastructure is about centrally hosting end-user desktop environments; it does not address image scanning or container-to-host isolation.
● Full-disk encryption — Full-disk encryption protects data at rest on a storage volume; it does not address vulnerability scanning of container images or runtime isolation.
● Software-defined networking — Software-defined networking abstracts and centrally manages network control functions; while it can play a role in a broader architecture, it does not specifically address image scanning or container-host isolation.

Source: NIST SP 800-190, Application Container Security Guide

Correct answer: Business continuity plan (BCP)
A Business Continuity Plan (BCP) focuses on how an organization’s essential business functions and processes will continue operating during and after a disruption, which may include manual workarounds or alternate facilities, distinct from a narrower IT disaster recovery plan.

Why the other options are incorrect:
● Incident response plan — An incident response plan focuses specifically on detecting, responding to, and recovering from security incidents, which is narrower in scope than sustaining overall business function continuity.
● Acceptable use policy — An acceptable use policy defines rules for how employees may use organizational systems; it does not address maintaining operations during a disruption.
● Data retention schedule — A data retention schedule specifies how long different types of data must be kept before disposal, unrelated to sustaining business operations during a disruption.

Source: NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems

Correct answer: Port security
CompTIA Security+ (SY0-701) objective 3.1 lists a specific set of architecture-model considerations: availability, resilience, cost, responsiveness, scalability, ease of deployment, risk transference, ease of recovery, patch availability, inability to patch, power, and compute. Port security is not part of that list — it’s a secure-infrastructure control covered under objective 3.2 (securing enterprise infrastructure), alongside things like 802.1X and EAP.

Why the other options are incorrect:
● Availability — Availability is explicitly listed as an architecture consideration — how reliably the architecture keeps systems accessible.
● Risk transference — Risk transference (e.g., via cyber insurance) is explicitly listed as an architecture consideration.
● Costs — Cost is explicitly listed as an architecture consideration when choosing between architecture models.

Source: CompTIA Security+ SY0-701 Exam Objectives

Correct answer: Full-disk encryption
Full-disk encryption (FDE) encrypts an entire storage volume, including the boot loader and system files needed to start the operating system, so all data on the drive — not just user files — is protected if the device is lost or stolen.

Why the other options are incorrect:
● Network segmentation — Network segmentation divides a network into isolated zones to limit lateral movement; it has no effect on protecting data stored on a hard drive.
● Patch management — Patch management keeps software up to date to close known vulnerabilities; it does not encrypt or otherwise protect data at rest on a drive.
● Device isolation — Device isolation restricts a device’s network connectivity or access; it does not protect the contents of the drive itself.

Source: NIST SP 800-111, Guide to Storage Encryption Technologies for End User Devices

Correct answer: A firewall is typically at the network border and serves as a preventive control to enforce access rules for ingress and egress traffic.
In a defense-in-depth strategy, a firewall is commonly placed at the network border, where it acts as a preventive control that enforces access rules on both inbound (ingress) and outbound (egress) traffic before it can reach or leave the internal network.

Why the other options are incorrect:
● A firewall is typically on internal routers and serves as a corrective control to mitigate denial of service (DoS) attacks. — A firewall is a preventive control, not a corrective one — corrective controls act after an incident to restore normal operation, whereas a firewall blocks unwanted traffic before it does harm.
● A firewall is typically inline behind the border firewall and serves as a preventive control to enforce access rules. — This describes a secondary, inline firewall placement rather than the typical border placement, and understates the firewall’s primary role of enforcing border access rules.
● A firewall is typically at the network border and serves as a detective control to identify malicious traffic. — A firewall primarily prevents unauthorized traffic by enforcing rules; detecting and identifying malicious traffic after the fact is more characteristic of a detective control like an IDS.

Source: NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy

Correct answer: A combination of volume and file encryption
Volume encryption protects the drive as a whole, while file-level encryption allows individual files to be protected with separate keys or permissions — combining the two provides broad protection plus the granular, varying access control per file or user that this scenario requires.

Why the other options are incorrect:
● Volume encryption only — Volume encryption alone protects the drive as a whole but doesn’t provide the per-file, per-user granularity needed when different users require different access levels.
● Full disk encryption (FDE) only — Full-disk encryption alone protects data when the device is powered off or stolen, but once the system is unlocked it does not restrict which authenticated users can access which specific files.
● Partition encryption only — Partition encryption is similar in scope to volume encryption and, alone, doesn’t provide file-level granularity for varying user access.

Source: NIST SP 800-111, Guide to Storage Encryption Technologies for End User Devices

Correct answer: Multifactor authentication (MFA)
Multifactor authentication requires a user to present evidence from two or more independent authentication factor categories, such as something they know (a password) and something they have (a hardware security key), significantly reducing the risk that a single compromised credential leads to unauthorized access.

Why the other options are incorrect:
● Single-factor authentication — Single-factor authentication uses only one category of evidence, such as a password alone; this scenario combines two distinct factor categories.
● Federation — Federation allows a user’s identity from one trusted domain to be used to access resources in another domain; it does not describe combining authentication factors.
● Role-based access control — Role-based access control governs what an authenticated user is authorized to do based on their assigned role; it is unrelated to how the user proves their identity.

Source: CISA, More than a Password (Multi-Factor Authentication)
Source: NIST SP 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management

Correct answer: Patch management
Patch management is the systematic process of identifying, acquiring, testing, and deploying software updates to remediate known vulnerabilities, exactly as described in this scenario.

Why the other options are incorrect:
● Change management — Change management is the broader process for controlling and documenting any change to an IT environment; patching is one specific type of change managed within that broader process, while this scenario specifically describes remediating a disclosed vulnerability.
● Configuration management — Configuration management focuses on establishing and maintaining known-good, consistent system configurations over time, rather than specifically applying vendor-released security fixes.
● Incident response — Incident response is the process of detecting, responding to, and recovering from a security incident; proactively patching a disclosed vulnerability before it is necessarily exploited is a preventive practice, not incident response.

Source: NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning

Correct answer: SSH encrypts the session, including authentication credentials, while Telnet transmits everything in cleartext
SSH (Secure Shell) encrypts the entire remote management session, including login credentials and commands, whereas Telnet transmits all data, including usernames and passwords, in cleartext, making it trivial for anyone intercepting the traffic to capture credentials.

Why the other options are incorrect:
● SSH uses a faster transport protocol than Telnet — The primary security benefit of SSH over Telnet is encryption, not transport speed; performance is not the relevant security distinction here.
● SSH does not require any authentication, simplifying access — SSH does require authentication, typically a password or key pair; claiming it requires none is factually incorrect and would actually be a security weakness, not a benefit.
● Telnet only works over Wi-Fi networks, which is less secure — Telnet’s insecurity is about cleartext transmission over any network medium, not a limitation to Wi-Fi specifically.

Source: NIST SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security

Correct answer: Hardening
Hardening is the process of reducing a system’s attack surface by disabling unnecessary services, removing default accounts, closing unused ports, and applying secure baseline configurations before, and after, deployment.

Why the other options are incorrect:
● Patch management — Patch management specifically addresses applying vendor updates to remediate known vulnerabilities, not the broader baseline configuration hardening described here.
● Segmentation — Segmentation divides a network into isolated zones to limit the blast radius of a compromise; it does not describe configuring an individual server’s baseline.
● Load balancing — Load balancing distributes traffic across multiple servers for performance and availability; it is unrelated to reducing a single server’s attack surface.

Source: NIST SP 800-70 Rev. 4, National Checklist Program for IT Products

Correct answer: Vulnerability scanning
Vulnerability scanning uses automated tools to systematically identify known vulnerabilities, missing patches, and misconfigurations across systems, producing a report that security teams use to prioritize remediation.

Why the other options are incorrect:
● Penetration testing — Penetration testing involves actively and manually attempting to exploit vulnerabilities to demonstrate real-world impact, going beyond the automated identification described here.
● Threat hunting — Threat hunting is a proactive, hypothesis-driven search for signs of attackers who may have already evaded existing detective controls, not routine automated scanning for known weaknesses.
● Digital forensics — Digital forensics is the process of collecting and analyzing evidence after a security incident has occurred, unrelated to proactively scanning for vulnerabilities.

Source: CISA, CISA Vulnerability Scanning

Correct answer: Security Information and Event Management (SIEM)
A Security Information and Event Management (SIEM) platform centralizes log collection from many sources, correlates events across them, and generates alerts based on defined rules or analytics, which is the core function described in this scenario.

Why the other options are incorrect:
● Intrusion Prevention System (IPS) only — An IPS actively blocks malicious traffic inline at the network level; while it can feed logs into a SIEM, it does not itself aggregate and correlate logs from many different unrelated sources across the enterprise.
● Vulnerability scanner — A vulnerability scanner identifies weaknesses in systems; it does not aggregate and correlate real-time security event logs from across the enterprise.
● Configuration management database (CMDB) — A CMDB tracks configuration items and their relationships for IT asset management; it is not designed for real-time log correlation and alerting.

Source: NIST SP 800-92, Guide to Computer Security Log Management

Correct answer: Security Orchestration, Automation, and Response (SOAR)
SOAR platforms integrate with security tools to automate and orchestrate predefined response playbooks, such as disabling accounts and isolating endpoints, reducing manual analyst workload and response time for common alert types.

Why the other options are incorrect:
● Data Loss Prevention (DLP) — DLP focuses on detecting and preventing unauthorized transmission or exfiltration of sensitive data; it does not orchestrate broader automated incident-response playbooks like account disablement and endpoint isolation.
● Network Access Control (NAC) — NAC controls whether devices are permitted to connect to a network based on posture and identity; it is not the orchestration layer that automates a multi-step response playbook.
● Public Key Infrastructure (PKI) — PKI manages digital certificates and public and private key pairs for encryption and authentication; it is unrelated to automating incident-response actions.

Source: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

Correct answer: Privileged Access Management (PAM)
Privileged Access Management (PAM) solutions are specifically designed to control, monitor, and secure access to highly privileged accounts, often through features like just-in-time credential issuance, session recording, and approval workflows, exactly as described.

Why the other options are incorrect:
● Single sign-on (SSO) — SSO allows a user to authenticate once and access multiple systems without re-entering credentials; it does not specifically add just-in-time elevation, session recording, or approval workflows for privileged accounts.
● Federation — Federation extends authentication trust across separate organizations or domains; it is unrelated to controlling and monitoring privileged account usage.
● Data loss prevention (DLP) — DLP focuses on preventing sensitive data from leaving the organization; it does not manage or monitor privileged account sessions.

Source: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

Correct answer: Preparation
The Preparation phase of the NIST incident response lifecycle involves establishing and training an incident response capability before an incident occurs, including tools, communication plans, and documented procedures, exactly as described.

Why the other options are incorrect:
● Detection and analysis — Detection and analysis involves identifying that a potential incident has occurred and determining its scope and impact, which happens after preparation and during an actual event.
● Containment, eradication, and recovery — Containment, eradication, and recovery involves limiting the damage of an active incident, removing the threat, and restoring systems, which occurs after detection.
● Post-incident activity — Post-incident activity, or lessons learned, occurs after an incident has been resolved, reviewing what happened and updating plans accordingly, not before an incident occurs.

Source: NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide

Correct answer: Containment
Containment is the phase focused on limiting the damage and preventing an active incident from spreading further, such as isolating infected systems and disabling compromised accounts, before eradication and recovery activities begin.

Why the other options are incorrect:
● Preparation — Preparation happens before any incident occurs and involves building the capability to respond, not actively isolating systems during a live incident.
● Detection and analysis — Detection and analysis focuses on identifying and understanding that an incident has occurred and assessing its scope, which typically precedes the containment actions described here.
● Post-incident activity — Post-incident activity happens after the incident is fully resolved, reviewing lessons learned, not during active isolation of infected systems.

Source: NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide

Correct answer: Chain of custody
Chain of custody is the documented, chronological record of who collected, handled, and had access to a piece of evidence, ensuring its integrity and admissibility by proving it has not been tampered with.

Why the other options are incorrect:
● Data carving — Data carving is a technical forensic technique for extracting files or fragments of data from unallocated disk space, unrelated to documenting who handled evidence.
● Order of volatility — Order of volatility refers to the sequence in which types of digital evidence should be collected, from most to least volatile, such as RAM before disk; it does not describe the documentation of custody itself.
● Legal hold — A legal hold is a directive to preserve data that may be relevant to anticipated or ongoing litigation; it is related to evidence preservation but is a distinct concept from documenting the chain of custody.

Source: NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response

Correct answer: Asset management
Asset management is the practice of maintaining an accurate, up-to-date inventory of an organization’s hardware, software, and data assets, which is foundational to nearly every other security operations activity, including vulnerability management, patching, and incident response.

Why the other options are incorrect:
● Change management — Change management governs how modifications are proposed, reviewed, and implemented in the environment; it relies on accurate asset information but is a distinct process from maintaining the inventory itself.
● Threat modeling — Threat modeling systematically identifies potential threats and attack vectors against a system’s design; it uses asset information as an input but is a different analytical activity.
● Business impact analysis — Business impact analysis assesses the operational and financial impact of a disruption to specific business functions; it is a risk-management activity distinct from maintaining a technical asset inventory.

Source: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

Correct answer: Media sanitization
Media sanitization is the process of removing information from storage media, through methods like clearing, purging, or physical destruction, such that data recovery is infeasible, which is required before media is repurposed, released, or disposed of.

Why the other options are incorrect:
● Data classification — Data classification is the process of categorizing data based on its sensitivity, such as public, confidential, or restricted, which informs handling requirements but does not itself describe the destruction or wiping process.
● Legal hold — A legal hold preserves data relevant to anticipated litigation and would actually prevent disposal of that specific data, the opposite of sanitizing and disposing of it.
● Tokenization — Tokenization replaces sensitive values with non-sensitive substitutes for use in live systems; it is unrelated to destroying data on decommissioned physical media.

Source: NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization

Correct answer: Threat hunting
Threat hunting is a proactive, analyst-driven activity that searches for signs of malicious activity that may have evaded existing automated detection tools, using hypotheses and manual investigation rather than waiting for an alert to trigger a response.

Why the other options are incorrect:
● Vulnerability scanning — Vulnerability scanning uses automated tools to identify known weaknesses in systems, not to proactively search logs for signs an attacker is already present.
● Business continuity planning — Business continuity planning prepares an organization to maintain critical operations during a disruption; it is unrelated to actively searching for indicators of compromise.
● Change management — Change management governs the review and approval of modifications to systems; it is unrelated to searching for signs of an active compromise.

Source: NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide

Correct answer: Limiting the scope and magnitude of the incident
The primary objective of the containment phase is to limit the scope and magnitude of an incident — for example, isolating affected systems — before it spreads further, buying time for a proper eradication and recovery plan.

Why the other options are incorrect:
● Continuing the discovery of indicators of the threat actor activity — Continued discovery of indicators of compromise is part of the detection and analysis phase, which the scenario states has already been completed before containment began.
● Removing the source of the threat and restoring the affected systems to a secure state — Removing the threat source and restoring systems describes the eradication and recovery phases, which follow containment rather than define it.
● Analyzing the incident and responses to identify whether procedures or systems could be improved — Reviewing and improving procedures based on the incident describes the lessons-learned (post-incident activity) phase, which happens after the incident is resolved.

Source: NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide

Correct answer: Look up the identifier in the vulnerability database and assess the vulnerability.
A CVE identifier is a standardized reference; the appropriate first step is to look it up in an authoritative vulnerability database, such as the National Vulnerability Database, to understand its description, severity (CVSS score), and affected products before deciding how to remediate it.

Why the other options are incorrect:
● Modify the scanner settings to avoid detecting similar vulnerabilities in the future. — Reconfiguring the scanner to stop detecting similar vulnerabilities would hide real risk rather than address it, and is the opposite of good vulnerability management practice.
● Consult the scanner’s manufacturer for advice on the vulnerability. — The scanner manufacturer is not the authoritative source for a specific CVE’s details; the CVE/NVD record itself and the affected product’s vendor advisories are the appropriate references.
● Ignore the identifier since it might not be significant. — Ignoring a flagged CVE without assessment risks leaving a genuine, potentially severe vulnerability unaddressed.

Source: NIST National Vulnerability Database

Correct answer: Conduct a detailed analysis of the alert using threat intelligence and incident response playbooks
Since the breach is not yet conclusively confirmed, the appropriate next step is a thorough analysis of the alert using threat intelligence and the organization’s incident response playbooks to validate the finding and scope the incident before taking more drastic or public action.

Why the other options are incorrect:
● Focus on other network abnormalities and wait for additional alerts before conducting a detailed analysis — Waiting for more alerts instead of analyzing the current one delays understanding a potentially serious breach involving sensitive patient data.
● Immediately shut down the server to prevent further data leaks — Immediately shutting down the server is a containment action taken once the incident is properly scoped; jumping straight to it, before analysis, can destroy volatile evidence and may be premature.
● Announce the potential data breach to all stakeholders and the public to maintain transparency — Publicly announcing a breach that is not yet confirmed risks reputational harm and regulatory issues from a false or premature disclosure; analysis and confirmation come first.

Source: NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide

Correct answer: Report the loss immediately and initiate approved device-protection and containment measures
A lost device that may hold sensitive organizational data is a security incident. Approved incident-handling procedure calls for reporting the loss right away and promptly applying protective actions, such as remote lock, remote wipe, and revoking the device’s stored credentials, to contain any potential exposure before the device can be accessed by someone else.

Why the other options are incorrect:
● Continue business activities on a personal device until the phone is recovered — Shifting work to an unapproved personal device does not address the exposure risk created by the lost phone and introduces its own unmanaged, unauthorized device risk.
● Attempt to locate the phone before notifying the support team — Delaying the report to search for the device first leaves any data on it unprotected for longer and violates the requirement to report incidents promptly.
● Use an alternative communication method and wait to see whether the device reconnects — Passively waiting takes no containment action, such as a remote lock or wipe, and leaves the device and any data on it exposed in the meantime.

Source: NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide

Correct answer: Continuous monitoring
Continuous monitoring, also called Information Security Continuous Monitoring (ISCM), maintains ongoing awareness of an organization’s security posture through automated data collection, analysis, and reporting, enabling faster detection of deviations from an established baseline than periodic, point-in-time assessments.

Why the other options are incorrect:
● Annual penetration testing — Annual penetration testing is a periodic, point-in-time manual assessment activity, which is explicitly the opposite of the ongoing, automated approach described here.
● Static code analysis — Static code analysis examines source code for security flaws without executing it; it is a specific application-security testing technique, not the broader ongoing security-posture monitoring described.
● Disaster recovery testing — Disaster recovery testing validates an organization’s ability to recover systems after a disruption; it is a periodic exercise, not continuous security posture monitoring.

Source: NIST SP 800-137, Information Security Continuous Monitoring for Federal Information Systems and Organizations

Correct answer: Risk register
A risk register is a centralized document or tool used to record identified risks along with their likelihood, impact, owner, and treatment status, supporting ongoing risk tracking and management.

Why the other options are incorrect:
● Business impact analysis — A business impact analysis assesses the operational and financial consequences of a disruption to specific business functions; it is one input to risk analysis but is not the ongoing tracking document itself.
● Data classification policy — A data classification policy defines categories of data sensitivity and associated handling rules; it is unrelated to tracking identified organizational risks.
● Acceptable use policy — An acceptable use policy defines permitted and prohibited use of organizational systems by users; it does not track risks, likelihood, or treatment status.

Source: NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments

Correct answer: $100,000
Annualized Loss Expectancy (ALE) is calculated as Single Loss Expectancy (SLE) multiplied by the Annualized Rate of Occurrence (ARO): $50,000 times 2 equals $100,000, representing the expected yearly monetary loss from this risk.

Why the other options are incorrect:
● $25,000 — $25,000 would result from incorrectly dividing the SLE by the ARO rather than multiplying, which does not follow the ALE formula.
● $50,000 — $50,000 is only the Single Loss Expectancy, the cost of one occurrence, not the annualized figure accounting for the expected frequency of two occurrences per year.
● $200,000 — $200,000 does not follow the ALE = SLE x ARO formula for the values given in this scenario.

Source: NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments

Correct answer: Third-party (vendor) risk management
Third-party, or vendor and supply chain, risk management involves assessing and managing the security risks introduced by external vendors and partners, commonly through security questionnaires, audit reports, and contractual security requirements, before and during a business relationship.

Why the other options are incorrect:
● Change management — Change management governs internal modifications to an organization’s own systems, not the due diligence process for evaluating an external vendor.
● Job rotation — Job rotation is an internal personnel control that periodically shifts employee responsibilities, unrelated to vendor due diligence.
● Continuous monitoring — Continuous monitoring refers to ongoing internal assessment of an organization’s own security posture; it is a distinct activity from the vendor onboarding due-diligence process described here.

Source: NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

Correct answer: Compliance
Compliance refers to an organization’s adherence to laws, regulations, standards, and contractual obligations that are externally imposed, such as mandatory safeguards for protecting health information under applicable law.

Why the other options are incorrect:
● Risk appetite — Risk appetite describes the level of risk an organization is willing to accept in pursuit of its objectives; it is an internal risk-management concept, not the obligation to meet external legal requirements.
● Due care — Due care refers to the reasonable steps an organization takes to protect its own interests and stakeholders; it is related but broader than the specific obligation to meet mandated regulatory requirements.
● Vulnerability management — Vulnerability management is the technical process of identifying and remediating weaknesses, not the broader obligation to meet external legal or regulatory mandates.

Source: NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Correct answer: Security awareness training
Security awareness training educates employees about security risks and safe practices, such as recognizing phishing attempts and following password hygiene, and is often reinforced with exercises like simulated phishing campaigns to measure and improve behavior over time.

Why the other options are incorrect:
● Penetration testing — Penetration testing is a technical assessment activity that simulates attacks against systems, not a program for educating the general employee population.
● Incident response — Incident response is the process for detecting and responding to security incidents after they occur, not the ongoing employee education program.
● Business continuity planning — Business continuity planning prepares an organization to maintain operations during disruptions; it is unrelated to training employees on everyday security hygiene.

Source: NIST SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program

Correct answer: Policy, standard, and guideline
A policy is a high-level, mandatory statement of management intent, such as protecting customer data; a standard is a detailed, mandatory technical requirement that supports a policy, such as the 12-character password rule; and a guideline is a recommended, non-mandatory best practice, such as the home-office suggestions.

Why the other options are incorrect:
● Standard, guideline, and policy — This mislabels the mandatory, high-level executive statement as a standard instead of a policy, and mislabels the mandatory 12-character password rule as a guideline instead of a standard.
● Procedure, policy, and standard — A procedure is a specific, step-by-step set of instructions for performing a task, which does not match the high-level executive statement described first in this scenario.
● Guideline, policy, and standard — This mislabels the high-level executive statement as a guideline, but guidelines are voluntary and non-mandatory, which contradicts the mandatory nature of that statement.

Source: NIST SP 800-12 Rev. 1, An Introduction to Information Security

Correct answer: Security audit
A security audit is a formal, often independent examination of an organization’s controls against a defined framework or standard, producing documented findings and an opinion on control effectiveness, which can be shared with stakeholders such as customers or regulators.

Why the other options are incorrect:
● Threat modeling — Threat modeling is a design-time analytical activity that identifies potential threats to a system, not a formal, independent evaluation of implemented controls producing an auditable report.
● Vulnerability scanning — Vulnerability scanning uses automated tools to identify technical weaknesses; it is narrower in scope and does not produce a formal control-effectiveness opinion against a recognized framework.
● Tabletop exercise — A tabletop exercise is a discussion-based simulation of a hypothetical incident scenario used to test a response plan, not a formal, independent assessment of control effectiveness.

Source: NIST SP 800-53A Rev. 5, Assessing Security and Privacy Controls in Information Systems and Organizations

Correct answer: Data owner
A data owner is a senior individual formally accountable for a specific data set, responsible for decisions such as its classification, appropriate use, and access requirements, even though technical custodianship, such as day-to-day storage and backups, may be delegated elsewhere.

Why the other options are incorrect:
● Data custodian — A data custodian, or steward, is responsible for the day-to-day technical management of data, such as storage, backups, and implementing controls, based on direction from the data owner, not for the overall accountability described here.
● Data processor — A data processor is typically a third party that processes data on behalf of a data controller or owner, often used in privacy and regulatory contexts, and does not match the internal, accountable business-leader role described.
● System administrator — A system administrator manages the technical infrastructure, such as servers, accounts, and configurations, that hosts data, which is an operational role distinct from the accountable data-owner role described.

Source: NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Correct answer: Privacy notice / privacy considerations
A privacy notice communicates to individuals what personal information an organization collects, why, how it is used and shared, and what rights individuals have over that data, reflecting broader privacy considerations that organizations must address, especially when handling personally identifiable information (PII).

Why the other options are incorrect:
● Disaster recovery plan — A disaster recovery plan addresses restoring IT systems after a disruptive event; it has no relationship to communicating data collection and privacy rights to customers.
● Vulnerability disclosure policy — A vulnerability disclosure policy defines how external researchers should report discovered security vulnerabilities to the organization, unrelated to communicating personal data handling practices to customers.
● Network diagram — A network diagram is a technical illustration of network architecture and connectivity; it does not address privacy communication to data subjects.

Source: NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)

Correct answer: The roles performed by the employees
Effective security awareness training is role-based: employees with access to more sensitive systems or data, or who are more likely to be targeted (such as finance or IT staff), need training tailored to the risks their specific role actually exposes them to.

Why the other options are incorrect:
● The length of service of the employees — Length of service does not determine what phishing risks an employee’s day-to-day responsibilities expose them to; a new hire and a veteran in the same role face similar risks.
● The job titles of the employees — Job titles alone can be misleading; what matters is the actual role, responsibilities, and system access the person has, which titles don’t always capture precisely.
● The personal interests of the employees — Personal interests have no bearing on an employee’s exposure to phishing risk tied to their job function.

Source: NIST SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program