CompTIA Security+ (SY0-701) Exam Questions

A hospital encrypts patient records stored on its database servers so that even if an attacker steals the physical disks, the data cannot be read without the encryption key. Which principle of the CIA triad does this control primarily protect?

⬜ A. Availability
✅ B. Confidentiality
⬜ C. Integrity
⬜ D. Non-repudiation

Explanation:
Encryption protects confidentiality by ensuring only authorized parties who hold the decryption key can read the data, even if the storage media itself is stolen or physically accessed.
Why other options are incorrect:
A: Availability is about ensuring authorized users can access data and systems when needed; encrypting data at rest does not, by itself, keep systems accessible.
C: Integrity is about ensuring data has not been altered; encryption alone protects secrecy, not against unauthorized modification, which is typically addressed with hashing or digital signatures.
D: Non-repudiation is not one of the three CIA triad principles; it refers to proof that an action or communication genuinely came from a specific party.
Source: NIST SP 800-12 Rev. 1, An Introduction to Information Security

---

A company’s security policy requires that every login attempt, file access, and configuration change made by an administrator be recorded in a tamper-evident log for later review. Which element of the AAA (Authentication, Authorization, and Accounting) framework does this describe?

⬜ A. Authentication
⬜ B. Authorization
✅ C. Accounting
⬜ D. Non-repudiation

Explanation:
Accounting (sometimes called auditing) is the AAA element responsible for recording what a user did after being authenticated and authorized, creating a log trail that can be reviewed later for security monitoring or compliance.
Why other options are incorrect:
A: Authentication verifies a user’s identity, such as with a password or token, before granting access; it does not itself record ongoing activity.
B: Authorization determines what an already-authenticated user is permitted to do; it defines permissions, not the logging of actions taken.
D: Non-repudiation is a related security goal, proving an action can be tied to a specific actor, but it is not one of the three AAA elements.
Source: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

---

An organization redesigns its network so that no user or device, whether inside or outside the corporate network perimeter, is automatically trusted, and every access request must be continuously authenticated, authorized, and validated based on all available data points before access is granted. Which security concept does this describe?

⬜ A. Defense in depth
✅ B. Zero Trust
⬜ C. Security through obscurity
⬜ D. Least functionality

Explanation:
Zero Trust is an architectural approach built on the principle of “never trust, always verify,” removing the assumption of implicit trust based on network location and instead requiring continuous verification of every access request.
Why other options are incorrect:
A: Defense in depth refers to layering multiple, different security controls so that if one fails, others still provide protection; it is related but distinct from removing implicit trust based on location.
C: Security through obscurity relies on hiding how a system works as its primary protection, which is discouraged as a standalone strategy and is unrelated to continuous verification.
D: Least functionality is the practice of configuring systems to provide only essential capabilities, which is one hardening technique, not the overall “never trust, always verify” model.
Source: NIST SP 800-207, Zero Trust Architecture

---

During enrollment for a new online banking application, a user is required to enter a password (something they know) and also insert a hardware security key into their laptop’s USB port (something they have) before being granted access. Which security concept is being applied?

⬜ A. Single-factor authentication
✅ B. Multifactor authentication (MFA)
⬜ C. Federation
⬜ D. Role-based access control

Explanation:
Multifactor authentication requires a user to present evidence from two or more independent authentication factor categories, such as something they know (a password) and something they have (a hardware security key), significantly reducing the risk that a single compromised credential leads to unauthorized access.
Why other options are incorrect:
A: Single-factor authentication uses only one category of evidence, such as a password alone; this scenario combines two distinct factor categories.
C: Federation allows a user’s identity from one trusted domain to be used to access resources in another domain; it does not describe combining authentication factors.
D: Role-based access control governs what an authenticated user is authorized to do based on their assigned role; it is unrelated to how the user proves their identity.
Source: CISA, More than a Password (Multi-Factor Authentication)
Source: NIST SP 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management

---

A contract is digitally signed by a vendor using their private key. Later, the vendor denies having agreed to the contract, but the customer is able to cryptographically prove, using the vendor’s corresponding public key, that only the vendor could have created that signature. Which security concept does this scenario demonstrate?

⬜ A. Confidentiality
⬜ B. Availability
✅ C. Non-repudiation
⬜ D. Obfuscation

Explanation:
Non-repudiation provides proof of the origin and integrity of data, preventing a party from credibly denying having sent a message or performed an action; digital signatures created with a private key that only the signer possesses are a primary mechanism for achieving this.
Why other options are incorrect:
A: Confidentiality is about keeping information secret from unauthorized parties, not proving who originated a message.
B: Availability is about ensuring systems and data are accessible when needed, which is unrelated to proving authorship.
D: Obfuscation is the practice of making something, such as code or data, more difficult to understand; it is not a mechanism for proving the origin of an action.
Source: NIST SP 800-57 Part 1 Rev. 5, Recommendation for Key Management

---

A retail store posts visible warning signs stating that all areas are under 24-hour video surveillance, primarily intending to discourage would-be shoplifters from attempting theft in the first place, rather than to catch them in the act. Which category of security control does this represent?

⬜ A. Detective control
✅ B. Deterrent control
⬜ C. Corrective control
⬜ D. Compensating control

Explanation:
A deterrent control is intended to discourage an attacker or bad actor from attempting a violation in the first place, such as warning signage about surveillance; its goal is prevention through psychological discouragement rather than detection or response after the fact.
Why other options are incorrect:
A: A detective control identifies and records that a security event occurred, such as the cameras themselves capturing footage, but the signage’s primary purpose here is discouragement, not detection.
C: A corrective control acts to limit damage and restore normal operations after an incident has already occurred, which does not describe posting a warning sign.
D: A compensating control is an alternative safeguard used when a primary control cannot be implemented; it does not describe discouraging an attack through visible warnings.
Source: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

---

A well-funded and highly organized group, believed to be sponsored by a foreign government, spends over a year quietly infiltrating a defense contractor’s network, carefully avoiding detection while exfiltrating sensitive design documents. Which type of threat actor does this best describe?

⬜ A. Script kiddie
⬜ B. Hacktivist
✅ C. Advanced persistent threat (APT) / nation-state actor
⬜ D. Insider threat

Explanation:
An advanced persistent threat (APT), typically associated with nation-state actors, is characterized by significant funding, sophisticated tools, and a long-term, stealthy campaign aimed at a specific high-value target, exactly matching this scenario.
Why other options are incorrect:
A: A script kiddie has limited skill and typically relies on pre-built tools for opportunistic, unsophisticated attacks, not a year-long, well-funded, stealthy campaign.
B: A hacktivist is motivated by political or social causes and often seeks public attention, such as defacement or leaks, rather than quiet, sustained espionage.
D: An insider threat originates from someone with legitimate authorized access within the organization, whereas this scenario describes an external actor infiltrating the network.
Source: CISA, Nation-State Cyber Actors

---

An employee who has legitimate administrative access to the company’s payroll system uses that access to secretly modify their own salary information for personal gain. Which type of threat actor does this represent?

⬜ A. External attacker
✅ B. Insider threat
⬜ C. Hacktivist
⬜ D. Shadow IT

Explanation:
An insider threat is a threat that originates from someone within the organization who has authorized access to systems and misuses that legitimate access for unauthorized or malicious purposes, exactly as described.
Why other options are incorrect:
A: An external attacker has no legitimate access and must first breach the organization’s defenses; this employee already had authorized administrative access.
C: A hacktivist is externally motivated by political or social causes, not personal financial gain through misuse of one’s own job access.
D: Shadow IT refers to the use of unauthorized systems, applications, or devices by employees, not misuse of already-authorized access to an approved system.
Source: CISA, Insider Threat Mitigation

---

An attacker calls the IT help desk pretending to be a company executive who is “locked out and about to miss an important client call,” pressuring the technician into resetting a password without proper identity verification. Which social engineering technique is being used?

⬜ A. Phishing
✅ B. Pretexting
⬜ C. Tailgating
⬜ D. Typosquatting

Explanation:
Pretexting is a social engineering technique in which an attacker fabricates a believable scenario, such as impersonating an executive under time pressure, to manipulate a victim into bypassing normal procedures.
Why other options are incorrect:
A: Phishing is typically conducted through deceptive electronic messages, such as email or SMS, rather than a live phone impersonation scenario like this one.
C: Tailgating is a physical security technique where an unauthorized person follows an authorized person through a secured door; it does not involve a phone-based impersonation.
D: Typosquatting involves registering domain names that are common misspellings of legitimate sites to trick users; it is unrelated to a live phone pretext.
Source: CISA, Malware, Phishing, and Ransomware

---

A finance clerk receives an email that appears to come from the company’s CEO, instructing her to urgently wire funds to a new vendor account before the end of the day. The sender’s email address is nearly identical to the real CEO’s but slightly altered. Which type of attack is this?

✅ A. Business email compromise (BEC)
⬜ B. Distributed denial-of-service (DDoS)
⬜ C. On-path (man-in-the-middle) attack
⬜ D. Credential stuffing

Explanation:
Business email compromise (BEC) is a form of targeted phishing in which an attacker impersonates a trusted executive or partner, typically through a spoofed or lookalike email address, to trick an employee into making an unauthorized wire transfer or disclosing sensitive information.
Why other options are incorrect:
B: A DDoS attack overwhelms a system or service with traffic to make it unavailable; it has nothing to do with tricking someone into a fraudulent wire transfer.
C: An on-path attack intercepts and potentially alters communications between two parties in transit; this scenario describes a deceptive email, not intercepted communications.
D: Credential stuffing uses previously breached username and password pairs to attempt logins on other services; it does not describe impersonating an executive to request a wire transfer.
Source: CISA, Malware, Phishing, and Ransomware

---

A hospital’s files suddenly become encrypted and inaccessible, and a message demands payment in cryptocurrency to restore access, threatening to permanently delete the data if payment is not made within 72 hours. Which type of malware is responsible for this attack?

⬜ A. Spyware
✅ B. Ransomware
⬜ C. Adware
⬜ D. Logic bomb

Explanation:
Ransomware is malicious software that encrypts a victim’s files or locks them out of their systems, then demands a ransom payment, often in cryptocurrency, in exchange for restoring access, exactly matching the scenario described.
Why other options are incorrect:
A: Spyware secretly monitors and collects user activity or data without the user’s knowledge; it does not encrypt files or demand a ransom.
C: Adware displays unwanted advertisements; it is a nuisance rather than a data-encrypting, extortion-based attack.
D: A logic bomb is malicious code that lies dormant until triggered by a specific condition or date, and while it can cause damage, the ransom-demand behavior described here is specifically characteristic of ransomware.
Source: CISA, Malware, Phishing, and Ransomware

---

Security analysts discover malicious code on a compromised server that has modified the operating system’s kernel-level functions to hide its own files, processes, and network connections from standard system tools and antivirus scans. Which type of malware is this?

✅ A. Rootkit
⬜ B. Worm
⬜ C. Keylogger
⬜ D. Trojan

Explanation:
A rootkit is malware specifically designed to gain and maintain privileged, often kernel-level, access to a system while actively concealing its presence, hiding files, processes, and network activity from the operating system and security tools, matching this scenario precisely.
Why other options are incorrect:
B: A worm is malware that self-replicates and spreads across networks without needing to attach to a host file or program; concealment of kernel-level artifacts is not its defining trait.
C: A keylogger records keystrokes to capture credentials or sensitive input; it does not necessarily manipulate kernel functions to hide system-wide artifacts.
D: A trojan disguises itself as legitimate software to trick a user into installing it; the defining behavior here, kernel-level concealment, is specifically characteristic of a rootkit rather than the trojan’s delivery method.
Source: NIST SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops

---

A piece of malware spreads automatically from one vulnerable machine to another across a corporate network without any user having to open a file or click a link, exploiting an unpatched network service. Which type of malware best fits this description?

⬜ A. Virus
✅ B. Worm
⬜ C. Trojan
⬜ D. Fileless malware

Explanation:
A worm is a standalone piece of malware that self-replicates and spreads autonomously across networks by exploiting vulnerabilities, without requiring any user interaction or a host file, unlike a virus.
Why other options are incorrect:
A: A virus requires attaching itself to a host file or program and typically needs some user action, like opening an infected file, to execute and spread, unlike the autonomous spreading described here.
C: A trojan relies on disguising itself as legitimate software to trick a user into installing it; it does not self-propagate across a network like a worm.
D: Fileless malware operates in memory and abuses legitimate system tools to avoid writing files to disk, which is a distinct evasion technique, not specifically defined by autonomous network-based self-propagation.
Source: NIST SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops

---

A web application allows users to enter a username directly into a login form field, and that input is concatenated into a database query without any validation or parameterization. An attacker enters a specially crafted string into the field that manipulates the underlying database query to bypass authentication entirely. Which vulnerability is being exploited?

⬜ A. Cross-site scripting (XSS)
✅ B. SQL injection
⬜ C. Buffer overflow
⬜ D. Cross-site request forgery (CSRF)

Explanation:
SQL injection occurs when unvalidated user input is inserted directly into a database query, allowing an attacker to alter the query’s logic, such as bypassing authentication or extracting data, exactly as described in this scenario.
Why other options are incorrect:
A: Cross-site scripting involves injecting malicious script into web pages viewed by other users’ browsers, not manipulating a backend database query.
C: A buffer overflow occurs when a program writes more data to a memory buffer than it can hold, corrupting adjacent memory; it is unrelated to manipulating a SQL query’s logic.
D: CSRF tricks an authenticated user’s browser into submitting unwanted requests to a site where they are already logged in; it does not involve injecting code into a database query field.
Source: NIST SP 800-115, Technical Guide to Information Security Testing and Assessment

---

Security researchers discover attackers actively exploiting a previously unknown flaw in a widely used piece of software, for which the vendor has not yet released a patch. Which term describes this type of vulnerability?

✅ A. Zero-day vulnerability
⬜ B. Legacy vulnerability
⬜ C. Misconfiguration
⬜ D. Race condition

Explanation:
A zero-day vulnerability is a flaw that is unknown to the vendor, or for which no patch yet exists, at the time it is discovered or actively exploited, giving defenders “zero days” of advance notice to prepare a fix.
Why other options are incorrect:
B: A legacy vulnerability typically refers to a known weakness in outdated or unsupported systems that no longer receive vendor updates, not a brand-new, previously unknown flaw.
C: A misconfiguration vulnerability results from improperly configured settings, such as default credentials or open permissions, not from an inherent, unpatched software flaw.
D: A race condition is a specific type of software flaw where the outcome depends on the timing of events; it is a possible root cause category but does not itself mean the flaw is unknown to the vendor.
Source: CISA, Known Exploited Vulnerabilities (KEV) Catalog

---

A programmer writes code that copies user-supplied input into a fixed-size memory buffer without checking the input’s length first. An attacker submits input longer than the buffer can hold, overwriting adjacent memory and potentially executing arbitrary code. Which vulnerability class does this describe?

✅ A. Buffer overflow
⬜ B. Cross-site scripting
⬜ C. Directory traversal
⬜ D. Insecure deserialization

Explanation:
A buffer overflow occurs when a program writes more data into a fixed-size memory buffer than it was allocated to hold, corrupting adjacent memory and potentially allowing an attacker to execute arbitrary code or crash the application.
Why other options are incorrect:
B: Cross-site scripting injects malicious script that executes in a victim’s browser through a web application; it is unrelated to overwriting memory buffers.
C: Directory traversal manipulates file path input to access files outside an intended directory; it does not involve overwriting a memory buffer.
D: Insecure deserialization occurs when untrusted serialized data is processed unsafely, potentially leading to code execution, but the specific mechanism described here, a fixed-size buffer overwritten by oversized input, defines a buffer overflow.
Source: NIST SP 800-115, Technical Guide to Information Security Testing and Assessment

---

After a critical vulnerability is publicly disclosed in a widely used web server software, an organization’s security team prioritizes testing and deploying the vendor’s released fix across all affected servers within days, following a documented process for evaluating, testing, and applying updates. Which security practice does this describe?

✅ A. Patch management
⬜ B. Change management
⬜ C. Configuration management
⬜ D. Incident response

Explanation:
Patch management is the systematic process of identifying, acquiring, testing, and deploying software updates to remediate known vulnerabilities, exactly as described in this scenario.
Why other options are incorrect:
B: Change management is the broader process for controlling and documenting any change to an IT environment; patching is one specific type of change managed within that broader process, while this scenario specifically describes remediating a disclosed vulnerability.
C: Configuration management focuses on establishing and maintaining known-good, consistent system configurations over time, rather than specifically applying vendor-released security fixes.
D: Incident response is the process of detecting, responding to, and recovering from a security incident; proactively patching a disclosed vulnerability before it is necessarily exploited is a preventive practice, not incident response.
Source: NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning

---

A company places its public-facing web server in a separate network segment that is isolated from both the internet and the internal corporate network, with firewall rules strictly controlling traffic in and out of that segment. Which architecture concept is being applied?

✅ A. Demilitarized zone (DMZ)
⬜ B. Virtual private network (VPN)
⬜ C. Network address translation (NAT)
⬜ D. Air gap

Explanation:
A demilitarized zone (DMZ) is a perimeter network segment that hosts public-facing services, isolated by firewalls from both the untrusted internet and the trusted internal network, limiting the exposure of the internal network if the public-facing server is compromised.
Why other options are incorrect:
B: A VPN creates an encrypted tunnel for remote connectivity between networks or users; it does not describe segmenting a public-facing server into its own isolated zone.
C: NAT translates private IP addresses to public ones, or vice versa, for routing purposes; it is a translation mechanism, not a network segmentation or isolation architecture.
D: An air gap physically isolates a system from all other networks, including the internet, which would prevent a public-facing web server from being reachable at all.
Source: NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy

---

An organization implements an architecture in which every application, workload, and user is placed into small, tightly controlled network zones, and traffic between any two zones, even ones on the same physical network segment, must be explicitly authenticated and authorized rather than trusted based on which subnet it originates from. Which term best describes this approach?

⬜ A. Flat network design
✅ B. Microsegmentation
⬜ C. Network address translation
⬜ D. Full-mesh VPN

Explanation:
Microsegmentation divides a network into very small, isolated zones, down to the individual workload or application level, and enforces strict authentication and authorization for traffic between them, a key architectural technique for implementing Zero Trust principles.
Why other options are incorrect:
A: A flat network design places all devices on a single broadcast domain with minimal segmentation, which is the opposite of the fine-grained isolation described here.
C: Network address translation is an addressing and translation technique, not a segmentation or access-control architecture.
D: A full-mesh VPN interconnects multiple sites with encrypted tunnels; it does not describe fine-grained, workload-level internal segmentation.
Source: NIST SP 800-207, Zero Trust Architecture
Source: CISA, Zero Trust Maturity Model

---

A company migrates its application to a public cloud provider’s Infrastructure as a Service (IaaS) offering. Under the shared responsibility model, which of the following is the CUSTOMER responsible for securing?

⬜ A. The physical security of the cloud provider’s datacenters
✅ B. The guest operating system, applications, and data running on the virtual machines
⬜ C. The physical network cabling between the provider’s datacenters
⬜ D. The virtualization hypervisor itself

Explanation:
Under the shared responsibility model for IaaS, the cloud provider secures the underlying physical infrastructure, hypervisor, and physical network, while the customer remains responsible for securing the guest operating system, any applications they install, and their own data.
Why other options are incorrect:
A: Physical datacenter security is retained by the cloud provider in every service model, including IaaS, PaaS, and SaaS, not shifted to the customer.
C: Physical network cabling between the provider’s own datacenters is part of the provider’s infrastructure, which the customer never manages.
D: The hypervisor that enables virtualization is managed and secured by the cloud provider, not the customer, under IaaS.
Source: NIST SP 800-145, The NIST Definition of Cloud Computing

---

A DevOps team defines its servers, networks, and security groups in version-controlled configuration files, which are used to automatically and consistently provision identical environments every time, rather than manually configuring each server by hand. Which concept does this describe?

✅ A. Infrastructure as Code (IaC)
⬜ B. Shadow IT
⬜ C. Virtual desktop infrastructure (VDI)
⬜ D. Bare-metal provisioning

Explanation:
Infrastructure as Code (IaC) is the practice of managing and provisioning infrastructure through machine-readable, version-controlled definition files, enabling consistent, repeatable, and auditable deployments instead of manual, error-prone configuration.
Why other options are incorrect:
B: Shadow IT refers to systems or software used without organizational approval or oversight, unrelated to codified infrastructure provisioning.
C: Virtual desktop infrastructure hosts virtualized end-user desktops centrally; it does not describe defining infrastructure in version-controlled code.
D: Bare-metal provisioning refers to deploying an operating system directly onto physical hardware without a hypervisor; it does not by itself describe the code-driven, version-controlled approach in this scenario.
Source: NIST SP 800-128, Guide for Security-Focused Configuration Management of Information Systems

---

A company’s disaster recovery plan states that after a major outage, the order-processing system must be restored within 4 hours, and the maximum acceptable data loss is 15 minutes’ worth of transactions. Which two metrics are being defined here, respectively?

✅ A. Recovery Time Objective (RTO) and Recovery Point Objective (RPO)
⬜ B. Recovery Point Objective (RPO) and Recovery Time Objective (RTO)
⬜ C. Mean Time Between Failures (MTBF) and Mean Time To Repair (MTTR)
⬜ D. Service Level Agreement (SLA) and Service Level Objective (SLO)

Explanation:
The Recovery Time Objective (RTO) defines the maximum acceptable time to restore a system after a disruption, 4 hours in this scenario, while the Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, 15 minutes here.
Why other options are incorrect:
B: This reverses the order; the 4-hour restoration target is RTO, and the 15-minute data-loss tolerance is RPO, not the other way around.
C: MTBF and MTTR are reliability metrics describing how often a component fails and how long repairs typically take on average; they are not the planning targets defined in a disaster recovery plan for a specific outage.
D: An SLA or SLO defines agreed service performance commitments, often contractual, which is a different concept from the specific recovery targets described here.
Source: NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems

---

A network administrator disables Telnet access to all network switches and routers and requires administrators to use SSH instead for remote command-line management. What is the primary security benefit of this change?

✅ A. SSH encrypts the session, including authentication credentials, while Telnet transmits everything in cleartext
⬜ B. SSH uses a faster transport protocol than Telnet
⬜ C. SSH does not require any authentication, simplifying access
⬜ D. Telnet only works over Wi-Fi networks, which is less secure

Explanation:
SSH (Secure Shell) encrypts the entire remote management session, including login credentials and commands, whereas Telnet transmits all data, including usernames and passwords, in cleartext, making it trivial for anyone intercepting the traffic to capture credentials.
Why other options are incorrect:
B: The primary security benefit of SSH over Telnet is encryption, not transport speed; performance is not the relevant security distinction here.
C: SSH does require authentication, typically a password or key pair; claiming it requires none is factually incorrect and would actually be a security weakness, not a benefit.
D: Telnet’s insecurity is about cleartext transmission over any network medium, not a limitation to Wi-Fi specifically.
Source: NIST SP 800-46 Rev. 2, Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security

---

A water treatment facility uses specialized equipment to monitor and control physical processes such as valves and pumps. These systems were originally designed for isolated, air-gapped environments and often cannot be patched without risking process downtime or safety issues, unlike typical enterprise IT systems. Which category of systems does this describe?

⬜ A. Internet of Things (IoT) devices
✅ B. Operational Technology (OT) / Industrial Control Systems (ICS)
⬜ C. Software as a Service (SaaS) applications
⬜ D. Bring Your Own Device (BYOD) endpoints

Explanation:
Operational Technology (OT) and Industrial Control Systems (ICS), such as SCADA systems used in water treatment and manufacturing, monitor and control physical processes and equipment; they often run legacy software, prioritize availability and safety over frequent patching, and were historically designed assuming physical or network isolation.
Why other options are incorrect:
A: IoT devices are typically consumer- or enterprise-connected smart devices such as sensors or cameras; while related to OT in some contexts, the scenario specifically describes industrial process-control equipment, the defining characteristic of OT/ICS.
C: SaaS refers to cloud-hosted software applications delivered over the internet, unrelated to physical process-control equipment.
D: BYOD refers to employee-owned computing devices used for work purposes, unrelated to industrial process-control systems.
Source: CISA, Industrial Control Systems

---

A retail company wants its customer service representatives to view masked credit card numbers, such as “XXXX XXXX XXXX 1234”, in the support system, without those representatives ever having access to the actual, usable card numbers, which are stored separately in a highly secured vault and referenced only by a substitute value. Which data protection technique is being used?

⬜ A. Hashing
✅ B. Tokenization
⬜ C. Steganography
⬜ D. Data compression

Explanation:
Tokenization replaces sensitive data, such as a credit card number, with a non-sensitive substitute value, a token, that has no exploitable value on its own, while the real data is stored separately in a secure vault and can only be mapped back to the token by an authorized system.
Why other options are incorrect:
A: Hashing produces a one-way, fixed-length representation of data that cannot be reversed to recover the original value, whereas a tokenization system can map a token back to the original value through the secure vault, which is not how hashing is used here.
C: Steganography hides data within other, unrelated data, such as embedding a message in an image file; it is unrelated to protecting structured payment data like a card number.
D: Compression reduces data size but is not a data protection or masking technique in itself, and does not securely separate sensitive values from their substitutes.
Source: NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)

---

An organization wants to scan its container images for known vulnerabilities and misconfigurations before they are deployed to production, and also wants to ensure the container runtime environment is isolated from the underlying host operating system as much as possible. Which security architecture concept is most relevant to this requirement?

✅ A. Container security
⬜ B. Virtual desktop infrastructure
⬜ C. Full-disk encryption
⬜ D. Software-defined networking

Explanation:
Container security encompasses practices such as scanning container images for known vulnerabilities before deployment, hardening the container runtime, and enforcing isolation between containers and the host operating system to reduce the attack surface of containerized applications.
Why other options are incorrect:
B: Virtual desktop infrastructure is about centrally hosting end-user desktop environments; it does not address image scanning or container-to-host isolation.
C: Full-disk encryption protects data at rest on a storage volume; it does not address vulnerability scanning of container images or runtime isolation.
D: Software-defined networking abstracts and centrally manages network control functions; while it can play a role in a broader architecture, it does not specifically address image scanning or container-host isolation.
Source: NIST SP 800-190, Application Container Security Guide

---

A systems administrator builds a new server image that has all unnecessary services, default accounts, and unused ports disabled or removed before the server is ever deployed into production. Which security practice does this represent?

✅ A. Hardening
⬜ B. Patch management
⬜ C. Segmentation
⬜ D. Load balancing

Explanation:
Hardening is the process of reducing a system’s attack surface by disabling unnecessary services, removing default accounts, closing unused ports, and applying secure baseline configurations before, and after, deployment.
Why other options are incorrect:
B: Patch management specifically addresses applying vendor updates to remediate known vulnerabilities, not the broader baseline configuration hardening described here.
C: Segmentation divides a network into isolated zones to limit the blast radius of a compromise; it does not describe configuring an individual server’s baseline.
D: Load balancing distributes traffic across multiple servers for performance and availability; it is unrelated to reducing a single server’s attack surface.
Source: NIST SP 800-70 Rev. 4, National Checklist Program for IT Products

---

A security team runs automated tools on a regular schedule to identify missing patches, outdated software versions, and insecure configurations across all servers on the network, generating a prioritized list of weaknesses to remediate. Which activity is being performed?

⬜ A. Penetration testing
✅ B. Vulnerability scanning
⬜ C. Threat hunting
⬜ D. Digital forensics

Explanation:
Vulnerability scanning uses automated tools to systematically identify known vulnerabilities, missing patches, and misconfigurations across systems, producing a report that security teams use to prioritize remediation.
Why other options are incorrect:
A: Penetration testing involves actively and manually attempting to exploit vulnerabilities to demonstrate real-world impact, going beyond the automated identification described here.
C: Threat hunting is a proactive, hypothesis-driven search for signs of attackers who may have already evaded existing detective controls, not routine automated scanning for known weaknesses.
D: Digital forensics is the process of collecting and analyzing evidence after a security incident has occurred, unrelated to proactively scanning for vulnerabilities.
Source: CISA, CISA Vulnerability Scanning

---

A security operations center (SOC) uses a platform that aggregates log data from firewalls, servers, and endpoint agents across the enterprise, correlates events from multiple sources in near real time, and generates alerts when suspicious patterns are detected. Which type of tool is this?

✅ A. Security Information and Event Management (SIEM)
⬜ B. Intrusion Prevention System (IPS) only
⬜ C. Vulnerability scanner
⬜ D. Configuration management database (CMDB)

Explanation:
A Security Information and Event Management (SIEM) platform centralizes log collection from many sources, correlates events across them, and generates alerts based on defined rules or analytics, which is the core function described in this scenario.
Why other options are incorrect:
B: An IPS actively blocks malicious traffic inline at the network level; while it can feed logs into a SIEM, it does not itself aggregate and correlate logs from many different unrelated sources across the enterprise.
C: A vulnerability scanner identifies weaknesses in systems; it does not aggregate and correlate real-time security event logs from across the enterprise.
D: A CMDB tracks configuration items and their relationships for IT asset management; it is not designed for real-time log correlation and alerting.
Source: NIST SP 800-92, Guide to Computer Security Log Management

---

After a SIEM generates an alert for a suspicious login, a connected platform automatically executes a predefined playbook: it disables the affected user account, isolates the affected endpoint from the network, and opens a ticket for analyst review, all without a human manually performing each step. Which type of technology enables this automated response?

✅ A. Security Orchestration, Automation, and Response (SOAR)
⬜ B. Data Loss Prevention (DLP)
⬜ C. Network Access Control (NAC)
⬜ D. Public Key Infrastructure (PKI)

Explanation:
SOAR platforms integrate with security tools to automate and orchestrate predefined response playbooks, such as disabling accounts and isolating endpoints, reducing manual analyst workload and response time for common alert types.
Why other options are incorrect:
B: DLP focuses on detecting and preventing unauthorized transmission or exfiltration of sensitive data; it does not orchestrate broader automated incident-response playbooks like account disablement and endpoint isolation.
C: NAC controls whether devices are permitted to connect to a network based on posture and identity; it is not the orchestration layer that automates a multi-step response playbook.
D: PKI manages digital certificates and public and private key pairs for encryption and authentication; it is unrelated to automating incident-response actions.
Source: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

---

An organization ensures that a database administrator’s account only has the specific permissions needed to manage databases, and nothing more, with no access to unrelated systems like HR records or network device configuration. Which security principle is being applied?

⬜ A. Separation of duties
✅ B. Least privilege
⬜ C. Job rotation
⬜ D. Mandatory vacation

Explanation:
The principle of least privilege states that a user, account, or process should be granted only the minimum access rights necessary to perform its required function, and no more, exactly as described for the database administrator’s scoped access.
Why other options are incorrect:
A: Separation of duties divides critical tasks among multiple people so that no single individual can complete a sensitive process alone; it is a related but distinct control from limiting the scope of one person’s permissions.
C: Job rotation periodically moves employees between roles or responsibilities, often to detect fraud or reduce dependency on one person; it does not describe scoping an account’s permissions.
D: Mandatory vacation requires employees to take time off, during which their duties are covered by someone else, helping surface fraudulent activity; it does not describe permission scoping.
Source: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

---

An organization requires that any use of a highly privileged domain administrator account go through a dedicated system that issues short-lived, just-in-time credentials, records a full session recording of everything the administrator does, and requires a second approver before access is granted. Which category of solution is being described?

✅ A. Privileged Access Management (PAM)
⬜ B. Single sign-on (SSO)
⬜ C. Federation
⬜ D. Data loss prevention (DLP)

Explanation:
Privileged Access Management (PAM) solutions are specifically designed to control, monitor, and secure access to highly privileged accounts, often through features like just-in-time credential issuance, session recording, and approval workflows, exactly as described.
Why other options are incorrect:
B: SSO allows a user to authenticate once and access multiple systems without re-entering credentials; it does not specifically add just-in-time elevation, session recording, or approval workflows for privileged accounts.
C: Federation extends authentication trust across separate organizations or domains; it is unrelated to controlling and monitoring privileged account usage.
D: DLP focuses on preventing sensitive data from leaving the organization; it does not manage or monitor privileged account sessions.
Source: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

---

Before any security incident occurs, an organization develops and documents an incident response plan, trains its incident response team, deploys detection tools, and establishes communication procedures and contact lists to be ready to respond effectively. According to the NIST incident response lifecycle, which phase does this activity belong to?

✅ A. Preparation
⬜ B. Detection and analysis
⬜ C. Containment, eradication, and recovery
⬜ D. Post-incident activity

Explanation:
The Preparation phase of the NIST incident response lifecycle involves establishing and training an incident response capability before an incident occurs, including tools, communication plans, and documented procedures, exactly as described.
Why other options are incorrect:
B: Detection and analysis involves identifying that a potential incident has occurred and determining its scope and impact, which happens after preparation and during an actual event.
C: Containment, eradication, and recovery involves limiting the damage of an active incident, removing the threat, and restoring systems, which occurs after detection.
D: Post-incident activity, or lessons learned, occurs after an incident has been resolved, reviewing what happened and updating plans accordingly, not before an incident occurs.
Source: NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide

---

During an active ransomware outbreak, the incident response team immediately disconnects the infected servers from the network and disables the compromised user accounts to stop the malware from spreading further, before beginning the process of removing the malware entirely. Which phase of incident response does this represent?

⬜ A. Preparation
⬜ B. Detection and analysis
✅ C. Containment
⬜ D. Post-incident activity

Explanation:
Containment is the phase focused on limiting the damage and preventing an active incident from spreading further, such as isolating infected systems and disabling compromised accounts, before eradication and recovery activities begin.
Why other options are incorrect:
A: Preparation happens before any incident occurs and involves building the capability to respond, not actively isolating systems during a live incident.
B: Detection and analysis focuses on identifying and understanding that an incident has occurred and assessing its scope, which typically precedes the containment actions described here.
D: Post-incident activity happens after the incident is fully resolved, reviewing lessons learned, not during active isolation of infected systems.
Source: NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide

---

During a forensic investigation into a data breach, an analyst carefully documents every person who handled a piece of digital evidence, such as a hard drive, when it was collected, and how it was stored and transferred, to ensure the evidence remains admissible and its integrity can be verified later. Which forensic concept does this describe?

✅ A. Chain of custody
⬜ B. Data carving
⬜ C. Order of volatility
⬜ D. Legal hold

Explanation:
Chain of custody is the documented, chronological record of who collected, handled, and had access to a piece of evidence, ensuring its integrity and admissibility by proving it has not been tampered with.
Why other options are incorrect:
B: Data carving is a technical forensic technique for extracting files or fragments of data from unallocated disk space, unrelated to documenting who handled evidence.
C: Order of volatility refers to the sequence in which types of digital evidence should be collected, from most to least volatile, such as RAM before disk; it does not describe the documentation of custody itself.
D: A legal hold is a directive to preserve data that may be relevant to anticipated or ongoing litigation; it is related to evidence preservation but is a distinct concept from documenting the chain of custody.
Source: NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response

---

An organization maintains a continuously updated inventory of every server, laptop, and network device it owns, including its owner, location, software installed, and criticality to the business, so that security teams know exactly what needs to be protected and patched. Which foundational security operations practice does this represent?

✅ A. Asset management
⬜ B. Change management
⬜ C. Threat modeling
⬜ D. Business impact analysis

Explanation:
Asset management is the practice of maintaining an accurate, up-to-date inventory of an organization’s hardware, software, and data assets, which is foundational to nearly every other security operations activity, including vulnerability management, patching, and incident response.
Why other options are incorrect:
B: Change management governs how modifications are proposed, reviewed, and implemented in the environment; it relies on accurate asset information but is a distinct process from maintaining the inventory itself.
C: Threat modeling systematically identifies potential threats and attack vectors against a system’s design; it uses asset information as an input but is a different analytical activity.
D: Business impact analysis assesses the operational and financial impact of a disruption to specific business functions; it is a risk-management activity distinct from maintaining a technical asset inventory.
Source: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations

---

Before any modification, such as a firewall rule change or a server patch, is applied to a production system, it must be documented, reviewed by a change advisory board, tested, and scheduled for a defined maintenance window, with a documented rollback plan in case something goes wrong. Which practice does this describe?

✅ A. Change management
⬜ B. Vulnerability management
⬜ C. Onboarding
⬜ D. Data retention

Explanation:
Change management is the formal process for proposing, reviewing, approving, testing, and documenting changes to production systems, including rollback planning, to minimize the risk of unintended disruption or security exposure.
Why other options are incorrect:
B: Vulnerability management focuses on identifying, prioritizing, and remediating known weaknesses, which may trigger a change but is a distinct process from the formal review-and-approval workflow for making changes.
C: Onboarding is the process of provisioning access and resources for new employees or systems, unrelated to reviewing modifications to existing production systems.
D: Data retention governs how long data must be kept and when it should be disposed of, unrelated to the process of reviewing and approving system changes.
Source: NIST SP 800-128, Guide for Security-Focused Configuration Management of Information Systems

---

A security team implements automated tools and processes to continuously collect security-related metrics, assess the security posture of systems against a defined baseline, and report deviations to stakeholders on an ongoing basis, rather than relying only on periodic annual assessments. Which security operations practice does this describe?

✅ A. Continuous monitoring
⬜ B. Annual penetration testing
⬜ C. Static code analysis
⬜ D. Disaster recovery testing

Explanation:
Continuous monitoring, also called Information Security Continuous Monitoring (ISCM), maintains ongoing awareness of an organization’s security posture through automated data collection, analysis, and reporting, enabling faster detection of deviations from an established baseline than periodic, point-in-time assessments.
Why other options are incorrect:
B: Annual penetration testing is a periodic, point-in-time manual assessment activity, which is explicitly the opposite of the ongoing, automated approach described here.
C: Static code analysis examines source code for security flaws without executing it; it is a specific application-security testing technique, not the broader ongoing security-posture monitoring described.
D: Disaster recovery testing validates an organization’s ability to recover systems after a disruption; it is a periodic exercise, not continuous security posture monitoring.
Source: NIST SP 800-137, Information Security Continuous Monitoring for Federal Information Systems and Organizations

---

Before decommissioned hard drives are removed from a secure facility for disposal, an organization uses a specialized process to overwrite or physically destroy the drives so that no residual data can be recovered by whoever receives the old hardware. Which practice does this describe?

✅ A. Media sanitization
⬜ B. Data classification
⬜ C. Legal hold
⬜ D. Tokenization

Explanation:
Media sanitization is the process of removing information from storage media, through methods like clearing, purging, or physical destruction, such that data recovery is infeasible, which is required before media is repurposed, released, or disposed of.
Why other options are incorrect:
B: Data classification is the process of categorizing data based on its sensitivity, such as public, confidential, or restricted, which informs handling requirements but does not itself describe the destruction or wiping process.
C: A legal hold preserves data relevant to anticipated litigation and would actually prevent disposal of that specific data, the opposite of sanitizing and disposing of it.
D: Tokenization replaces sensitive values with non-sensitive substitutes for use in live systems; it is unrelated to destroying data on decommissioned physical media.
Source: NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization

---

After noticing unusual outbound traffic patterns, a security analyst proactively searches through endpoint and network logs for subtle indicators of compromise that automated detection tools may have missed, forming and testing hypotheses about how an attacker might have gained a foothold. Which activity does this describe?

✅ A. Threat hunting
⬜ B. Vulnerability scanning
⬜ C. Business continuity planning
⬜ D. Change management

Explanation:
Threat hunting is a proactive, analyst-driven activity that searches for signs of malicious activity that may have evaded existing automated detection tools, using hypotheses and manual investigation rather than waiting for an alert to trigger a response.
Why other options are incorrect:
B: Vulnerability scanning uses automated tools to identify known weaknesses in systems, not to proactively search logs for signs an attacker is already present.
C: Business continuity planning prepares an organization to maintain critical operations during a disruption; it is unrelated to actively searching for indicators of compromise.
D: Change management governs the review and approval of modifications to systems; it is unrelated to searching for signs of an active compromise.
Source: NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide

---

A risk management team documents each identified risk to the organization, along with its likelihood, potential impact, assigned owner, and current treatment status, in a centralized tracking document that is reviewed and updated regularly. Which risk management tool is being described?

✅ A. Risk register
⬜ B. Business impact analysis
⬜ C. Data classification policy
⬜ D. Acceptable use policy

Explanation:
A risk register is a centralized document or tool used to record identified risks along with their likelihood, impact, owner, and treatment status, supporting ongoing risk tracking and management.
Why other options are incorrect:
B: A business impact analysis assesses the operational and financial consequences of a disruption to specific business functions; it is one input to risk analysis but is not the ongoing tracking document itself.
C: A data classification policy defines categories of data sensitivity and associated handling rules; it is unrelated to tracking identified organizational risks.
D: An acceptable use policy defines permitted and prohibited use of organizational systems by users; it does not track risks, likelihood, or treatment status.
Source: NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments

---

A risk analysis determines that a particular server has a single loss expectancy (SLE) of $50,000 for a specific threat, and that threat is expected to occur twice per year on average (an annualized rate of occurrence, or ARO, of 2). What is the Annualized Loss Expectancy (ALE) for this risk?

⬜ A. $25,000
⬜ B. $50,000
✅ C. $100,000
⬜ D. $200,000

Explanation:
Annualized Loss Expectancy (ALE) is calculated as Single Loss Expectancy (SLE) multiplied by the Annualized Rate of Occurrence (ARO): $50,000 times 2 equals $100,000, representing the expected yearly monetary loss from this risk.
Why other options are incorrect:
A: $25,000 would result from incorrectly dividing the SLE by the ARO rather than multiplying, which does not follow the ALE formula.
B: $50,000 is only the Single Loss Expectancy, the cost of one occurrence, not the annualized figure accounting for the expected frequency of two occurrences per year.
D: $200,000 does not follow the ALE = SLE x ARO formula for the values given in this scenario.
Source: NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments

---

Before signing a contract with a new cloud service provider that will process sensitive customer data, an organization requires the vendor to complete a detailed security questionnaire, provide a recent independent audit report, and agree to specific contractual security obligations. Which practice does this represent?

✅ A. Third-party (vendor) risk management
⬜ B. Change management
⬜ C. Job rotation
⬜ D. Continuous monitoring

Explanation:
Third-party, or vendor and supply chain, risk management involves assessing and managing the security risks introduced by external vendors and partners, commonly through security questionnaires, audit reports, and contractual security requirements, before and during a business relationship.
Why other options are incorrect:
B: Change management governs internal modifications to an organization’s own systems, not the due diligence process for evaluating an external vendor.
C: Job rotation is an internal personnel control that periodically shifts employee responsibilities, unrelated to vendor due diligence.
D: Continuous monitoring refers to ongoing internal assessment of an organization’s own security posture; it is a distinct activity from the vendor onboarding due-diligence process described here.
Source: NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations

---

A healthcare organization ensures that any system storing or transmitting patient health information implements specific administrative, physical, and technical safeguards required by federal law, and undergoes regular audits to demonstrate adherence to these mandatory requirements. Which term describes the organization’s obligation to meet these externally imposed legal requirements?

✅ A. Compliance
⬜ B. Risk appetite
⬜ C. Due care
⬜ D. Vulnerability management

Explanation:
Compliance refers to an organization’s adherence to laws, regulations, standards, and contractual obligations that are externally imposed, such as mandatory safeguards for protecting health information under applicable law.
Why other options are incorrect:
B: Risk appetite describes the level of risk an organization is willing to accept in pursuit of its objectives; it is an internal risk-management concept, not the obligation to meet external legal requirements.
C: Due care refers to the reasonable steps an organization takes to protect its own interests and stakeholders; it is related but broader than the specific obligation to meet mandated regulatory requirements.
D: Vulnerability management is the technical process of identifying and remediating weaknesses, not the broader obligation to meet external legal or regulatory mandates.
Source: NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

---

An organization requires every employee to complete annual training that teaches them how to recognize phishing emails, use strong passwords, and report suspicious activity, reinforced with periodic simulated phishing tests throughout the year. Which security program element does this represent?

✅ A. Security awareness training
⬜ B. Penetration testing
⬜ C. Incident response
⬜ D. Business continuity planning

Explanation:
Security awareness training educates employees about security risks and safe practices, such as recognizing phishing attempts and following password hygiene, and is often reinforced with exercises like simulated phishing campaigns to measure and improve behavior over time.
Why other options are incorrect:
B: Penetration testing is a technical assessment activity that simulates attacks against systems, not a program for educating the general employee population.
C: Incident response is the process for detecting and responding to security incidents after they occur, not the ongoing employee education program.
D: Business continuity planning prepares an organization to maintain operations during disruptions; it is unrelated to training employees on everyday security hygiene.
Source: NIST SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program

---

An organization documents the specific steps its critical business functions, not just its IT systems, will take to continue operating, potentially through manual workarounds or an alternate site, during and immediately after a disruptive event, until normal operations can be restored. Which type of plan does this describe?

✅ A. Business continuity plan (BCP)
⬜ B. Incident response plan
⬜ C. Acceptable use policy
⬜ D. Data retention schedule

Explanation:
A Business Continuity Plan (BCP) focuses on how an organization’s essential business functions and processes will continue operating during and after a disruption, which may include manual workarounds or alternate facilities, distinct from a narrower IT disaster recovery plan.
Why other options are incorrect:
B: An incident response plan focuses specifically on detecting, responding to, and recovering from security incidents, which is narrower in scope than sustaining overall business function continuity.
C: An acceptable use policy defines rules for how employees may use organizational systems; it does not address maintaining operations during a disruption.
D: A data retention schedule specifies how long different types of data must be kept before disposal, unrelated to sustaining business operations during a disruption.
Source: NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems

---

A company’s information security governance documents include a high-level, mandatory statement approved by executive leadership about protecting customer data, and a detailed, mandatory technical document specifying that all passwords must be at least 12 characters, and a voluntary, recommended document suggesting best practices for securing a home office. Which three types of governance documents does this describe, respectively?

✅ A. Policy, standard, and guideline
⬜ B. Standard, guideline, and policy
⬜ C. Procedure, policy, and standard
⬜ D. Guideline, policy, and standard

Explanation:
A policy is a high-level, mandatory statement of management intent, such as protecting customer data; a standard is a detailed, mandatory technical requirement that supports a policy, such as the 12-character password rule; and a guideline is a recommended, non-mandatory best practice, such as the home-office suggestions.
Why other options are incorrect:
B: This mislabels the mandatory, high-level executive statement as a standard instead of a policy, and mislabels the mandatory 12-character password rule as a guideline instead of a standard.
C: A procedure is a specific, step-by-step set of instructions for performing a task, which does not match the high-level executive statement described first in this scenario.
D: This mislabels the high-level executive statement as a guideline, but guidelines are voluntary and non-mandatory, which contradicts the mandatory nature of that statement.
Source: NIST SP 800-12 Rev. 1, An Introduction to Information Security

---

An organization hires an independent third party to formally evaluate whether its security controls are designed and operating effectively against a recognized framework, producing a formal report with findings and an opinion that can be shared with customers and regulators. Which activity does this describe?

✅ A. Security audit
⬜ B. Threat modeling
⬜ C. Vulnerability scanning
⬜ D. Tabletop exercise

Explanation:
A security audit is a formal, often independent examination of an organization’s controls against a defined framework or standard, producing documented findings and an opinion on control effectiveness, which can be shared with stakeholders such as customers or regulators.
Why other options are incorrect:
B: Threat modeling is a design-time analytical activity that identifies potential threats to a system, not a formal, independent evaluation of implemented controls producing an auditable report.
C: Vulnerability scanning uses automated tools to identify technical weaknesses; it is narrower in scope and does not produce a formal control-effectiveness opinion against a recognized framework.
D: A tabletop exercise is a discussion-based simulation of a hypothetical incident scenario used to test a response plan, not a formal, independent assessment of control effectiveness.
Source: NIST SP 800-53A Rev. 5, Assessing Security and Privacy Controls in Information Systems and Organizations

---

An organization designates a specific senior business leader as being formally accountable for the accuracy, classification, and appropriate use of a particular dataset, such as customer records, even though a separate technical team handles day-to-day storage and backups of that data. Which role does this leader hold?

✅ A. Data owner
⬜ B. Data custodian
⬜ C. Data processor
⬜ D. System administrator

Explanation:
A data owner is a senior individual formally accountable for a specific data set, responsible for decisions such as its classification, appropriate use, and access requirements, even though technical custodianship, such as day-to-day storage and backups, may be delegated elsewhere.
Why other options are incorrect:
B: A data custodian, or steward, is responsible for the day-to-day technical management of data, such as storage, backups, and implementing controls, based on direction from the data owner, not for the overall accountability described here.
C: A data processor is typically a third party that processes data on behalf of a data controller or owner, often used in privacy and regulatory contexts, and does not match the internal, accountable business-leader role described.
D: A system administrator manages the technical infrastructure, such as servers, accounts, and configurations, that hosts data, which is an operational role distinct from the accountable data-owner role described.
Source: NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

---

A company that collects personal information from its customers publishes a document explaining what personal data it collects, why it is collected, how it is used and shared, and how individuals can exercise rights such as requesting deletion of their data. Which concept is this document primarily addressing?

✅ A. Privacy notice / privacy considerations
⬜ B. Disaster recovery plan
⬜ C. Vulnerability disclosure policy
⬜ D. Network diagram

Explanation:
A privacy notice communicates to individuals what personal information an organization collects, why, how it is used and shared, and what rights individuals have over that data, reflecting broader privacy considerations that organizations must address, especially when handling personally identifiable information (PII).
Why other options are incorrect:
B: A disaster recovery plan addresses restoring IT systems after a disruptive event; it has no relationship to communicating data collection and privacy rights to customers.
C: A vulnerability disclosure policy defines how external researchers should report discovered security vulnerabilities to the organization, unrelated to communicating personal data handling practices to customers.
D: A network diagram is a technical illustration of network architecture and connectivity; it does not address privacy communication to data subjects.
Source: NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)