Fall 2025 Midterm Exam Configure a Screened Subnet

10/15/25, 11:31 PM Individual Response Fall 2025 Midterm Exam Date: 10/2/2025, 6:46:33 PM Time Spent: 01:35:00 Score: 80% Passing Score: 60% 1/115 10/15/25, 11:31 PM Individual Response Question 1 Correct A hospital has implemented a security device that processes sensitive patient information. The hospital wants to ensure that in the event of a failure, the confidentiality and integrity of the patient data take priority over the system's availability. What should the hospital set as the failure mode configuration for this security device? The security device should be configured to passively monitor the network. The security device should be configured to actively monitor the network. The security device should be configured to fail-open. The security device should be configured to fail-closed. Correct Explanation A fail-closed configuration prioritizes confidentiality and integrity over availability. In the event of a failure, a fail-closed device would block access or enter the most secure state available, protecting patient data. A fail-open configuration would prioritize availability over confidentiality and integrity. In the event of a failure, a fail-open device would preserve network or host access, potentially exposing sensitive patient data. While active monitoring is an important part of network security, it does not directly pertain to the failure mode of the device and would not ensure the confidentiality and integrity of patient data. As with active monitoring, passive monitoring is important for network security, but it does not directly pertain to the failure mode of the device. Related Content 5.1.1 Enterprise Network Architecture 5.1.2 Enterprise Network Architecture Facts 5.2.3 Security Solution Facts resources\questions\q_ent_architecture_fail-closed_01_secp8.question.xml 2/115 10/15/25, 11:31 PM Individual Response Question 2 Correct You are a network security engineer for a large corporation. The company is planning to launch a new software product and wants to provide customer access to this product over the internet. The company also wants to ensure that the internal production network remains secure. Which type of common security zone would be the MOST appropriate to implement in this scenario? Intranet Extranet Screened Subnet Correct Wireless Explanation Screened subnet is the correct answer. A screened subnet is used as a public-facing accessible network. It acts as a buffer and a barrier to the internal production network, which is accessible from the internet. It can be configured using either one or two firewalls and acts as the middleman between the internet and the internal network. This makes it the most appropriate choice for this scenario. Intranet is incorrect because an intranet is a private network that is used for internal purposes only. It would not be appropriate for providing customer access to a product over the internet. Extranet is incorrect because an extranet is used to grant resource access to business partners, suppliers, and even customers outside of the organization. However, it is not specifically designed to act as a buffer between the internet and the internal network, which is a requirement in this scenario. Wireless is incorrect because a wireless zone is a broadcasted network connection used within an organization. It would not be appropriate for providing customer access to a product over the internet while also protecting the internal network. Related Content 5.2.5 Security Zone Facts 5.3.3 Configure a Screened Subnet 3/115 10/15/25, 11:31 PM Individual Response 5.3.4 Screened Subnet Facts 5.4.2 Firewall Facts resources\questions\q_sec_zone_screened_subnet_secp8.question.xml 4/115 10/15/25, 11:31 PM Individual Response Question 3 Correct Which of the following BEST describes the concept of a virtual LAN? Devices connected through the internet that can communicate without using a network address. Devices on the same network logically grouped as if they were on separate networks. Correct Devices on different networks that can receive multicast packets. Devices connected by a transmission medium other than a cable (microwave, radio transmissions). Devices in separate networks (different network addresses) logically grouped as if they were in the same network. Explanation A virtual LAN is created by identifying a subset of devices on the same network logically grouped as if they were on separate networks. Think of VLANs as subdivisions of a LAN. Devices connected by a transmission medium other than a cable normally rely on a Wi-Fi connection, not a VLAN. The devices on a VLAN need to be on the same network--not separate networks. The devices on a VLAN need to be assigned a network address in order to communicate with each other. Once again, devices on a VLAN need to be on the same network, whether they can receive multicast packets or not. Related Content 5.9.1 Switch Features 5.9.2 Securing Network Switches 5.9.3 Switch Security Facts 5.9.6 Hardening a Switch 5.10.3 Router Security Facts https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 5/115 10/15/25, 11:31 PM Individual Response resources\questions\q_sec_swi_vlan_02_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 6/115 10/15/25, 11:31 PM Individual Response Question 4 Correct As a senior network architect at your company, you have been tasked with evaluating the current network architecture and proposing changes to improve security and efficiency. The company has been experiencing frequent network outages due to an outdated infrastructure, which has led to significant financial losses. The board of directors is concerned about the costs associated with a complete network overhaul and is considering other options. Which of the following is the MOST appropriate course of action? Transfer the risk by outsourcing the network management to a third-party service provider. Correct Do nothing and continue with the current network architecture. Invest in minor upgrades to the current network infrastructure. Implement a complete network overhaul immediately, regardless of the costs. Explanation Transferring the risk by outsourcing the network management to a third-party service provider is the correct answer. This approach allows the company to leverage the expertise of a third-party provider, potentially improving network stability and security. It also transfers the risk associated with network management to the third-party provider, aligning with the concept of risk transference. Implementing a complete network overhaul immediately, regardless of the costs, may not be the best solution. While it could potentially solve the current issues, it may also introduce new ones and could be financially burdensome for the company. This approach does not consider the risk transference option. Doing nothing and continuing with the current network architecture is not a viable option. The frequent network outages are causing significant financial losses and damaging the company's reputation. This approach ignores the problem and does not consider risk transference. Investing in minor upgrades to the current network infrastructure may not be sufficient to address the frequent network outages. While this approach may improve the situation in the short term, it does not provide a long-term solution and does not consider risk transference. https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 7/115 10/15/25, 11:31 PM Individual Response Related Content resources\questions\q_ent_architecture_risk_transference_secp8.question.xml Question 5 Correct What differentiates a logic bomb from other types of malware? Logic bombs are always associated with ransomware. Logic bombs can only infect networked systems. Logic bombs are always visible to the user. Logic bombs can only be triggered by a specific event or condition. Correct Explanation Logic bombs are unique in that they are programmed to execute (or "explode") when a specific condition or event occurs, such as a certain date and time, a specific user logging in, or a particular application being launched. Logic bombs, like many other types of malware, often operate in the background without the user's knowledge until they are triggered. While it's possible for a logic bomb to be part of a ransomware attack, they are not inherently associated with ransomware. Logic bombs can be used in various types of malicious software. Logic bombs can infect any system, not just networked ones. They can be placed in any piece of software and triggered by a wide range of events or conditions. Related Content 2.3.2 Malware Facts resources\questions\q_mal_logic_bomb_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 8/115 10/15/25, 11:31 PM Individual Response Question 6 Correct A systems administrator for a large organization dealing with massive amounts of data must ensure the security of data stored on disks and during transfers over the network. Recently, the organization has encountered challenges with encrypting and decrypting large volumes of data. Which encryption method would be inefficient for encrypting a large amount of data on a disk or transporting it over a network? Symmetric encryption Asymmetric encryption Correct Hybrid encryption Obfuscation techniques Explanation While asymmetric encryption offers advantages in certain areas, it becomes inefficient when dealing with large volumes of data on disks or during network transport due to its computational overhead. Asymmetric encryption requires more processing power and time when compared to symmetric encryption, which is more efficient for bulk data encryption. Hybrid encryption combines the benefits of both asymmetric and symmetric encryption but does not alleviate the inefficiencies of asymmetric encryption for large data encryption. Obfuscation techniques are not encryption methods and would not address the performance challenges associated with encrypting large amounts of data. Obfuscation involves making a message or data difficult to find, such as hiding messages in files. Related Content 3.1.2 Cryptography Facts 3.1.4 Symmetric and Asymmetric Encryption Facts 3.2.1 Combining Cryptographic Methods 3.2.4 Cryptographic Implementation Facts 8.7.1 Secure Protocols https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 9/115 10/15/25, 11:31 PM Individual Response 8.7.2 Secure Protocol Facts 8.7.5 IPsec resources\questions\q_asys_sys_encrypt_asym_03_secp8.question.xml Question 7 Partial Given that hash functions are n-to-1 functions, which of the following are considered hash functions? The variable x represents the input data, and k represents a constant. x AND k Incorrect x % k (% is modulo operation) Correct x XOR k (XOR is for exclusive or operation) x >>> k (>>> is for rotatory right shifting) x >> k (>> is for right shifting) x / k (/ is integer division) Correct Correct https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 10/115 10/15/25, 11:31 PM Individual Response Question 8 Correct Which of the following is the MOST likely to happen if the firewall managing traffic into the screened subnet fails? Nothing will happen - all devices will stay protected. The LAN is compromised, but the screened subnet stays protected. All devices in the screened subnet and LAN will be compromised. Only the servers in the screened subnet are compromised, but the LAN will stay protected. Correct Explanation If the firewall managing traffic into the screened subnet fails, only the servers in the screened subnet are subject to compromise. The LAN is protected by default. None of the other options are correct in this scenario. Related Content 5.2.5 Security Zone Facts 5.3.3 Configure a Screened Subnet 5.3.4 Screened Subnet Facts 5.4.2 Firewall Facts resources\questions\q_dmz_screened_subnet_02_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 11/115 10/15/25, 11:31 PM Individual Response Question 9 Correct You are the head of the IT department at a large corporation. Recently, there have been several security breaches, and you suspect that these breaches are due to issues with your Identity and Access Management (IAM) processes. You decide to conduct a thorough review of your IAM processes. Which of the following steps should you prioritize and why? Examining the accounting process to track authorized usage of a resource or use of rights by a subject and alert when unauthorized use is detected or attempted. Checking the authentication process to verify that each subject is who or what it claims to be when attempting to access a resource. Assessing the authorization process to determine what rights subjects should have on each resource and Correct whether those rights are being enforced. Reviewing the identification process to ensure that each user, device, or process on the network is uniquely represented. Explanation https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 12/115 10/15/25, 11:31 PM Individual Response Assessing the authorization process should be the priority. This process determines what rights subjects should have on each resource and whether those rights are being enforced. If this process is flawed, subjects may gain access to resources they should not have access to, leading to security breaches. Reviewing the identification process is important, but not the first step to take when dealing with security breaches. Identification only ensures that each user, device, or process on the network is uniquely represented, but does not prevent unauthorized access if the authentication and authorization processes are flawed. Checking the authentication process is crucial, verifying that each subject is who or what it claims to be when attempting to access a resource. However, even if the authentication process is robust, breaches can still occur if the authorization process is flawed and allows subjects to access resources they should not have access to. Examining the accounting process is important for detecting and alerting when unauthorized use is detected or attempted. However, this process is reactive rather than proactive, helping identify when a breach has occurred, but not preventing breaches from happening in the first place. Therefore, while important, examining the accounting process should not be the first step in addressing security breaches. Related Content 4.1.1 Fundamental Security Concepts 4.1.2 Access Control Facts 5.6.2 Network Access Control Facts resources\questions\q_acc_ctrl_iam_process_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 13/115 10/15/25, 11:31 PM Individual Response Question 10 Correct Which of the following applies the appropriate policies in order to provide a device with the access it's defined to receive? Identity Services Engine Authorization Correct Zero-trust security Authentication Explanation Authorization looks at the authentication information and applies the appropriate policies in order to provide a device with the access it's defined to receive. Authentication defines all the prerequisites a device must meet in order to access a network. These criteria are detailed for such things as anti-malware, OS, patch level, and so on. Zero-trust security means nothing is trusted unless it can pass both the authentication and authorization stages. Identity Services Engine (ISE) is Cisco's NAC solution. Related Content 5.6.2 Network Access Control Facts 10.7.1 BYOD Security Issues 10.7.2 BYOD Security Facts resources\questions\q_nac_authorization_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 14/115 10/15/25, 11:31 PM Individual Response Question 11 Incorrect A network engineer has the task of creating a remote access solution for a global enterprise. The solution should secure encrypted communication for the company's employees worldwide and detect potential security threats in real time. Which configuration should the network engineer deploy to meet these requirements? A network equipped with a Next Generation Firewall (NGFW), a Web Application Firewall (WAF), and an intrusion prevention system (IPS) in tap/monitor mode A Software-Defined Wide Area Network (SD-WAN) with secure access service edge (SASE) implementation, supplemented by an intrusion prevention system (IPS) A VPN utilizing IKE and IPSec protocols, combined with an inline intrusion detection system (IDS) Incorrect Correct A network fortified by 802.1X port security, an Extensible Authentication Protocol (EAP), and a load balancer Explanation A VPN using internet key exchange and IPSec protocols secures remote access and communication. An inline IDS detects potential security threats in real time. 802.1X port security and EAP provide robust network security but don't address secure remote access. A load balancer manages traffic but doesn't contribute to threat detection. An NGFW and WAF protect the network and web applications but don't provide secure remote access. An IPS in tap/monitor mode detects intrusions but isn't as effective as an inline system. SD-WAN with SASE provides secure, scalable cloud-based network architecture but focuses more on optimization than secure remote access. An IPS prevents intrusions but doesn't directly address threat detection or secure remote access. Related Content 4.8.1 Remote Access 4.8.2 Remote Access Facts 5.5.6 Configure Remote Access, non VPN https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 15/115 10/15/25, 11:31 PM Individual Response 5.5.7 Virtual Private Network Facts 5.5.8 VPN Protocol Facts 8.2.2 File System Security Facts 8.6.3 Wireless Authentication and Access Methods 8.7.1 Secure Protocols 8.7.2 Secure Protocol Facts 8.7.3 Add TLS to a Website 8.7.4 Allow SSL Connections 8.7.5 IPsec 8.7.6 IPsec Facts 8.7.7 Requiring IPsec for Communications 10.9.1 Email Security 10.9.4 Securing an Email Server 10.9.6 Securing Accounts on an iPad 10.9.7 Secure Email on iPad resources\questions\q_vpn_prot_ike_ipsec_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 16/115 10/15/25, 11:31 PM Individual Response Question 12 Correct As a network administrator, you have implemented a Network Access Control (NAC) system with automatic remediation capabilities in your organization. One day, you notice that a significant number of devices are being quarantined frequently by the NAC system due to non-compliance with security policies. What should be your next course of action? Reduce the security standards set by the NAC system to decrease the number of quarantined devices. Investigate the root cause of the frequent noncompliance and address it. Correct Disable the automatic remediation feature to reduce the number of quarantined devices. Ignore the issue as the NAC system is doing its job by quarantining noncompliant devices. Explanation Investigating the root cause of the frequent non-compliance is the best course of action. It could be due to outdated software on the devices, overly strict security policies, or other factors. Once the root cause is identified, it can be addressed, which should reduce the number of quarantined devices and improve the overall security of the network. Ignoring the issue is not a good practice. Frequent quarantining of devices indicates a potential problem with the devices' security compliance or with the NAC system's policies. It's important to investigate and address the issue to ensure the security and functionality of the network. Disabling the automatic remediation feature may reduce the number of quarantined devices, but it also reduces the effectiveness of the NAC system. The automatic remediation feature is designed to help bring non-compliant devices into compliance, not to be disabled when it's inconvenient. Reducing the security standards set by the NAC system may decrease the number of quarantined devices, but it also weakens the security of the network. The standards are there to protect the network and should not be reduced without a good reason. Related Content https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 17/115 10/15/25, 11:31 PM Individual Response 5.6.2 Network Access Control Facts 10.7.1 BYOD Security Issues 10.7.2 BYOD Security Facts resources\questions\q_nac_automatic_remediation_secp8.question.xml Question 13 Incorrect What is the name of the service included with the Windows Server operating system that manages a centralized database containing user account and security information? Active Directory Domain Services Active Directory Explanation Active Directory (AD) is a centralized database that is included with the Windows Server operating system. Active Directory is used to store information about a network. It stores such things as user accounts, computers, printers, and security policies. Related Content resources\questions\q_actdir_ad_01_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 18/115 10/15/25, 11:31 PM Individual Response Question 14 Correct In the context of network monitoring, which of the following is crucial for enforcing and maintaining the security measures put in place during the hardening process? Endpoint hardening Correct IP scanning Top talkers Packet routing Explanation Endpoint hardening is the correct answer. It refers to the process of securing individual devices on a network (endpoints) against threats. Network monitoring plays a vital role in endpoint hardening as it helps to enforce and maintain the security measures put in place during the hardening process. It can detect changes that weaken the hardened configuration and alert analysts of the change, which may indicate a breach. Top talkers refers to the computers that send the most data, either from your network or into your network. While monitoring these can help identify potential network issues, it is not directly related to the enforcement and maintenance of security measures. Packet routing refers to the path a packet takes to reach its destination. While this is an important aspect of network monitoring, it does not directly relate to the enforcement and maintenance of security measures. IP scanning is a process that allows a network administrator to scan the entire network to find all connected devices and their IP addresses. While this is a useful tool in network monitoring, it does not directly enforce or maintain security measures. Related Content resources\questions\q_netmon_endpoint_hardening_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 19/115 10/15/25, 11:31 PM Individual Response Question 15 Correct A leading online retail company wants to improve user experience and security for its customers. The security team aims to eliminate the need for users to remember or input complex passwords, reducing the risk of password breaches. Instead, they propose a solution where users can access their accounts seamlessly through a secure link sent to their verified email or via a push notification on a trusted device. This approach should not involve traditional passwords, fingerprint scans, or multiple validation steps. Which authentication method is the security team planning to implement for users? Passwordless authentication Correct Biometric authentication Multi-factor authentication Attestation Explanation Passwordless authentication eliminates traditional passwords and relies on other factors like biometrics, security keys, or mobile push notifications for user verification. Attestation involves verifying the integrity and authenticity of a device's hardware or software. While it can enhance overall security, it is not a passwordless authentication method. Multi-factor authentication (MFA) involves using multiple authentication factors, which can include something users know (like a password) along with something they have or are (like a fingerprint). While it can enhance security, it still involves using passwords in some cases. Biometric authentication uses physical characteristics like fingerprints or facial recognition to verify a user's identity. Related Content 4.2.2 Authentication Factors Facts 4.5.10 Hardening Authentication Facts resources\questions\q_authent_passwordless_02_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 20/115 10/15/25, 11:31 PM Individual Response Question 16 Correct You have a group named Research on your system that needs a new password because a member of the group has left the company. Which of the following commands should you use? gpasswd research groupmod -p Research newpasswd Research gpasswd Research Correct Explanation Use gpasswd Research to be prompted to enter a new password for the Research group. Group names are case-sensitive, so gpasswd research won't change the password for the Research group. The groupmod command does not have a switch that can be used to change passwords. The newpasswd option is not a valid Linux command. Related Content 4.1.5 Access Control Model Facts 4.5.7 Restrict Local Accounts 4.5.8 Secure Default Accounts 4.5.10 Hardening Authentication Facts 4.6.1 Linux User and Group Overview 4.6.2 Managing Linux Users 4.6.3 Linux User Commands and Files 4.6.4 Create a User Account 4.6.6 Delete a User 4.6.9 Lock and Unlock User Accounts https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 21/115 10/15/25, 11:31 PM Individual Response 4.7.2 Linux Group Commands 4.7.3 Rename and Create Groups 4.7.4 Add Users to a Group 4.7.5 Remove a User from a Group 5.7.2 Device Vulnerability Facts 8.1.3 Hardening an Operating System 8.2.2 File System Security Facts 8.9.4 Version Control Management resources\questions\q_linux_grps_cmds_pass_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 22/115 10/15/25, 11:31 PM Individual Response Question 17 Incorrect A large multinational corporation has recently experienced a significant data breach. The breach was detected by an external cybersecurity firm, and the corporation's IT department was unable to prevent or detect the breach in its early stages. The CEO wants to ensure that such a breach does not happen again and is considering several options to enhance the company's security posture. Which of the following options would be the MOST effective in preventing and detecting future data breaches? Conducting regular cybersecurity training for all employees. Hiring an external cybersecurity firm to conduct regular penetration testing. Incorrect Increasing the budget for the IT department to purchase more advanced security software. Implementing a dedicated Computer Incident Response Team (CIRT). Correct Explanation https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 23/115 10/15/25, 11:31 PM Individual Response Implementing a dedicated Computer Incident Response Team (CIRT) is the most effective option. A CIRT is a group of experts who respond to security incidents. They have the skills and authority to respond quickly and effectively to security incidents, minimizing the impact and preventing further damage. This team would also be responsible for monitoring the company's network for signs of a breach, allowing them to detect and respond to incidents more quickly in the future. Hiring an external cybersecurity firm to conduct regular penetration testing is a good practice, but it is not sufficient on its own. Penetration testing can identify vulnerabilities, but it does not provide continuous monitoring or incident response capabilities. Increasing the budget for the IT department to purchase more advanced security software can be helpful, but software alone cannot fully protect a company from data breaches. Effective security requires a combination of technology, processes, and people. Conducting regular cybersecurity training for all employees is important, but it is not enough to prevent and detect data breaches. Employees can help prevent breaches by following good security practices, but they cannot be expected to have the specialized skills needed to detect and respond to sophisticated attacks. Related Content 1.1.3 Security Introduction Facts 1.2.2 Control Categories and Types Facts resources\questions\q_sec_intro_cirt_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 24/115 10/15/25, 11:31 PM Individual Response Question 18 Correct In a rapidly evolving IT environment, a cloud service provider offers various services to businesses, enabling them to store and process data securely. To enhance security, the provider regularly updates its systems and software. Despite these efforts, a security researcher discovers a previously unknown vulnerability in one of the cloud-specific applications, leaving customer data exposed to potential threats. In this scenario, which vulnerability is the security researcher likely to have found in the cloudspecific application? Cross-site scripting (XSS) vulnerability Network misconfiguration Zero-day vulnerability Correct SQL injection vulnerability Explanation A zero-day vulnerability refers to a security flaw previously unknown to the vendor or developer. The discovery of this previously unknown vulnerability aligns with the characteristics of a zero-day vulnerability. In the scenario provided, the focus is on a vulnerability identified within a cloud-specific application that is distinct from a misconfiguration in the network settings and often involves errors in firewall rules, access controls, or other network-related configurations. SQL injection is a prevalent type of cyberattack where malicious actors exploit vulnerabilities in web applications to insert malicious SQL queries into the application's database. Malicious script injection, also known as cross-site scripting (XSS), is when attackers inject malicious scripts into web pages to compromise users' sessions or steal sensitive information. Related Content 5.7.2 Device Vulnerability Facts 8.8.4 Zero Day Application Attacks resources\questions\q_dev_vuln_zero-day_01_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 25/115 10/15/25, 11:31 PM Individual Response Question 19 Correct A cybersecurity analyst working for a financial institution handles sensitive customer data and must ensure its integrity and confidentiality. Part of the analyst's responsibilities is to evaluate the hashing algorithms used to protect the data's integrity. Which statement accurately describes the purpose and functionality of hashing algorithms in data security? Hashing algorithms compress data to reduce storage requirements and improve performance. Hashing algorithms use a public and private key pair to transmit data over the network securely. Hashing algorithms encrypt data to make it unreadable to unauthorized users. Hashing algorithms generate a fixed-size output (a hash value), which represents the input data and is unique to each input. Correct Explanation Hashing algorithms generate a fixed-size output called a hash value, which represents the input data and is unique to each input. Additionally, they generate unique, fixed-size output (hash value) for any given input. The hash value is a digital fingerprint of the input data and is unique to each input, ensuring data integrity and allowing for efficient data comparison. Hashing algorithms do not relate to encryption but rather to data integrity verification. Hashing algorithms do not involve the use of public and private key pairs. Hashing algorithms do not relate to data compression; instead, they create a unique representation of the input data. Related Content 3.1.1 Cryptography Concepts 3.1.2 Cryptography Facts 3.2.4 Cryptographic Implementation Facts 3.3.1 Hashing https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 26/115 10/15/25, 11:31 PM Individual Response 3.3.3 Hashing Facts 3.3.4 Using Hashes 3.3.5 Compare an MD5 Hash 6.6.2 Password Attack Facts resources\questions\q_cryp_hash_hash_04_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 27/115 10/15/25, 11:31 PM Individual Response Question 20 Correct The chief security officer (CSO) at a financial organization wants to implement additional detective security controls. Which of the following would BEST represent this type of control? Implementation of biometric authentication systems. Installation of surveillance camera. Correct Enforcement of access control mechanisms. Performing regular system backups. Explanation Surveillance cameras are physical controls that act as detective mechanisms, helping to identify unauthorized access or activities within the monitored area. While it is an important security measure, enforcing access control mechanisms primarily serves as a preventive control. For example, it prevents unauthorized physical access but does not detect issues or breaches actively. Although a biometric authentication system is an important control, it primarily serves as a preventive control. Biometric authentication prevents unauthorized access by ensuring verified individuals can access certain areas or data, but it does not actively detect breaches or security incidents. Regular system backups are generally a corrective control that does not detect issues. Instead, they provide a means to recover after a security incident. Related Content 1.2.2 Control Categories and Types Facts resources\questions\q_ctrl_cattypes_detective_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 28/115 10/15/25, 11:31 PM Individual Response Question 21 Correct A major software vendor becomes aware of a new zero-day vulnerability in one of its products due to an anonymous tip. The vulnerability could potentially allow unauthorized access to sensitive data stored in the software. The vendor is currently creating a patch to address the issue. Which of the following BEST describes the current risk to the software users and the appropriate response from the software vendor? Since the vendor knows about the vulnerability, there is minimal risk. The vendor should alert all users about the vulnerability immediately and provide mitigation steps. There is no risk to users as long as the vendor does not disclose the vulnerability. The vendor should continue its usual operations without interruption. The risk to users is unknown, and the vendor should contact individual users to assess potential damage before proceeding. The risk to the users is significant, and the vendor should quietly create a patch without informing the users until it is ready. Correct Explanation Zero-day vulnerabilities represent significant risk, and the vendor should prioritize creating a patch. Disclosing the vulnerability to the public before a patch is ready could increase the risk. Alerting users about the vulnerability could also alert potential threat actors, increasing the risk before a patch is ready. Even if the vendor does not disclose the vulnerability, there is a risk while the vulnerability exists, especially since someone is aware of it, as indicated by the anonymous tip. The risk is significant due to the nature of the vulnerability, and contacting individual users is not feasible, nor will it reduce the risk. The vendor should focus on creating a patch. Related Content 5.7.2 Device Vulnerability Facts 8.8.4 Zero Day Application Attacks https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 29/115 10/15/25, 11:31 PM Individual Response resources\questions\q_dev_vuln_zero-day_03_secp8.question.xml Question 22 Correct In a Kerberos authentication system, how does the Ticket Granting Service (TGS) contribute to the single sign-on (SSO) process? The TGS encrypts all data transferred between the client and the application server. The TGS generates the initial Ticket Granting Ticket (TGT) for the client. The TGS issues service tickets to clients for accessing specific services. Correct The TGS validates the client's password and username. Explanation The TGS issues service tickets to clients after they have been authenticated. These service tickets allow clients to access specific services without having to re-authenticate. The initial Ticket Granting Ticket (TGT) is generated by the authentication service (AS), not the TGS. The validation of the client's password and username is also done by the authentication service (AS), not the TGS. While the TGS does play a role in the encryption process by providing session keys, it does not encrypt all data transferred between the client and the application server. The encryption of data transferred between the client and the server is done using session keys, which are provided by the TGS but the actual encryption is done at the client and server ends. Related Content resources\questions\q_netauth_tgs_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 30/115 10/15/25, 11:31 PM Individual Response Question 23 Correct An attacker has gained access to the administrator's login credentials. Which type of attack has MOST likely occurred? Password cracking Correct Backdoor Privilege escalation Buffer overflow Explanation Password cracking is the process of recovering secret passwords from data that has been stored in or transmitted by a computer system. If an attacker has gained access to the administrator's login credentials, this is most likely the cause of a password-cracking attack. Privilege escalation allows a user to take advantage of a software bug or design flaw in an application to gain access to system resources or additional privileges that would typically not be available to the user. A backdoor is an unprotected access method or pathway. Backdoors may include hard-coded passwords or hidden service accounts. A buffer overflow attack occurs when the operating system or an application does not properly enforce boundaries for how much and which type of data can be inputted. Related Content 5.7.2 Device Vulnerability Facts 11.1.1 Program Management and Oversight Overview resources\questions\q_dev_vuln_cracking_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 31/115 10/15/25, 11:31 PM Individual Response Question 24 Correct An employee named Bob Smith, whose username is bsmith, has left the company. You have been instructed to delete his user account and home directory. Which of the following commands would produce the required outcome? (Select two.) userdel -Z bsmith userdel -r bsmith Correct userdel bsmith userdel bsmith;rm -rf /home/bsmith Correct userdel -h bsmith Explanation The userdel -r command deletes a user's home directory and user account. The userdel command by itself does not delete a user's home directory and user account. Executing rm -rf on the user's home directory after executing userdel removes the home directory. The userdel -h command displays the syntax and options for the userdel command. The userdel -Z command removes an SELinux user assigned to the user's login from SELinux login mapping. However, it does not delete the user home directory. Related Content 4.1.5 Access Control Model Facts 4.5.7 Restrict Local Accounts 4.5.8 Secure Default Accounts 4.5.10 Hardening Authentication Facts 4.6.1 Linux User and Group Overview 4.6.2 Managing Linux Users 4.6.3 Linux User Commands and Files 4.6.4 Create a User Account 4.6.6 Delete a User https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 32/115 10/15/25, 11:31 PM Individual Response 4.6.9 Lock and Unlock User Accounts 4.7.2 Linux Group Commands 4.7.3 Rename and Create Groups 4.7.4 Add Users to a Group 4.7.5 Remove a User from a Group 5.7.2 Device Vulnerability Facts 8.1.3 Hardening an Operating System 8.2.2 File System Security Facts 8.9.4 Version Control Management resources\questions\q_linux_usr_cmds_user_02_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 33/115 10/15/25, 11:31 PM Individual Response Question 25 Correct Which of the following is a password that relates to things that people know, such as a mother's maiden name or a pet's name? Cognitive Correct Passphrase Dynamic One-time Explanation Cognitive passwords relate to things that people know, such as a mother's maiden name or a pet's name. Dynamic passwords change upon each consecutive login. One-time passwords are only valid for a single use. A passphrase is a password long enough to be a phrase. Related Content 4.1.3 Access Control Best Practices 4.2.1 Authentication 4.2.2 Authentication Factors Facts 4.5.11 Configure Smart Card Authentication 4.5.12 Configure Smart Card Authentication 4.5.13 Smart Card Authentication Facts resources\questions\q_authent_know_01_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 34/115 10/15/25, 11:31 PM Individual Response Question 26 Correct You are the IT security manager for a rapidly growing tech company. The company has been using simple password authentication for all systems. However, with the increasing number of employees and the sensitivity of the data being handled, you decide it's time to harden the authentication methods. Which of the following steps would be the MOST effective in achieving this goal? Requiring all employees to change their passwords every 30 days. Implementing multifactor authentication (MFA) for all systems. Correct Implementing a policy that allows employees to use their personal email addresses for system logins. Implementing a policy that requires all passwords to be at least 8 characters long. Explanation Implementing multifactor authentication (MFA) is the most effective option. MFA requires users to provide two or more verification factors to gain access to a resource such as an application, online account, or a VPN. It adds an additional layer of security, reducing the likelihood of successful cyber attacks. While having a policy that requires all passwords to be at least 8 characters long is a step in the right direction, it is not the most effective way to harden authentication methods. Longer passwords are generally more secure, but they can still be compromised, especially if they are not complex. Requiring all employees to change their passwords every 30 days can lead to password fatigue, where users resort to using weak or reused passwords. While regular password changes can be part of a secure system, it is not as effective as implementing MFA. Allowing employees to use their personal email addresses for system logins is not a good practice for hardening authentication. Personal email addresses can be compromised, which could lead to unauthorized access to company systems. It's better to use work-specific email addresses or other forms of identification for system logins. Related Content https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 35/115 10/15/25, 11:31 PM Individual Response resources\questions\q_harden_auth_multifactor_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 36/115 10/15/25, 11:31 PM Individual Response Question 27 Correct As a cybersecurity expert, you are tasked with implementing a secure enclave in your company's new mobile banking application. Which of the following statements best describes the primary function and benefit of a secure enclave in this context? A secure enclave is a protected area within the application's code that prevents users from making unauthorized transactions. A secure enclave is a separate, isolated environment within the device's processor where sensitive data can be securely stored and processed. Correct A secure enclave is a cloud-based storage system where encrypted data is stored and can only be accessed with the correct decryption key. A secure enclave is a network security tool that monitors and controls incoming and outgoing network traffic based on predetermined security rules. Explanation A secure enclave is a separate, isolated environment within the device's processor. It is designed to securely store and process sensitive data, even in the event that the rest of the device is compromised. While a secure enclave does provide a level of protection, it is not located within the application's code and it does not directly prevent users from making unauthorized transactions. Its primary function is to securely store and process sensitive data. Monitoring and controlling incoming and outgoing network traffic refers to a firewall, not a secure enclave. A firewall is a network security device that monitors and controls network traffic, while a secure enclave is a hardware-based security feature of a processor. While a secure enclave does involve the storage of sensitive data, it is not a cloud-based storage system. A secure enclave is a hardware-based feature that exists within a device's processor. Related Content 3.2.4 Cryptographic Implementation Facts https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 37/115 10/15/25, 11:31 PM Individual Response resources\questions\q_comb_cryp_secure_enclaves_02_secp8.question.xml Question 28 Correct A healthcare provider suddenly receives a threat from an unknown source claiming to have obtained sensitive patient data. The anonymous actor demands a significant sum of Bitcoin, threatening to release the information publicly if the provider does not make payment. This kind of scenario BEST exemplifies which threat motivation? Disinformation Blackmail Correct Service disruption Espionage Explanation Blackmail involves threats to reveal damaging information unless the affected party meets the blackmailer's demands, such as demanding Bitcoin for not releasing stolen patient data. Espionage typically refers to the covert practice of obtaining confidential information for strategic advantage, often conducted by nation-states or competitive companies. Service disruption prevents an organization from functioning normally through distributed denial-of-service (DDoS) attacks or other means of halting services. The threat scenario mentioned does not include any attempt to halt the healthcare provider's services. Disinformation refers to the dissemination of false information to deceive or mislead. The threat scenario mentioned does not involve spreading false information but rather the threat of exposing real, sensitive information. Related Content 2.1.1 Threat Actor Types 2.1.2 Threat Actor Types Facts resources\questions\q_types_attackers_blackmail_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 38/115 10/15/25, 11:31 PM Individual Response Question 29 Correct An organization is implementing an Intrusion Prevention System (IPS) as part of its efforts to secure its enterprise infrastructure. The IT manager is considering the failure modes of the IPS and is deciding between a fail-open and a fail-closed configuration. What are the implications of each configuration on network traffic in the event of a system failure? Fail-open will block all traffic, while fail-closed will allow all traffic. Fail-open will allow all traffic, while fail-closed will block all traffic. Correct Both fail-open and fail-closed will allow all traffic. Both fail-open and fail-closed will block all traffic. Explanation An IPS can either allow all traffic through without disruption but with a risk of malware (failopen) or block all traffic without malware but with a risk of disruption (fail-closed). In the event of a system failure, a fail-open configuration allows all traffic, while a fail-closed configuration blocks all traffic. Even if the system fails, a fail-open configuration allows all traffic to pass through, ensuring that there is no disruption to the flow of data and information. If the system fails, a fail-closed configuration blocks all traffic from passing through, ensuring that no malware or other harmful content can enter the network. Related Content 5.1.1 Enterprise Network Architecture 5.1.2 Enterprise Network Architecture Facts 5.2.3 Security Solution Facts resources\questions\q_ent_architecture_fail-open_02_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 39/115 10/15/25, 11:31 PM Individual Response Question 30 Correct Which disinformation/misinformation tactics create convincing brand impersonation for phishing attacks or pharming websites? (Select two.) By mimicking the style or tone of email communications or website copy to create a convincing fake. Correct Repeating false claims or rumors without the intention to deceive others but aiming to get those false facts amplified by others. By accurately duplicating a company's logos and formatting, such as fonts, colors, and styles, to make the fake site visually compelling. Correct Primarily focusing on providing support for IT resources such as networks, security, or web infrastructure. Using disinformation to purposefully deceive individuals by spreading false claims and rumors with the intention of causing confusion and harm. Explanation A disinformation/misinformation campaign utilizes accurate duplications of a company's logos and formatting to appear more legitimate. Using the mimicry of communication styles creates convincing brand impersonation. This mimicry can lead to successful phishing attacks or pharming websites that appear visually compelling and authentic. While disinformation campaigns aim to purposely deceive individuals with false claims, it does not directly relate to brand impersonation or the creation of visually compelling fake messages or websites. Repeating rumors, false claims, or misinformation does not address brand impersonation or the use of realistic content to boost search rankings for fake websites. MSPs primarily focus on providing support for IT resources such as networks, security, or web infrastructure. Related Content 2.2.3 Social Engineering Techniques https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 40/115 10/15/25, 11:31 PM Individual Response 2.2.4 Social Engineering Techniques Facts resources\questions\q_social_engr_tqs_duplicate_logos_secp8.question.xml Question 31 Correct Which of the following malware recovery techniques is often faster and more effective than malware removal and cleanup of an infected computer? Remove removable drives Enabling privacy controls Block specific executable files Re-imaging the computer Correct Explanation Re-image a machine if your organization uses imaging solutions. Re-imaging or installing from scratch is often faster and more effective than malware removal and cleanup. The following are preventative measures, not recovery techniques: Enabling privacy controls in Windows Internet Explorer such as deleting browser history. Removing removable drives to prevent unauthorized software from being installed on a system. Block executable files that have been copied from another computer. Related Content resources\questions\q_mal_prot_reimage_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 41/115 10/15/25, 11:31 PM Individual Response Question 32 Correct You are a cybersecurity analyst tasked with performing passive reconnaissance on a potential client's network. You need to gather information from a variety of public sources including emails, names, subdomains, IPs, and URLs. Which of the following tools would be most appropriate for this task? Dnsenum Shodan OSINT framework theHarvester Correct Explanation theHarvester is the correct answer. This tool is specifically designed for passive reconnaissance and can gather a wide range of information from various public sources including emails, names, subdomains, IPs, and URLs. It uses multiple public data sources including search engines, social media sites, and Shodan, making it the most appropriate tool for this task. While Shodan is a powerful tool for finding internet-connected devices, it is not specifically designed for gathering a wide range of information from various public sources such as emails, names, subdomains, IPs, and URLs. While Dnsenum is a useful tool for DNS enumeration, it is not as comprehensive as theHarvester for gathering a wide range of information from various public sources. While the OSINT framework is a collection of resources and tools for open-source intelligence, it does not have the specific functionality of gathering emails, names, subdomains, IPs, and URLs from various public sources like theHarvester does. Related Content 6.2.3 Performing Port and Ping Scans 6.2.4 Reconnaissance 6.2.5 Perform Reconnaissance with Nmap https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 42/115 10/15/25, 11:31 PM Individual Response 6.2.6 Reconnaissance Facts 6.5.9 Examining DNS Attacks 7.4.1 Penetration Testing 7.4.2 Penetration Testing Facts 7.4.3 Penetration Testing Methods 7.4.4 Exploring Penetration Testing Tools resources\questions\q_recon_theharvester_secp8.question.xml Question 33 Partial What are the correct assumptions for attackers? Their attacks will eventually be detected. They are well-versed in various attack techniques. Correct They attack all systems, regardless of the type and value of the systems. They have abundant resources to leverage. Correct Correct They attack one system at a time. They don't have much knowledge about the system to attack. https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 43/115 10/15/25, 11:31 PM Individual Response Question 34 Incorrect To answer this question, complete the lab using the information below. You did not attempt the lab. You work as the IT security administrator for a small corporate network. You are improving office computers' security by renaming and disabling default accounts. In this lab, your task is to perform the following on the Office1 computer: Rename the Administrator account, Yoda. Disable the Guest account. Verify that Password never expires is not selected for any local users. This forces them to change their passwords regularly. Delete any user accounts with User must change password at next logon selected. This indicates that a user has never logged in. Launch Lab Related Content 4.1.5 Access Control Model Facts 4.5.7 Restrict Local Accounts 4.5.10 Hardening Authentication Facts 4.6.1 Linux User and Group Overview 4.6.2 Managing Linux Users 4.6.3 Linux User Commands and Files 4.6.4 Create a User Account 4.6.6 Delete a User 4.6.9 Lock and Unlock User Accounts 4.7.2 Linux Group Commands 4.7.3 Rename and Create Groups https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 44/115 10/15/25, 11:31 PM Individual Response 4.7.4 Add Users to a Group 4.7.5 Remove a User from a Group 5.7.2 Device Vulnerability Facts 8.1.3 Hardening an Operating System 8.2.2 File System Security Facts 8.9.4 Version Control Management l_secure_acct_secp8.js https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 45/115 10/15/25, 11:31 PM Individual Response Question 35 Correct You are a network security analyst for a large corporation. The company has recently experienced a series of network attacks, and you've been tasked with hardening the network switches to prevent future attacks. You've identified several potential measures to improve security. Which of the following would be the MOST effective approach to hardening the switches? Changing the default credentials. Enabling HTTP services for remote management. Disabling unnecessary services and interfaces. Correct Implementing Access Control Lists (ACLs). Explanation Disabling unnecessary services and interfaces is the most effective approach. Disabling unnecessary services and interfaces reduces the attack surface of the switch, making it harder for attackers to gain access. This is a more comprehensive measure compared to the other options, making it the most effective approach to switch hardening. Changing default credentials is a basic step in hardening any device, as default credentials are often well-known and pose a significant security risk. However, this measure alone does not provide a comprehensive approach to switch hardening. ACLs restrict access to the switch, providing a layer of security. However, this measure alone does not provide a comprehensive approach to switch hardening. Enabling HTTP services for remote management can actually introduce security vulnerabilities, as HTTP is not a secure protocol. This would not be an effective approach to hardening the switches and is therefore not the most effective approach. Related Content 5.7.6 Secure a Switch 5.9.1 Switch Features 5.9.2 Securing Network Switches 5.9.3 Switch Security Facts https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 46/115 10/15/25, 11:31 PM Individual Response 5.9.4 Switch Attacks 5.9.5 Switch Attack Facts 5.9.6 Hardening a Switch 5.9.7 Harden a Switch 5.9.8 Secure Access to a Switch 5.9.9 Secure Access to a Switch 2 resources\questions\q_swi_attack_harden_switches_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 47/115 10/15/25, 11:31 PM Individual Response Question 36 Correct The IT administrator for a large university uses an LDAP directory service to manage user access to various computing resources. To ensure the directory's security, which of the following measures should the administrator implement? Implement Simple Bind with plaintext transmission of distinguished name and password. Use the basic LDAP protocol without any additional security mechanisms. Set up LDAP Secure (LDAPS) with a digital certificate on port 636 for secure user credential exchange. Correct Allow anonymous access to the directory for easy user onboarding. Explanation Setting up LDAP Secure (LDAPS) with a digital certificate on port 636 for secure user credential exchange encrypts data and ensures the protection of user credentials during transmission by providing a secure tunnel. Exposing sensitive data and creating potential security risks results from anonymous access to the directory, making it not recommended for secure environments. Using the basic LDAP protocol without any additional security mechanisms does not provide the extra security needed in this scenario. Implementing Simple Bind with plaintext transmission of distinguished name and password does not provide the level of security needed in this scenario. Related Content 4.2.3 Authentication Methods 4.2.4 Authentication Methods Facts 4.9.2 Network Authentication Facts 4.9.3 LDAP Authentication 4.9.4 LDAP Authentication Facts 8.8.3 Injection Attacks https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 48/115 10/15/25, 11:31 PM Individual Response resources\questions\q_ldap_secure_secp8.question.xml Question 37 Correct Which of the following is the BEST definition of the term hacker? A threat actor whose main goal is financial gain. Any individual whose attacks are politically motivated. A threat actor who lacks skills and sophistication but wants to impress their friends or garner attention. A general term used to describe any individual who uses their technical knowledge to gain unauthorized access to an organization. Correct The most organized, well-funded, and dangerous type of threat actor. Explanation The term hacker is a general term used to describe any individual who uses their technical knowledge to gain unauthorized access to an organization. The following are specific types of hackers, also known as threat actors: A hacktivist is any individual whose attacks are politically motivated. A nation state is the most organized, well-funded, and dangerous type of threat actor. An organized crime threat actor is a group of cybercriminals whose main goal is financial gain. A script kiddie is a threat actor who lacks skills and sophistication but wants to impress their friends or garner attention. Script kiddies carry out an attack by using scripts or programs written by more advanced hackers. Related Content resources\questions\q_types_attackers_hacker_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 49/115 10/15/25, 11:31 PM Individual Response Question 38 Incorrect To answer this question, complete the lab using the information below. You did not attempt the lab. You have a small business network connected to the internet through a single router as shown in the network diagram. You have noticed that three hosts on the internet have been flooding your router with unwanted traffic. As a temporary measure, you want to prevent all communication from these three hosts until the issue is resolved. In this lab, your task is to: Create a Standard Access List 25. Add statements to the access list to block traffic from the following hosts: 199.68.111.199 202.177.9.1 211.55.67.11 Add a statement to allow all other traffic from all other hosts. Apply Access List 25 to the Serial0/0/0 interface to filter incoming traffic. You can also use 199.68.111.199 0.0.0.0 (without the host parameter) to identify a specific host. You can also use 0.0.0.0 255.255.255.255 to identify any host. Because this is a temporary solution, you do not need to save your changes. Launch Lab Related Content 4.3.1 Authorization 4.3.3 Authorization Facts 5.10.1 Router Security 5.10.2 Router ACLs 5.10.3 Router Security Facts https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 50/115 10/15/25, 11:31 PM Individual Response 5.10.4 Configuring ACLs 5.10.5 Restrict Telnet and SSH Access 5.10.6 Permit Traffic 6.4.2 Protocol Analyzer Facts 8.1.1 Operating System Hardening 8.2.1 File Server Security 8.2.2 File System Security Facts 8.2.3 File Permission Facts 8.2.4 Configuring NTFS Permissions 8.3.1 Linux Host Security 8.3.2 Removing Unnecessary Services 8.3.3 Linux Host Security Facts 8.3.4 Configure iptables 8.3.5 Configure iptables Facts l_acl_block_host_secp8.js https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 51/115 10/15/25, 11:31 PM Individual Response Question 39 Incorrect A new IT tech reviews changes made to a computer, including turning off unneeded logical ports, installing a host-based firewall, and updating the installed antivirus software. These actions are examples of what technique? Implementing host-based intrusion detection/prevention Securing the system against a network attack Correct Controlling access to the system Following a baseline configuration and registry settings Incorrect Explanation Protecting a system from a network-based attack includes disabling unneeded logical ports, installing a host-based firewall, and updating the local antivirus software. These steps do not assist in controlling access to the system. The steps outlined will help make a system more secure overall, especially when the steps to protect against a network attack pair with steps to harden the system from local attacks. Host-based intrusion detection and intrusion prevention systems (HIDS/HIPS) require deploying and configuring specialized software agents that continuously monitor and analyze endpoints. Companies install baseline configuration and registry settings (BCRS) by default and automatically apply the registry settings. Related Content 5.2.1 Security Appliances 5.2.3 Security Solution Facts 5.2.6 Configure Network Security Appliance Access 5.4.1 Firewalls 5.4.2 Firewall Facts 5.4.5 Configure a Perimeter Firewall https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 52/115 10/15/25, 11:31 PM Individual Response resources\questions\q_firewalls_host_02_secp8.question.xml Question 40 Incorrect You have transferred an encrypted file across a network using the Server Message Block (SMB) Protocol. What happens to the file's encryption? An encrypted file cannot be moved using SMB. The encryption inherits from the new location. The encryption carries over to the new location. The file is unencrypted when moved. Incorrect Correct Explanation A file is automatically unencrypted when you copy it over a network using the SMB Protocol. The encryption does not carry over to the new location, nor does the file inherit from the new location. A file can be moved using the SMB Protocol. Related Content 3.4.9 File Encryption Facts 5.1.2 Enterprise Network Architecture Facts 8.1.2 Hardening Facts resources\questions\q_file_encryption_unencrypt_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 53/115 10/15/25, 11:31 PM Individual Response Question 41 Incorrect To answer this question, complete the lab using the information below. You did not attempt the lab. Every seven years, your company provides a six-week sabbatical for every employee. Vera Edwards (vedwards), Corey Flynn (cflynn), and Bhumika Kahn (bkahn) are leaving today. Maggie Brown (mbrown), Brenda Cassini (bcassini), and Arturo Espinoza (aespinoza) are just returning. The company security policy mandates that user accounts for employees gone for longer than two weeks be disabled. In this lab, your task is to: Lock the following user accounts: vedwards cflynn bkahn Unlock the following user accounts: mbrown bcassini aespinoza When you're finished, view the /etc/shadow file to verify the changes. Launch Lab Related Content 4.1.5 Access Control Model Facts 4.5.7 Restrict Local Accounts 4.5.8 Secure Default Accounts 4.5.10 Hardening Authentication Facts 4.6.1 Linux User and Group Overview https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 54/115 10/15/25, 11:31 PM Individual Response 4.6.2 Managing Linux Users 4.6.3 Linux User Commands and Files 4.6.4 Create a User Account 4.6.6 Delete a User 4.7.2 Linux Group Commands 4.7.3 Rename and Create Groups 4.7.4 Add Users to a Group 4.7.5 Remove a User from a Group 5.7.2 Device Vulnerability Facts 8.1.3 Hardening an Operating System 8.2.2 File System Security Facts 8.9.4 Version Control Management l_lock_acct_secp8.js Question 42 Correct Which of the following statements are true about one-time pad? For perfect secrecy, the key should be truly randomly. It is impractical for most uses. Correct Correct The encryption is done by the bitwise OR operation. It is provably unbreakable regardless of key usage. https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 55/115 10/15/25, 11:31 PM Individual Response Question 43 Correct Hashing is the process of converting one value into another using a mathematical algorithm like MD5 or SHA. This fixed length of data is called the hash. Which of the following are true statements about hashing? (Select two.) Hashing works by shifting each letter in the alphabet a certain number of spaces to the right or left. A hash is a string of bits that is randomly generated using a specific cipher. A hash cannot be decrypted. Correct Hashing is used on data that does not need to be decrypted, such as a password. Correct A hash verifies that the data is legitimate and provides non-repudiation. Explanation The following are true statements about hashing: Hashing is used on data that does not need to be decrypted, such as a password. A hash cannot be decrypted. When a piece of data is run through a hashing algorithm, it always generates the same hash. An encryption key is a string of bits that is randomly generated using a specific cipher, such as Advanced Encryption Standard (AES). A Caesar cipher works be shifting each letter in the alphabet a certain number of spaces to the right or left. A digital signature verifies that the data is legitimate and provides non-repudiation. This means that the sender cannot deny having sent the file. Related Content 3.1.1 Cryptography Concepts 3.1.2 Cryptography Facts 3.2.4 Cryptographic Implementation Facts https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 56/115 10/15/25, 11:31 PM Individual Response 3.3.1 Hashing 3.3.3 Hashing Facts 3.3.4 Using Hashes 3.3.5 Compare an MD5 Hash 6.6.2 Password Attack Facts resources\questions\q_cryp_concepts_hashing_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 57/115 10/15/25, 11:31 PM Individual Response Question 44 Correct Which of the following objects identifies a set of users with similar access needs? DACL Permissions Group Correct SACL Explanation A group is an object that identifies a set of users with similar access needs. Microsoft systems have two kinds of groups, distribution groups and security groups. Only security groups can be used for controlling access to objects. A discretionary access control list (DACL) is an implementation of discretionary access control (DAC). A system access control list (SACL) is used by Microsoft for auditing in order to identify past actions performed by users on an object. Permissions define the rights and access users and groups have with objects. Related Content 4.1.2 Access Control Facts 4.2.3 Authentication Methods 4.2.4 Authentication Methods Facts 4.3.3 Authorization Facts 4.5.1 Hardening Authentication 4.5.2 Configure User Account Restrictions 4.5.10 Hardening Authentication Facts 5.6.2 Network Access Control Facts 10.4.3 Cloud Computing Security Issues resources\questions\q_authorize_group_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 58/115 10/15/25, 11:31 PM Individual Response Question 45 Correct A corporation's IT department is integrating a new framework that permits, ascertains, and applies various resources in accordance with established company policies. Which principle should the department incorporate? AAA Zero trust Authorization models Policy-driven access control Correct Explanation Policy-driven access control uses policies to control access to resources, allowing the organization to systematically enforce rules about who can access which resources under which conditions. Authorization models are more generic methods for determining what resources a user or system can access within a system. While crucial to any secure system, they do not necessarily incorporate company policies for controlling access. Authentication, authorization, and accounting (AAA) includes policy enforcement elements in its scope. However, AAA is a broader concept that also involves verifying the user's identity (authentication) and tracking their activities (accounting). Zero trust does not focus on enforcing company policies to control access, but verifies everything trying to connect to the system. Related Content 4.1.1 Fundamental Security Concepts 4.1.2 Access Control Facts 5.6.2 Network Access Control Facts resources\questions\q_acc_ctrl_access_control_02_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 59/115 10/15/25, 11:31 PM Individual Response Question 46 Correct Which of the following are characteristics of a rootkit? (Select two.) Uses cookies saved on the hard drive to track user preferences. Resides below regular antivirus software detection. Correct Collects various types of personal information. Requires administrator-level privileges for installation. Correct Monitors user actions and opens pop-ups based on user preferences. Explanation A rootkit is a set of programs that allow attackers to maintain hidden, permanent, administrator-level access to a computer. A rootkit: Is almost invisible software. Resides below regular antivirus software detection. Requires administrator privileges for installation and then maintains those privileges to allow subsequent access. Might not be malicious. Often replaces operating system files with alternate versions that allow hidden access. Spyware collects various types of personal information, such as internet surfing habits and passwords, and sends the information back to its originating source. Adware monitors actions that denote personal preferences and then sends pop-ups and ads that match those preferences. Both spyware and adware can use cookies to collect and report a user's activities. Related Content 2.3.2 Malware Facts resources\questions\q_mal_rootkit_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 60/115 10/15/25, 11:31 PM Individual Response Question 47 Incorrect To answer this question, complete the lab using the information below. You did not attempt the lab. You are the IT security administrator for a small corporate network. Recently, some of your firm's proprietary data leaked online. You have been asked to use steganography to encrypt data into a file to be shared with a business partner. The data will allow you to track the source if the information is leaked again. In this lab, your task is to use OpenStego to hide data in photos as follows: Encrypt and password-protect the user data in the file to be shared. Message file: John.txt Cover file: gear.png Output Sego file: send.png (saved in the Documents folder) Password: NoMor3L3@ks! Confirm the functionality of the steganography by: Extracting the data to C:\Users\Administrator\Documents\Export. Open the extracted file to confirm that the associated username has been embedded into the file. Launch Lab Related Content 3.1.1 Cryptography Concepts 3.1.2 Cryptography Facts 3.1.10 Use Steganography to Hide a File 3.2.1 Combining Cryptographic Methods 3.2.4 Cryptographic Implementation Facts 3.3.5 Compare an MD5 Hash 7.3.6 Data Loss Prevention https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 61/115 10/15/25, 11:31 PM Individual Response 8.7.1 Secure Protocols 8.7.5 IPsec 8.7.6 IPsec Facts 8.7.7 Requiring IPsec for Communications l_hidefiles_openstego_secp8.js https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 62/115 10/15/25, 11:31 PM Individual Response Question 48 Correct Marcus White has just been promoted to a manager. To give him access to the files that he needs, you make his user account a member of the Managers group, which has access to a special shared folder. Later that afternoon, Marcus tells you that he is still unable to access the files reserved for the Managers group. What should you do? Have Marcus log off and log back in. Correct Manually refresh Group Policy settings on his computer. Manually refresh Group Policy settings on the file server. Add his user account to the ACL for the shared folder. Explanation On a Microsoft system, an access token is only generated during authentication. Changes made to group memberships or user rights do not take effect until the user logs in again and a new access token is created. Use NTFS and share permissions, not Group Policy, to control access to files. In addition, Group Policy is periodically refreshed, and new settings are applied on a regular basis. Related Content 4.1.2 Access Control Facts 4.2.3 Authentication Methods 4.2.4 Authentication Methods Facts 4.3.3 Authorization Facts 4.5.1 Hardening Authentication 4.5.2 Configure User Account Restrictions 4.5.10 Hardening Authentication Facts 5.6.2 Network Access Control Facts 10.4.3 Cloud Computing Security Issues https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 63/115 10/15/25, 11:31 PM Individual Response resources\questions\q_authorize_token_01_secp8.question.xml Question 49 Correct In the certificate authority trust model known as a hierarchy, where does trust start? Third-party CA Registration authority Root CA Correct Issuing CA Explanation Trust starts at the Root CA in all trust models. An Issuing CA can be a Root CA or a CA at any level below the root. A third-party CA may be the source of trust, but even then, the trust starts at a Root CA located somewhere. A registration authority (RA) is a limited-functionality CA where certificates are verified, but no new certificates can be issued. Related Content 3.5.3 Certificate Types 3.5.4 Certificate Types Facts 3.5.7 Certificate Concepts 3.5.8 Certificate Concepts Facts resources\questions\q_cert_types_ca_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 64/115 10/15/25, 11:31 PM Individual Response Question 50 Correct The security team in a financial organization identified a zero-day vulnerability attack that enables cross-site scripting (XSS) attacks on its internal web portal. The chief information security officer (CISO) instructs the team to take immediate action. Which action MOST effectively minimizes the threat from the zero-day vulnerability and the potential XSS attacks? Upgrade the hardware of the server. Encourage staff to change their passwords. Restrict the number of login attempts. Implement a web application firewall (WAF). Correct Explanation Implementing a WAF directly addresses the zero-day vulnerability and XSS attacks by inspecting incoming traffic and blocking suspicious requests. Upgrading the server hardware might improve overall system performance but does not address software vulnerabilities like XSS. Encouraging staff to change passwords is generally a good practice in maintaining security, but it does not directly help in preventing XSS attacks. XSS attacks exploit vulnerabilities in web applications to inject malicious scripts, which execute in the context of the victim's session. Restricting login attempts is a common method used to mitigate brute-force attacks, where an attacker tries multiple combinations to guess a password and does not prevent XSS attacks. Related Content 5.2.1 Security Appliances 5.2.3 Security Solution Facts 5.2.6 Configure Network Security Appliance Access 5.4.1 Firewalls 5.4.2 Firewall Facts https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 65/115 10/15/25, 11:31 PM Individual Response 5.4.5 Configure a Perimeter Firewall resources\questions\q_firewalls_waf_01_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 66/115 10/15/25, 11:31 PM Individual Response Question 51 Incorrect To answer this question, complete the lab using the information below. You did not attempt the lab. You work as the IT security administrator for a small corporate network. Occasionally, you and your co-administrators need to access internal resources when you are away from the office. You would like to set up a Remote Access VPN using pfSense to allow secure access. In this lab, your task is to use the pfSense wizard to create and configure an OpenVPN Remote Access server using the following guidelines: Sign in to pfSense using: Username: admin Password: P@ssw0rd (zero) Create a new certificate authority certificate using the following settings: Name: CorpNet-CA Country Code: GB State: Cambridgeshire City: Woodwalton Organization: CorpNet Create a new server certificate using the following settings: Name: CorpNet Country Code: GB State: Cambridgeshire City: Woodwalton Configure the VPN server using the following settings: Interface: WAN Protocol: UDP on IPv4 only Description: CorpNet-VPN Tunnel network IP: 198.28.20.0/24 Local network IP: 198.28.56.18/24 Concurrent Connections: 4 DNS Server 1: 198.28.56.1 https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 67/115 10/15/25, 11:31 PM Individual Response Configure the following: A firewall rule An OpenVPN rule Set the OpenVPN server just created to Remote Access (User Auth). Create and configure the following standard remote VPN users: Username Password Full Name blindley L3tM31nNow Brian Lindley jphillips L3tM31nToo Jacob Phillips Launch Lab Related Content 4.8.1 Remote Access 4.8.2 Remote Access Facts 4.8.4 RADIUS and TACACS+ Facts 5.3.4 Screened Subnet Facts 5.5.1 Virtual Private Networks 5.5.2 Configuring a VPN 5.5.5 Configure a VPN Connection iPad 5.5.6 Configure Remote Access, non VPN 5.5.7 Virtual Private Network Facts 5.5.8 VPN Protocol Facts 5.10.1 Router Security 8.2.1 File Server Security 8.2.2 File System Security Facts 8.7.2 Secure Protocol Facts 8.7.6 IPsec Facts 10.2.5 Virtual Networking Facts l_pfsense_vpn_secp8.js https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 68/115 10/15/25, 11:31 PM Individual Response Question 52 Correct In the IND-CPA game, how many plaintext messages can the adversary send to the challenger for encryption in the maximum? 8 None of the above 1 Unlimited Correct 4 2 https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 69/115 10/15/25, 11:31 PM Individual Response Question 53 Correct A large enterprise recently introduced a bring your own device (BYOD) policy and is seeing an uptick in the use of Internet of Things (IoT) devices in the office. Concerns about unauthorized network access and compliance with security standards accompany these changes. Assess the following options and determine the MOST suitable strategy to alleviate these security concerns. Deploy agent-based Network Access Control (NAC) with dynamic Virtual Local Area Networks (VLANs) and firewall integration. Correct Implement agentless Network Access Control (NAC) without firewall integration. Depend solely on the existing firewall for device authentication. Use Network Access Control (NAC) without employing dynamic Virtual Local Area Networks (VLANs). Explanation An agent-based NAC approach combined with dynamic VLAN assignment and firewall integration provides a comprehensive solution. The solution offers robust device authentication, security policy compliance, and flexibility to accommodate various device types and user roles. While essential for network security, firewalls do not offer the granular control and compliance enforcement that an agent-based NAC can provide. While agentless NAC can accommodate a variety of devices without prior configuration, its information about a device's status and compliance is less detailed than that of agent-based NAC. Employing NAC without using dynamic VLANs limits the system's ability to effectively manage network access based on user identity attributes, device type, or compliance status. Related Content 5.6.2 Network Access Control Facts 10.7.1 BYOD Security Issues https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 70/115 10/15/25, 11:31 PM Individual Response 10.7.2 BYOD Security Facts resources\questions\q_nac_vlan_01_secp8.question.xml Question 54 Correct The SHA-256 algorithm is used to calculate the hash of a 21-byte message. How long is the trunk used during the calculation? What is the hexadecimal value of the "length of input" field in the trunk? How long is the hash? 512 bits, 0000000F, 256 bits Correct 512 bits, 0015, 256 bytes 256 bits, 8015, 256 bits 256 bytes, 0000000F, 256 bits 512 bytes, 80000015, 256 bits 256 bits, 800F, 256 bytes https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 71/115 10/15/25, 11:31 PM Individual Response Question 55 Correct A user copies files from her desktop computer to a USB flash device and puts the device into her pocket. Which of the following security risks is MOST pressing? Availability Confidentiality Correct Non-repudiation Integrity Explanation Confidentiality ensures that data is not disclosed to unintended persons. Removable media poses a big threat to confidentiality because it makes it easy to remove data and share it with unauthorized users. Availability ensures that data is available when it is needed. Copying files to a server that includes malware could threaten the data's availability if the malware deletes or corrupts the data. Integrity ensures that data is not modified or tampered with. Non-repudiation provides validation of a message's origin. Related Content 1.1.3 Security Introduction Facts 4.1.2 Access Control Facts 5.6.2 Network Access Control Facts resources\questions\q_sec_intro_confidentiality_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 72/115 10/15/25, 11:31 PM Individual Response Question 56 Incorrect You are a cybersecurity manager at a financial institution. Your team is responsible for managing the cryptographic keys used for secure transactions. Recently, there has been an increase in attempted cyber attacks on your institution. Which of the following key management strategies would be MOST effective in maintaining the security of your cryptographic keys under these circumstances? You decide to set an expiration date for all current keys and inform users that they will need to renew their keys Correct after this date. You decide to centralize key generation and storage, moving all keys to a single server for easier management. You decide to generate new keys for each transaction, but keep the old keys stored in the system for future reference. You decide to revoke all current keys and generate new ones, informing all users to update their keys Incorrect immediately. Explanation Setting an expiration date for all current keys and requiring users to renew their keys after this date is the correct and proactive approach to key management in this scenario. This ensures that keys are regularly updated, reducing the chance that an attacker can use an old key to gain unauthorized access. It also provides a structured and predictable process for users, which can help prevent confusion or errors. While generating new keys for each transaction can enhance security, keeping old keys stored in the system can pose a risk. If an attacker gains access to these old keys, they might be able to decrypt past transactions and gain access to sensitive information. Revoking all current keys and generating new ones can be a drastic measure that may cause unnecessary disruption. It can also confuse users and lead to potential errors or security risks if not managed properly. While centralizing key generation and storage can simplify management, it can also create a single point of failure. If the server where the keys are stored is compromised, all keys could be at risk. It's generally better to distribute keys across multiple secure locations. https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 73/115 10/15/25, 11:31 PM Individual Response Related Content resources\questions\q_comb_cryp_expiration_date_secp8.question.xml Question 57 Correct Which technology was developed to help improve the efficiency and reliability of checking the validity status of certificates in large, complex environments? Online Certificate Status Protocol Correct Certificate revocation list Private key recovery Key escrow Explanation Online Certificate Status Protocol (OCSP) is the technology developed to improve the efficiency and reliability of checking the validity status of certificates in large, complex environments. OCSP allows clients to query a CA or registration authority (RA) and quickly learn whether a certificate is valid or has been revoked. OCSP is a significant improvement over the CRL mechanism. CRLs were static lists that were distributed periodically to CAs and RAs. However, CRLs were often out of date. Key escrow and private key recovery are not related to certificate status checking. Related Content 3.5.1 Public Key Infrastructure 3.5.2 Public Key Infrastructure Facts 3.5.4 Certificate Types Facts 3.5.7 Certificate Concepts 3.5.8 Certificate Concepts Facts resources\questions\q_cryt_pki_ocsp_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 74/115 10/15/25, 11:31 PM Individual Response Question 58 Correct A financial institution has recently undergone a significant network infrastructure upgrade and plans to enhance its network security. It is considering incorporating access control lists (ACLs) into its firewall rules and wants to establish a screened subnet for better security. Which of the following options would be the MOST beneficial course of action? Incorporate ACLs into its firewall rules and set up a screened subnet Correct Implement ACLs in its firewall and avoid creating a screened subnet Establish a screened subnet but keep the existing firewall rules Maintain the existing firewall rules and ignore ACLs and screened subnet Explanation Incorporating ACLs into the institution's firewall rules will provide more precise control over traffic based on various parameters. Simultaneously, setting up a screened subnet can isolate public-facing servers from sensitive internal network resources, thus reducing the exposure of the internal network to external threats. Keeping the current firewall rules without considering ACLs or a screened subnet may leave the institution vulnerable to more advanced threats. While implementing ACLs in the firewall enhances traffic control and security, not setting up a screened subnet misses an opportunity to reduce the exposure of internal network resources to external threats. Establishing a screened subnet is a good security practice; however, keeping the existing firewall rules without integrating ACLs misses out on granular traffic control. Related Content 5.4.1 Firewalls 5.4.2 Firewall Facts 5.4.3 Configuring Firewall Rules 5.4.4 Configure Firewall Schedules 5.4.5 Configure a Perimeter Firewall https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 75/115 10/15/25, 11:31 PM Individual Response resources\questions\q_firewalls_acl_03_secp8.question.xml Question 59 Correct Which of the following statements about honeyfiles are true? (Select two.) Honeyfiles are used to block all types of malicious traffic. Honeyfiles can only be created by system administrators. Honeyfiles work with network intrusion detection systems (NIDs) and can help prevent false positives. Correct Honeyfiles are designed to provide real data to the attacker. Honeyfiles are named in a way that makes them attractive to hackers, enticing them to open or execute Correct them. Explanation The following are true statements about honeyfiles: Honeyfiles are named in a way that makes them attractive to hackers, enticing them to open or execute them. Honeyfiles work with network intrusion detection systems (NIDs) and can help prevent false positives by providing a controlled environment for detecting malicious activity. Honeyfiles do not provide real data to the attacker. They are decoy files set up to attract and trap attackers. While honeyfiles can help detect and track malicious activity, they do not directly block malicious traffic. While system administrators often create honeyfiles, end users who are properly trained can also create their own honeyfiles with their own alarms and alerts. Related Content 5.2.9 Deceptive and Disruption Technology 5.2.10 Deceptive and Disruption Technology Facts resources\questions\q_attk_deception_honeyfiles_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 76/115 10/15/25, 11:31 PM Individual Response Question 60 Correct A hacker scans hundreds of IP addresses randomly on the internet until they find an exploitable target. What kind of attack is this? Insider attack Targeted attack Nation-state attack Opportunistic attack Correct Explanation In this scenario, the hacker is looking for an easy target and doesn't care what they are attacking. This is considered an opportunistic attack. If the hacker had been targeting a certain individual, company, organization, or nation, it would have been considered a targeted attack. An insider attack is accomplished by a threat agent who has authorized access to an organization and either intentionally or unintentionally carries out an attack. A nation-state attack is accomplished by a threat agent that is a sovereign state who may wage an all-out war on a target and have significant resources and money at their disposal. Related Content resources\questions\q_types_attackers_opp_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 77/115 10/15/25, 11:31 PM Individual Response Question 61 Correct You are a security analyst at a large corporation. Your company has recently implemented an Open Authorization (OAuth) system to allow third-party applications to access company resources. One day, you notice an unusual amount of data being transferred from your company's servers to an unknown third-party application. What should be your first course of action? Report the situation to the company's legal department without conducting any further investigation. Immediately block all data transfers to the third-party application without further investigation. Ignore the situation as the OAuth system is designed to allow third-party applications to access company resources. Investigate the third-party application to understand why it is accessing a large amount of data. Correct Explanation Investigating the third-party application is the correct answer. This action will help you understand why the OAuth system is accessing a large amount of data. This could reveal whether the data transfer is legitimate or if there is a potential security breach. While OAuth is designed to allow third-party applications to access company resources, an unusual amount of data transfer could indicate a potential security breach or misuse of access privileges. While it might be necessary to block data transfers eventually, doing so immediately without further investigation could disrupt legitimate business operations and does not address the root cause of the issue. While it might be necessary to involve the legal department eventually, doing so without conducting any further investigation does not address the immediate potential security risk. Related Content 4.2.3 Authentication Methods 4.2.4 Authentication Methods Facts https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 78/115 10/15/25, 11:31 PM Individual Response 4.9.1 Network Authentication Protocols 4.9.2 Network Authentication Facts resources\questions\q_netauth_oauth_04_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 79/115 10/15/25, 11:31 PM Individual Response Question 62 Incorrect To answer this question, complete the lab using the information below. You did not attempt the lab. You share a computer with other users at work. You want to secure the contents of the Finances folder so that unauthorized users cannot view its contents. In this lab, your task is to: Encrypt the D:\Finances folder and all of its contents. Give John file access to the encrypted D:\Finances\2023report.xls file by adding the encryption certificate. Launch Lab Related Content 3.2.3 Verify Device for TPM 3.2.4 Cryptographic Implementation Facts 3.4.1 Encrypting File System 3.4.2 Encrypt Files 3.4.6 BitLocker and Database Encryption 3.4.7 Configuring BitLocker 3.4.8 Configure BitLocker with a TPM 7.3.6 Data Loss Prevention 8.1.2 Hardening Facts 8.2.1 File Server Security 8.2.2 File System Security Facts l_encrypt_secp8.js https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 80/115 10/15/25, 11:31 PM Individual Response Question 63 Correct A financial institution is processing transactions and wishes to improve its security posture. The institution divides its network into different sections to minimize risk while actively updating or retrieving transaction data. What method does the financial institution intend to use? Segmentation Correct Firewalling Virtual private network (VPN) Network address translation (NAT) Explanation Segmentation works by dividing a network into different sections so that the institution can protect its data while processing. Firewalling provides a line of defense against attacks but does not involve dividing the network into different sections. NAT is a method of remapping one Internet Protocol (IP) address space into another by modifying network address information in the IP header of packets. However, it does not provide a method of dividing a network into segments. A VPN can provide secure remote access to an organization's network, although it does not involve segmenting the network. Related Content 5.9.1 Switch Features 5.9.2 Securing Network Switches 5.9.3 Switch Security Facts 5.9.6 Hardening a Switch 5.10.3 Router Security Facts resources\questions\q_router_sec_segmentation_01_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 81/115 10/15/25, 11:31 PM Individual Response Question 64 Correct Which of the following are differences between RADIUS and TACACS+? RADIUS supports more protocols than TACACS+. RADIUS encrypts the entire packet contents; TACACS+ only encrypts the password. RADIUS combines authentication and authorization into a single function; TACACS+ allows these services to be Correct split between different servers. RADIUS uses TCP; TACACS+ uses UDP. Explanation TACACS+ provides three protocols (one each for authentication, authorization, and accounting). This allows each service to be provided by a different server. In addition, TACACS+: Uses TCP Encrypts the entire packet contents Supports more protocol suites than RADIUS Related Content 4.8.3 Configuring a RADIUS Solution 4.8.4 RADIUS and TACACS+ Facts 5.9.3 Switch Security Facts 8.4.3 Wireless Networking Facts 8.6.3 Wireless Authentication and Access Methods 8.6.4 Wireless Authentication and Access Methods Facts resources\questions\q_radius_tacacs_tac_dif_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 82/115 10/15/25, 11:31 PM Individual Response Question 65 Correct A medium-sized organization implements a secure access service edge (SASE) solution to secure its distributed network. The IT manager wants to protect all data in transit. Which of the following should the organization implement alongside SASE to achieve this goal? A Software-Defined Wide Area Network (SD-WAN) to manage network connectivity A Transport Layer Security (TLS) protocol to secure data in transit Correct A Layer 4 firewall to control access to network resources A standalone intrusion detection system (IDS) to monitor network traffic Explanation The Transport Layer Security (TLS) protocol encrypts data in transit, providing an additional layer of security alongside SASE to help to ensure sensitive information remains confidential and protected from unauthorized access. While an intrusion detection system (IDS) can monitor network traffic for signs of security threats, it doesn't specifically secure data in transit, meaning data could still be vulnerable to interception or tampering. An SD-WAN can manage network connectivity and optimize traffic routing but does not inherently secure data in transit, so additional measures may be necessary to protect sensitive information. A Layer 4 firewall controls access to network resources by filtering traffic based on port numbers and protocols, but it does not specifically secure data in transit. Related Content 4.8.1 Remote Access 4.8.2 Remote Access Facts 5.5.6 Configure Remote Access, non VPN 5.5.7 Virtual Private Network Facts 5.5.8 VPN Protocol Facts https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 83/115 10/15/25, 11:31 PM Individual Response 8.2.2 File System Security Facts 8.6.3 Wireless Authentication and Access Methods 8.7.1 Secure Protocols 8.7.2 Secure Protocol Facts 8.7.3 Add TLS to a Website 8.7.4 Allow SSL Connections 8.7.5 IPsec 8.7.6 IPsec Facts 8.7.7 Requiring IPsec for Communications 10.9.1 Email Security 10.9.4 Securing an Email Server 10.9.6 Securing Accounts on an iPad 10.9.7 Secure Email on iPad resources\questions\q_vpn_prot_tls_02_secp8.question.xml Question 66 Correct Which of the following statement are true about block ciphers? They provide integrity. They use symmetric keys. Correct They encrypt data in blocks of variable sizes. They produce a permutation of the plaintext. Correct https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 84/115 10/15/25, 11:31 PM Individual Response Question 67 Incorrect In a brute-force attack on the Caesar cipher, how many possible keys must be tested in the worst-case scenario? 26 Incorrect 24 12 25 Correct None of the above 13 https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 85/115 10/15/25, 11:31 PM Individual Response Question 68 Correct What is the purpose of key escrow? Key escrow is a method of generating encryption keys. Key escrow is a method of transmitting encryption keys over the internet. Key escrow is a method of revoking encryption keys. Key escrow is a method of storing a copy of the encryption key with a trusted third party. Correct Explanation The correct answer is that key escrow is a method of storing a copy of the encryption key with a trusted third party. Key escrow is a security measure where a copy of the encryption key is stored with a trusted third party. This is often done for security and legal purposes. In case the original key is lost or the key holder is unavailable, the key can be retrieved from the escrow to access the encrypted data. Key escrow does not involve the generation of encryption keys. It is a method for storing a copy of the encryption key with a trusted third party for safekeeping and retrieval in case of need. Key escrow is not a method for transmitting encryption keys. It is a method of storing a copy of the encryption key with a trusted third party. The transmission of encryption keys involves different protocols and methods to ensure security. Key escrow does not involve the revocation of encryption keys. It is a method of storing a copy of the encryption key with a trusted third party. The revocation of encryption keys is a separate process that involves invalidating the key and ceasing its use for encryption or decryption. Related Content 3.1.4 Symmetric and Asymmetric Encryption Facts 3.5.2 Public Key Infrastructure Facts 3.5.8 Certificate Concepts Facts resources\questions\q_cert_concepts_escrow_01_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 86/115 10/15/25, 11:31 PM Individual Response Question 69 Incorrect A tech company is developing a new software product. The development team is distributed across different locations and needs to securely access and work on specific systems located in the company's main office. The team members need to establish secure communication channels between their individual devices and the specific systems in the office. Which remote access architecture would be the most suitable for this scenario? Host-to-host tunnel topology Correct Client-to-site VPN technology Incorrect Virtual network computing (VNC) Site-to-site VPN topology Explanation Host-to-host tunnel topology is the correct answer. In a host-to-host tunnel topology, individual devices establish a secure tunnel between each other over a public network. This type of VPN is typically used for secure communication between specific hosts or endpoints, which is exactly what the team members need in this scenario. Client-to-site VPN technology is typically used when individual users need to securely connect to a private network from a remote location. In this scenario, the team members need to establish secure communication channels with specific systems, not the entire network. A site-to-site VPN topology is used to connect two or more geographically separate networks over a public network such as the Internet. This is typically used by businesses with multiple branch offices or organizations that must securely connect with external partners, not for secure communication between specific hosts or endpoints. While VNC allows for remote control of another computer, it does not inherently provide the secure, encrypted tunnels needed for this scenario. VNC is a type of remote desktop software, not a remote access architecture. It would allow the team members to control the specific systems, but it would not provide the secure communication channels they need. Related Content 4.8.1 Remote Access https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 87/115 10/15/25, 11:31 PM Individual Response 4.8.2 Remote Access Facts 5.3.4 Screened Subnet Facts 5.5.4 Configure a Remote Access VPN 5.5.5 Configure a VPN Connection iPad 5.5.6 Configure Remote Access, non VPN 5.5.7 Virtual Private Network Facts 5.5.8 VPN Protocol Facts 8.2.1 File Server Security 8.2.2 File System Security Facts 8.7.2 Secure Protocol Facts 8.7.6 IPsec Facts 10.2.5 Virtual Networking Facts resources\questions\q_remote_acc_host_to_host_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 88/115 10/15/25, 11:31 PM Individual Response Question 70 Correct You are the IT manager of a company that develops its own software applications. You've been tasked with enhancing the security of these applications. You decide to implement application vulnerability scanning. What is the MOST effective way to proceed? Implement application vulnerability scanning and immediately halt all development activities until all identified vulnerabilities are addressed. Implement application vulnerability scanning but ignore minor vulnerabilities identified. Implement application vulnerability scanning only for applications that have previously been compromised. Implement application vulnerability scanning without informing the development team. Implement application vulnerability scanning and provide comprehensive training to the development team on the process and how to address identified Correct vulnerabilities. Explanation https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 89/115 10/15/25, 11:31 PM Individual Response Implementing application vulnerability scanning and providing comprehensive training to the development team on the process and how to address identified vulnerabilities is the most effective way to proceed as it not only introduces a method to identify vulnerabilities but also ensures that the development team is equipped to address these vulnerabilities. Training and clear communication are key to ensuring that the solution is used effectively and that vulnerabilities are properly addressed. Implementing application vulnerability scanning only for applications that have previously been compromised could leave other applications exposed to potential vulnerabilities. It's important to scan all applications to ensure comprehensive security. Implementing application vulnerability scanning without informing the development team could lead to confusion and resistance among the development team. It's important to communicate changes and provide clear guidelines. Implementing application vulnerability scanning but ignoring minor vulnerabilities identified could leave the applications exposed to potential security risks. Even minor vulnerabilities can be exploited and should be addressed. Implementing application vulnerability scanning and immediately halting all development activities until all identified vulnerabilities are addressed is not very effective. While addressing vulnerabilities is important, halting all development activities could disrupt the company's operations. It's important to find a balance between addressing vulnerabilities and maintaining productivity. Related Content 5.8.1 Network Application Security 5.8.2 Configure Application Control Software 5.8.3 Network Application Facts 7.2.1 Vulnerability Scanning 7.2.5 Vulnerability Scanning Facts 8.9.1 Development Life Cycle 8.9.3 SDLC and Development Facts resources\questions\q_net_app_training_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 90/115 10/15/25, 11:31 PM Individual Response Question 71 Correct After implementing the National Institute of Standards and Technology (NIST) Cybersecurity Framework, the chief information security officer (CISO) is assessing the company's security posture to identify deficiencies from the framework's recommendations. What process can the CISO run to get a better sense of what the company needs to improve upon? Penetration test Implement disaster recovery plan Implement business continuity plan Gap analysis Correct Explanation The CISO would be preparing a gap analysis report. This report shows the defects in the company's current security posture against the NIST Cybersecurity Framework (or any other baseline security framework). A business continuity plan would significantly improve security posture, but the CISO is verifying what currently exists, not what should exist. The CISO would not be performing a penetration test. However, this task may show up as a remediation step during a gap analysis report. Like penetration testing, a disaster recovery plan would likely be a remediation step for any defects the CISO finds during the analysis. Related Content 4.1.1 Fundamental Security Concepts 4.1.2 Access Control Facts 5.6.2 Network Access Control Facts resources\questions\q_acc_ctrl_gap_analysis_01_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 91/115 10/15/25, 11:31 PM Individual Response Question 72 Correct You are a security architect for a large organization that uses various cloud services. The organization wants to implement a system that allows users to authenticate once and then access multiple applications, with the system providing information about the user to the applications. The system should be able to work across multiple platforms and authentication systems. Which solution would you recommend? Local authentication Claims-based identity Correct Password-based authentication Network authentication Explanation Claims-based identity is the correct answer. In a claims-based identity system, an identity provider issues a token containing claims about the user (such as the user's name, role, or privileges) to the user's browser. The user's browser then presents this token to applications, which use the claims to decide what the user is allowed to do. This system can work across multiple platforms and authentication systems. Local authentication is incorrect because local authentication is used to authenticate a user to a specific system or application. It does not provide a way for users to authenticate once and then access multiple applications. Network authentication is incorrect because network authentication is used to authenticate a user to a network. It does not provide a way for users to authenticate once and then access multiple applications. Password-based authentication is incorrect because password-based authentication is a method of authenticating a user based on something the user knows (their password). It does not provide a way for users to authenticate once and then access multiple applications. Related Content 4.2.3 Authentication Methods 4.2.4 Authentication Methods Facts https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 92/115 10/15/25, 11:31 PM Individual Response 4.9.1 Network Authentication Protocols 4.9.2 Network Authentication Facts resources\questions\q_authent_methods_claims-based_sec8.question.xml Question 73 Correct Which of the following is true about or according to Kerckhoff's Principle? This principle conflicts with Shannon's Maxim. The key should be the only thing that must be kept secret. Correct The system should be designed to facilitate easy changes to the encryption algorithms. Cryptosystems should remain secure even when the attacker knows all internal details of the system. Correct https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 93/115 10/15/25, 11:31 PM Individual Response Question 74 Correct To answer this question, complete the lab using the information below. You have already answered this question. You are not allowed to view the lab again. You completed the lab correctly. View Lab Report You are an IT security administrator for a small corporate network. To increase security for the corporate network, you have installed the pfSense network security appliance in your network. Now you need to configure the device. In this lab, your task is to configure pfSense as follows: Sign in to pfSense using the following case-sensitive information: URL: 198.28.56.22 Username: admin Password: P@ssw0rd Configure the DNS servers as follows: Primary DNS server: 163.128.78.93 - Hostname: DNS1 Secondary DNS server: 163.128.80.93 - Hostname: DNS2 Configure the WAN IPv4 information as follows: Enable the interface. Use a static IPv4 address of 65.86.24.136/8 Add a new gateway using the following information: Type: Default gateway Name: WANGateway IP address: 65.86.1.1 Launch Lab Related Content 5.1.2 Enterprise Network Architecture Facts 5.2.1 Security Appliances https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 94/115 10/15/25, 11:31 PM Individual Response 5.2.3 Security Solution Facts 5.2.8 Configure Network Security Appliance Access 5.2.12 Configure Load Balancer 6.3.1 Intrusion Detection 6.3.2 IDS Facts 6.3.3 Implement Intrusion Detection and Prevention 6.3.4 Implement Intrusion Prevention 7.3.3 SIEM and SOAR 8.6.5 Hardening a Wireless Access Point 8.6.7 Configure WIPS 8.8.4 Zero Day Application Attacks 9.2.1 Security Information and Event Management 9.2.3 SIEM and Log Management Facts 9.2.6 Use Elasticsearch Logstash Kibana 9.4.2 Redundancy Facts 9.4.4 Clustering Facts 10.1.2 Load Balancing with Virtualization 10.1.3 Virtualization Facts l_pfsense_wan_secp8.js https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 95/115 10/15/25, 11:31 PM Individual Response Question 75 Correct Which of the following statements are true about security? The security of a valuable system must be safeguarded at all costs. Effective defense requires as many layers as possible, utilizing all available technologies. An entity should have no more permissions than necessary to do its job. Even with seemingly perfect attack prevention, detection and recovery mechanisms must be in place. Correct Correct Security can be achieved by concealing the system's design. Each and every access point to the system must be monitored and protected. Correct Adding security to a system later is as effective as building it in from the start. Operations run best when one entity carries full responsibility. https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 96/115 10/15/25, 11:31 PM Individual Response Question 76 Correct You have a company network that is connected to the internet. You want all users to have internet access, but you need to protect your private network and users. You also need to make a web server publicly available to internet users. Which solution should you use? Use firewalls to create a screened subnet. Place the web server inside the screened subnet and the private Correct network behind the screened subnet. Use a single firewall. Put the web server and the private network behind the firewall. Use firewalls to create a screened subnet. Place the web server and the private network inside the screened subnet. Use a single firewall. Put the web server in front of the firewall and the private network behind the firewall. Explanation A screened subnet is a buffer network (or subnet) that sits between the private network and an untrusted network such as the internet. A common configuration uses two firewalls, one connected to the public network and one connected to the private network. Publiclyaccessible resources (servers) are placed inside the screened subnet. Examples of publiclyaccessible resources include web, FTP, or email servers. Private resources that are not accessible from the internet are placed behind the screened subnet (behind the inner firewall). Placing the web server inside the private network would mean opening ports in the firewall leading to the private network, which could expose other devices to attack. Placing the web server outside of the firewall would leave it unprotected. Related Content 5.2.5 Security Zone Facts 5.3.3 Configure a Screened Subnet 5.3.4 Screened Subnet Facts 5.4.2 Firewall Facts resources\questions\q_dmz_firewall_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 97/115 10/15/25, 11:31 PM Individual Response Question 77 Correct To answer this question, complete the lab using the information below. You have already answered this question. You are not allowed to view the lab again. You completed the lab correctly. View Lab Report You are the IT security administrator for a small corporate network. You need to increase the security on the switch in the Networking Closet by creating an access control list. You have been asked to prevent video game consoles from connecting to the switch. In this lab, your task is to: Create a MAC-based ACL named GameConsoles. Configure the GameConsoles MAC-based access control entry (ACE) settings as follows: Destination Priority Action 1 Deny Any 2 Deny Any 3 Deny Any 4 Deny Any 5 Deny Any 6 Deny Any MAC Address Source MAC Address Value: 00041F111111 Mask: 000000111111 Value: 005042111111 Mask: 000000111111 Value: 000D3A111111 Mask: 000000111111 Value: 001315111111 Mask: 000000111111 Value: 0009BF111111 Mask: 000000111111 Value: 00125A111111 Mask: 000000111111 https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 98/115 10/15/25, 11:31 PM Individual Response Bind the GameConsoles ACL to all of the GE1-GE30 interfaces. Use Copy Settings to apply the binding to multiple interfaces. Save the changes to the switch's startup configuration file. Use the default settings. Launch Lab Related Content 5.7.6 Secure a Switch 5.9.1 Switch Features 5.9.2 Securing Network Switches 5.9.3 Switch Security Facts 5.9.4 Switch Attacks 5.9.5 Switch Attack Facts 5.9.6 Hardening a Switch 5.9.7 Harden a Switch 5.9.8 Secure Access to a Switch l_switch_secure_access2_secp8.js https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 99/115 10/15/25, 11:31 PM Individual Response Question 78 Partial Which of the following are control categories? (Select four.) Physical Correct Managerial Correct Deterrent Preventative Technical Incorrect Correct Compensating Operational Incorrect Correct Explanation Control categories are: Managerial controls (consist of management techniques and administrative procedures) Operational controls (performed everyday by the security team) Technical controls (based around software, applications, and security appliances) Physical controls (alarms, locks, and cameras) The remaining items are all control types. Control types consist of different strategies to prevent, detect, mitigate, and correct any network breach. Related Content resources\questions\q_ctrl_cattypes_categories_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 100/115 10/15/25, 11:31 PM Individual Response Question 79 Incorrect You are a system administrator at a software company. You have been tasked with verifying the integrity of a large software update file that has been downloaded from the internet. The software provider has provided a SHA256 hash of the file for verification purposes. You decide to use the Get-FileHash command in PowerShell to calculate the hash of the downloaded file. Which of the following scenarios best demonstrates the correct use of the Get-FileHash command for this purpose? You use the Get-FileHash command to calculate the hash of the downloaded file and send it to the software provider for verification. You use the Get-FileHash command to calculate the hash of the downloaded file and compare it with the hash of the original file on your system. If the hashes match, you assume the file has not been tampered with. You use the Get-FileHash command to calculate the hash of the downloaded file and compare it with the hash of another file downloaded from the internet. If the hashes match, you assume the file has not been Incorrect tampered with. You use the Get-FileHash command to calculate the hash of the downloaded file and compare it with the hash provided by the software provider. If the hashes match, Correct you assume the file has not been tampered with. Explanation https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 101/115 10/15/25, 11:31 PM Individual Response The proper use of the Get-FileHash command is for verifying the integrity of a file. By calculating the hash of the downloaded file and comparing it with the hash provided by the software provider, you can verify that the file has not been tampered with during download. The software provider has already provided a hash for verification purposes. You should not need to send your calculated hash back to them for verification. Comparing the hash of the downloaded file with the hash of the original file on your system will not verify the integrity of the downloaded file. The original file on your system may not be the same version as the downloaded file, so their hashes may not match even if the downloaded file has not been tampered with. Comparing the hash of the downloaded file with the hash of another file downloaded from the internet will not verify the integrity of the downloaded file. The two files are likely to be different, so their hashes should not match. Related Content 3.1.1 Cryptography Concepts 3.1.2 Cryptography Facts 3.2.4 Cryptographic Implementation Facts 3.3.1 Hashing 3.3.3 Hashing Facts 3.3.4 Using Hashes 3.3.5 Compare an MD5 Hash 6.6.2 Password Attack Facts resources\questions\q_cryp_hash_get-filehash_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 102/115 10/15/25, 11:31 PM Individual Response Question 80 Incorrect To answer this question, complete the lab using the information below. You have already answered this question. You are not allowed to view the lab again. You did not complete the lab correctly. View Lab Report You are the IT administrator for a small corporate network. You recently added an Active Directory domain to the CorpDC server to manage network resources centrally. You now need to add user accounts in the domain. In this lab, your task is to create the following user accounts on CorpDC: User Job Role Departmental OU Juan Suarez Marketing manager Marketing\MarketingManagers Susan Smith Permanent sales employee Sales\PermSales Mark Burnes Sales manager Sales\SalesManagers Temporary sales employee Sales\TempSales Borey Chan Use the following user account naming standards and specifications as you create each account: Create the user account in the departmental OU corresponding to the employee's job role. User account name: First name + Last name Logon name: firstinitial + lastname with @CorpNet.local as the domain Original password: asdf1234$ (must change after the first logon) Configure the following for the temporary sales employee: Limit the logon hours to allow logon only from 8:00 a.m. to 5:00 p.m., Monday through Friday. Set the user account to expire on December 31st of the current year. https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 103/115 10/15/25, 11:31 PM Individual Response Launch Lab Related Content 4.4.1 Active Directory Introduction 4.4.12 Manage User Accounts 4.4.13 Create a Group 4.4.14 Create Global Groups 8.1.3 Hardening an Operating System l_actdir_user1_secp8.js https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 104/115 10/15/25, 11:31 PM Individual Response Question 81 Correct You are a security administrator for a large organization that uses Kerberos for authentication. One day, you receive a call from a user who is having trouble accessing a specific service on the network. You suspect that the issue might be related to the Kerberos service ticket. Which of the following steps should you take first to troubleshoot this issue? Request a new Ticket Granting Ticket (TGT) for the user. Check the expiration time of the user's service ticket. Correct Change the user's password in the Kerberos database. Invalidate all active service tickets for the user. Explanation The first step in troubleshooting should be to check the expiration time of the user's service ticket. Kerberos service tickets have a limited lifespan for security reasons. If the service ticket has expired, the user will need to request a new one. Invalidating all active service tickets for the user is a drastic step that could disrupt the user's access to other services. This should not be the first step in troubleshooting. Requesting a new Ticket Granting Ticket (TGT) for the user is not necessary if the problem is specifically with the service ticket. The TGT is used to obtain service tickets, but it is not directly involved in accessing services. Changing the user's password in the Kerberos database is a drastic step that could disrupt the user's access to the network. This should not be the first step in troubleshooting, and it is not directly related to the service ticket. Related Content resources\questions\q_authorize_service_ticket_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 105/115 10/15/25, 11:31 PM Individual Response Question 82 Correct A data center must enhance its security measures to prevent unauthorized access to its facility. The center are considering different methods to achieve this goal. What should the data center implement first to ensure a strong physical barrier against intrusions? Biometric authentication Security guard patrols Fencing Correct Video surveillance Explanation Fencing serves as a first line of defense in physical security, creating a physical barrier that prevents or discourages unauthorized access to the facility. It not only restricts intrusions but also acts as a psychological deterrent. Biometric authentication effectively controls access inside the data center, although it is not a primary physical barrier against intrusions from outside. Security guard patrols are not considered a physical barrier and thus do not provide the initial deterrence that fencing does. Video surveillance is not a physical barrier to entry and therefore does not provide the initial deterrence that fencing offers. Related Content 6.1.1 Physical Security 6.1.2 Physical Security Facts resources\questions\q_phys_sec_fencing_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 106/115 10/15/25, 11:31 PM Individual Response Question 83 Correct An employee at a company frequently recycles old passwords when prompted for a password change. What feature of a password policy can prevent this? Password complexity Password history Correct Password age Password length Explanation The password history attribute keeps track of previously used passwords and prevents employee from using them again, discouraging password recycling. Password length refers to the minimum (and sometimes maximum) length that a password should have. It does not prevent the reuse of old passwords. Password complexity enforces rules like a mix of characters, numbers, and symbols. It does not prevent the reuse of old passwords. Password age is the length of time an employee can use a password before it expires, and the employee must choose a new one. It does not prevent the reuse of old passwords. Related Content 4.5.3 Configure Account Policies and UAC Settings 4.5.5 Configure Account Password Policies 4.5.10 Hardening Authentication Facts 4.6.13 Linux User Security and Restriction Facts 5.7.3 Searching for Default Passwords 11.1.1 Program Management and Oversight Overview resources\questions\q_harden_auth_password_history_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 107/115 10/15/25, 11:31 PM Individual Response Question 84 Correct Upon reviewing the results of an organizational assessment, the cyber team implements various remediation practices to safeguard the company's data. What remediation practices include the division of a network into separate pieces to contain an attack or attempted breach within one piece of the network? Segmentation Correct Compensating controls Patching Insurance Explanation In this instance, segmentation involves dividing a network into separate pieces to contain potential security breaches. Not relevant here, compensating controls refer to measures put in place to mitigate the risk of a vulnerability when security teams cannot directly eliminate it or when direct remediation is not immediately possible. Additionally, patching is one of the most straightforward and effective remediation practices. It involves applying updates and patches to software or systems to fix known vulnerabilities. Insurance provides financial protection in case of a security breach resulting from a vulnerability and is important in a comprehensive risk management strategy, complementing technical controls with financial risk transfer. Related Content 5.9.1 Switch Features 5.9.2 Securing Network Switches 5.9.3 Switch Security Facts 5.9.6 Hardening a Switch 5.10.3 Router Security Facts resources\questions\q_router_sec_segmentation_03_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 108/115 10/15/25, 11:31 PM Individual Response Question 85 Correct The cybersecurity manager of a large organization is investigating a recent security breach that occurred during office hours. Investigatory research shows that the suspect convinced the janitor to let them inside the building because they had forgotten their badge at home. Once inside, the suspect pulled the fire alarm and accessed the building's network room amongst the chaos. The intruder then attached a monitoring device to a network port before escaping unnoticed. Which of the following is the social engineering technique the threat actor employed in this scenario? Impersonation Pretexting Correct Vishing Pharming Explanation The threat actor used pretexting as a social engineering technique. They triggered a fire alarm to create a distraction and a convincing pretext to gain physical access to the network room, attaching a monitoring device to a network port. Vishing is a phishing attack conducted through a voice channel (telephone or VoIP). There is no involvement of voice communication in this scenario, just a physical intrusion. Impersonation with persuasive techniques involves convincing the target that the request is natural and without refusal. In this scenario, there is no indication of the threat actor persuading someone to act. Pharming is a technique that redirects users from a legitimate website to a malicious one. It is irrelevant to this physical intrusion scenario. Related Content 2.2.3 Social Engineering Techniques 2.2.4 Social Engineering Techniques Facts resources\questions\q_social_engr_tqs_pretexting_02_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 109/115 10/15/25, 11:31 PM Individual Response Question 86 Correct You are attempting to delete the temp group but are unable to. Which of the following is the MOST likely cause? The secondary group of an existing user cannot be deleted. All users have already been deleted. The primary group of an existing user cannot be deleted. Correct Groups cannot be deleted. Explanation You cannot remove the primary group of any existing user. You must remove the user before you remove the group. Deleting all users would not prevent a group from being deleted. Groups can be deleted using the groupdel command. Secondary groups of a user can be deleted. This event would not prevent a group from bring deleted. Related Content 4.1.5 Access Control Model Facts 4.5.7 Restrict Local Accounts 4.5.8 Secure Default Accounts 4.5.10 Hardening Authentication Facts 4.6.1 Linux User and Group Overview 4.6.2 Managing Linux Users 4.6.3 Linux User Commands and Files 4.6.4 Create a User Account 4.6.6 Delete a User 4.6.9 Lock and Unlock User Accounts https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 110/115 10/15/25, 11:31 PM Individual Response 4.7.2 Linux Group Commands 4.7.3 Rename and Create Groups 4.7.4 Add Users to a Group 4.7.5 Remove a User from a Group 5.7.2 Device Vulnerability Facts 8.1.3 Hardening an Operating System 8.2.2 File System Security Facts 8.9.4 Version Control Management resources\questions\q_linux_grps_cmds_primary_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 111/115 10/15/25, 11:31 PM Individual Response Question 87 Incorrect A company wants to improve the physical security at its headquarters. They need a solution that can help regulate access to the building and deter potential intruders during nighttime. Which physical security measure should they prioritize? Enhanced lighting Incorrect Closed-circuit television (CCTV) Access control vestibule Correct Perimeter fencing Explanation An access control vestibule is a two-door system where the first door must close before the second opens, effectively controlling and managing access to the building. Lighting can deter potential intruders during nighttime by illuminating dark areas, but it does not regulate access to the building. CCTV can provide surveillance and record activity around the building, but it does not regulate access to the building. CCTV provides a way to monitor and record activities but does not control who can enter the building. Perimeter fencing can deter potential intruders and control access to a property to an extent. However, it does not regulate access to the building in a controlled manner as an access control vestibule does. Related Content 6.1.1 Physical Security 6.1.2 Physical Security Facts resources\questions\q_phys_sec_vestibule_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 112/115 10/15/25, 11:31 PM Individual Response Question 88 Correct The cybersecurity team at a multinational corporation is collaborating with the facilities department to design a new data center. The team seeks to integrate top-tier physical security controls into the site layout to maximize protection against potential threats. The discussions revolve around the BEST strategies to ensure the safety of the data center. When designing the physical security controls for the site layout of the new data center, which strategy would be MOST effective in deterring unauthorized access and providing a comprehensive security layer? Establishing a security perimeter with layered access controls Correct Implementing a single, fortified main entrance Placing all servers near windows for easy maintenance Distributing security personnel evenly throughout the premises Explanation Layered access controls, often referred to as "defense in depth," ensure that multiple levels of security mechanisms are in place. If one fails or gets bypassed, others still provide protection. While a fortified entrance can be a strong deterrent, relying solely on one point of entry without layered controls can lead to vulnerabilities. Single points of failure are generally not advisable. Positioning servers near windows can expose them to potential threats, such as visual hacking or physical breaches. It is counterproductive from a security perspective. While security personnel are important, their distribution should be strategic, focusing on critical points rather than a mere even spread. Layered access controls would still be more effective. Related Content resources\questions\q_phys_sec_layered_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 113/115 10/15/25, 11:31 PM Individual Response Question 89 Correct Social engineers are master manipulators. Which of the following are tactics they might use? Eavesdropping, ignorance, and threatening Keylogging, shoulder surfing, and moral obligation Shoulder surfing, eavesdropping, and keylogging Moral obligation, ignorance, and threatening Correct Explanation Social engineers are master manipulators. Some of the most popular tactics they use are moral obligation, innate human trust, threatening, an easy reward, and ignorance. Social engineering attacks include shoulder surfing, eavesdropping, USB and keyloggers, spam and spim, and hoaxes. Related Content resources\questions\q_social_engr_ovw_intim_secp8.question.xml https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 114/115 10/15/25, 11:31 PM Individual Response Question 90 Correct Which of the following security actions represents a non-intrusive scanning type of framework? Vulnerability scanning Correct Keylogger Penetration testing Access control list (ACL) Explanation Whether they use purely passive techniques or some sort of active session or agent, vulnerability scanners represent a non-intrusive scanning type. The scanner identifies vulnerabilities in its database by analyzing things such as build and patch levels or system policies. Penetration testing that uses exploitation frameworks are "active" and "intrusive" and detectable. An ACL is a list of permissions associated with a network object, such as a router or a switch, that controls traffic at a network interface level. An ACL is not a type of framework. A keylogger is spyware that actively attempts to steal confidential information by recording keystrokes. The attacker will usually hope to discover passwords or credit card data. It is not a framework in itself. Related Content resources\questions\q_net_app_vuln_scan_secp8.question.xml Copyright © CompTIA, Inc. All rights reserved. https://platform.comptia.org/v6_0_696/index.html/my-courses?campus=a8844aac-d69a-42ed-9844-5f1935936981 115/115