A security engineer is reviewing event logs because an employee successfully connected a personal Windows laptop to the corporate network, which is against company policy. Company policy allows all Windows 10 and 11 laptops to connect to the system as long as the MDM agent installed by IT is running. Only compliant devices can connect, and the logic in the system to evaluate compliant laptops is as follows:
```python
if laptop['OsVersion'] >= 10:
if laptop['agentRunning']:
return COMPLIANT
else:
return NON_COMPLIANT
else:
return COMPLIANT
```
Which of the following most likely occurred when the employee connected a personally owned Windows laptop and was allowed on the network?
A.The agent was not running on the laptop, which triggered a false positive.
B.The OS was a valid version, but the MDM agent was not installed, triggering a true positive.
C.The OS was running a Windows version below 10 and triggered a false negative.Correct
D.The OS version was higher than 11, and the MDM agent was running, triggering a true negative.
Explanation
The else branch returns COMPLIANT for any OS version below 10, so an old, unmanaged Windows laptop is accepted without any agent check. The system failed to detect a noncompliant device, which is a false negative. If the OS were version 10 or higher without a running agent, the logic would correctly return NON_COMPLIANT and block it, so options A and B do not explain the laptop being allowed. Option D describes a device that really is compliant, not a policy violation.
An organization is working to secure its development process to ensure developers cannot deploy artifacts directly into the production environment. Which of the following security practice recommendations would be the best to accomplish this objective?
A.Implement least privilege access to all systems.
B.Roll out security awareness training for all users.
C.Set up policies and systems with separation of duties.Correct
D.Enforce job rotations for all developers and administrators.
E.Utilize mandatory vacations for all developers.
F.Review all access to production systems on a quarterly basis.
Explanation
Separation of duties splits writing code from releasing it, so a developer cannot push their own artifacts into production without another role (release or operations) approving and deploying them. Least privilege helps but does not by itself define the split between development and deployment roles. Training, job rotation, mandatory vacations and quarterly access reviews are detective or administrative measures that do not stop a direct deployment.
A security architect discovers the following while reviewing code for a company's website:
```
selection = "SELECT Item FROM Catalog WHERE ItemID = " & Request("ItemID")
```
Which of the following should the security architect recommend?
A.Client-side processing
B.Query parameterizationCorrect
C.Data normalization
D.Escape character blocking
E.URL encoding
Explanation
The code concatenates user input straight into a SQL statement, which allows SQL injection. Parameterized queries (prepared statements) send the input as data, separate from the SQL command, so it can never change the query's structure. Client-side processing can be bypassed, escaping or blocking characters is error-prone and incomplete, and URL encoding and data normalization do not stop injection.
A security architect needs to enable a container orchestrator for DevSecOps and SOAR initiatives. The engineer has discovered that several Ansible YAML files used for the automation of configuration management have the following content:
```
$ hostnamectl
COMPTIA001
$ cat /etc/ansible/ansible.cfg
[inventory]
enable_plugins = kubernetes.core.k8s
$ cat /etc/ansible/projects/roles/k8/default/main.yml
---
- Name: Create a Kubernetes Service Objects
kubernetes.core.k8s:
state: present
definition:
apiVersion: v2
kind: Service
$ cat /etc/kubernetes/manifests
insecure-bind-address "localhost"
```
Which of the following should the engineer do to correct the security issues presented within this content?
A.Update the kubernetes.core.k8s module to kubernetes.core.k8s_service in the main.yml file.
B.Update the COMPTIA001 hostname to localhost using the hostnamectl command.
C.Update the state: present module to state: absent in the main.yml file.
D.Update or remove the ansible.cfg file.
E.Update the insecure-bind-address from localhost to the COMPTIA001 in the manifests file.Correct
Explanation
The security-relevant item in the exhibit is the insecure-bind-address setting in the Kubernetes manifest, which controls where the API server's unauthenticated HTTP port listens, so that is the line to correct. The other options change functional details: the module name, the hostname, the desired state of the Service object and the inventory plugin setting do not address a security weakness. Be aware that current Kubernetes releases have removed the insecure port entirely, and in practice the safest fix is to delete this flag rather than bind it to a network-reachable host name.
A CRM company leverages a CSP PaaS service to host and publish its SaaS product. Recently, a large customer requested that all infrastructure components must meet strict regulatory requirements, including configuration management, patch management, and life-cycle management. Which of the following organizations is responsible for ensuring those regulatory requirements are met?
A.The CRM companyCorrect
B.The CRM company's customer
C.The CSP
D.The regulatory body
Explanation
The CRM company is the service provider to its customer and remains accountable for compliance of the SaaS product, even though it delegates some infrastructure operations to the CSP. Under the shared responsibility model, the CRM company must choose a compliant PaaS provider, verify the CSP's attestations and contract terms, and manage the parts it controls. The CSP performs patching of the platform it runs but has no obligation to the CRM company's customer, and neither the customer nor the regulator is responsible for meeting the requirements.
Company A is merging with Company B. Company A is a small, local company. Company B has a large, global presence. The two companies have a lot of duplication in their IT systems, processes, and procedures. On the new Chief Information Officer's (CIO's) first day, a fire breaks out at Company B's main data center. Which of the following actions should the CIO take first?
A.Determine whether the incident response plan has been tested at both companies, and use it to respond.
B.Review the incident response plans, and engage the disaster recovery plan while relying on the IT leaders from both companies.Correct
C.Ensure hot, warm, and mobile disaster recovery sites are available, and give an update to the companies' leadership teams.
D.Initiate Company A's IT systems processes and procedures, assess the damage, and perform a BIA.
Explanation
A fire that takes out a main data center is a disaster, so the CIO should invoke the existing plans immediately and lean on the IT leaders who know each company's environment. Checking whether plans were tested (A) wastes time during an active event. Option C assumes recovery sites of every type exist rather than acting on the plan, and option D imposes the smaller company's processes on the larger company's systems and starts a BIA, which should have been done before a disaster.
The results of an internal audit indicate several employees reused passwords that were previously included in a published list of compromised passwords.
The company has the following employee password policy:
| Attribute | Requirement |
|---|---|
| Complexity | Enabled |
| Character class | Special character, number |
| Length | 10 characters |
| History | 8 |
| Maximum age | 60 days |
| Minimum age | 0 |
Which of the following should be implemented to best address the password reuse issue? (Choose two.)
A.Increase the minimum age to two days.Correct
B.Increase the history to 20.Correct
C.Increase the character length to 12.
D.Add case-sensitive requirements to character class.
E.Decrease the maximum age to 30 days.
F.Remove the complexity requirements.
G.Increase the maximum age to 120 days.
Explanation
Password reuse is controlled by password history combined with a minimum password age. With a minimum age of 0, users can change their password several times in a row to cycle past the history and return to an old password; a minimum age above zero stops that, and a longer history of 20 remembers more previous passwords. Longer length or extra character classes make passwords harder to guess but do not prevent reusing an old one, and changing the maximum age or removing complexity does nothing for reuse.
A mobile administrator is reviewing the following mobile device DHCP logs to ensure the proper mobile settings are applied to managed devices:
```
10,10/18/2021,17:01:05,Assign,192.168.1.10,UserA-MobileDevice,0236FB12CA0B
23,10/19/2021,07:11:19,Assign,192.168.1.23,UserA-MobileDevice,068ADIFAB109
10,10/20/2021,19:22:56,Assign,192.168.1.96,UserA-MobileDevice,0ABC65E81AB0
10,10/21/2021,22:34:15,Assign,192.168.1.33,UserA-MobileDevice,BAC034EF9451
10,10/22/2021,11:55:41,Assign,192.168.1.12,UserA-MobileDevice,0E938663221B
```
Which of the following mobile configuration settings is the mobile administrator verifying?
A.Service set identifier authentication
B.Wireless network auto joining
C.802.1X with mutual authentication
D.Association MAC address randomizationCorrect
Explanation
The same device, UserA-MobileDevice, receives a DHCP lease each day with a different MAC address, which is exactly what MAC address randomization (private Wi-Fi address) produces. SSID authentication, auto-joining and 802.1X mutual authentication are not visible in DHCP lease records, which show only the IP, host name and MAC address.
A security analyst is investigating a possible insider threat incident that involves the use of an unauthorized USB from a shared account to exfiltrate data. The event did not create an alert. The analyst has confirmed the USB hardware ID is not on the device allow list, but has not yet confirmed the owner of the USB device. Which of the following actions should the analyst take next?
A.Classify the incident as a false positive.
B.Classify the incident as a false negative.Correct
C.Classify the incident as a true positive.
D.Classify the incident as a true negative.
Explanation
Data was actually exfiltrated through an unauthorized USB device, yet no alert fired, so the detection control missed real malicious activity: that is a false negative. A false positive is an alert on benign activity, a true positive is an alert on real activity, and a true negative is correctly staying silent on benign activity. Confirming the device owner is a later investigative step and does not change the classification.
Which of the following security features do email signatures provide?
A.Non-repudiationCorrect
B.Body encryption
C.Code signing
D.Sender authentication
E.Chain of custody
Explanation
A digital signature on an email (for example S/MIME or PGP) is created with the sender's private key, which only the sender holds, so the sender cannot later deny having sent the message, and any change to the message breaks the signature. Non-repudiation is the security feature a signature is specifically used to provide; the signature also proves who signed the message, but that identity proof is what makes non-repudiation possible rather than a separate feature asked for here. Signing does not encrypt the body; that requires encryption with the recipient's public key. Code signing applies to software, and chain of custody is a forensic evidence-handling process.
A software development company wants to ensure that users can confirm the software is legitimate when installing it. Which of the following is the best way for the company to achieve this security objective?
A.Code signingCorrect
B.Non-repudiation
C.Key escrow
D.Private keys
Explanation
Code signing attaches a digital signature from the publisher's certificate to the software, so the installer can verify who published it and that it has not been altered since it was signed. Non-repudiation is a property that signing provides, not the mechanism itself. Key escrow is a key-recovery arrangement, and private keys alone are an ingredient of signing rather than a way for users to confirm legitimacy.
While performing mandatory monthly patch updates on a production application server, the security analyst reports an instance of buffer overflow for a new application that was migrated to the cloud and is also publicly exposed. Security policy requires that only internal users have access to the application. Which of the following should the analyst implement to mitigate the issues reported? (Choose two.)
A.Configure firewall rules to block all external traffic.Correct
B.Enable input validation for all fields.Correct
C.Enable automatic updates to be installed on all servers.
D.Configure the security group to enable external traffic.
E.Set up a DLP policy to alert for exfiltration on all application servers.
F.Enable nightly vulnerability scans.
Explanation
The application must be reachable only by internal users, so firewall rules that block all external traffic remove the public exposure. The buffer overflow is fixed at its root by validating input length and format on every field so oversized input never reaches memory unchecked. Enabling external traffic in the security group does the opposite of the policy, while automatic updates, DLP alerts and nightly scans may detect or reduce risk but do not mitigate either reported issue directly.
PKI can be used to support security requirements in the change management process. Which of the following capabilities does PKI provide for messages?
A.Non-repudiationCorrect
B.Confidentiality
C.Delivery receipts
D.Attestation
Explanation
When a message is signed with the sender's private key from a PKI-issued certificate, anyone can verify the signature with the matching public key, and the signer cannot credibly deny approving it. In change management this proves who requested or approved a change. PKI can also support confidentiality through encryption, but the capability the question targets for signed change messages is non-repudiation; delivery receipts and attestation are not PKI message capabilities.
Several unlabeled documents in a cloud document repository contain cardholder information. Which of the following configuration changes should be made to the DLP system to correctly label these documents in the future?
A.Digital rights management
B.Network traffic decryption
C.Regular expressionsCorrect
D.Watermarking
Explanation
Cardholder data such as primary account numbers follows predictable patterns, so a DLP system identifies and labels it using regular expressions (often combined with a Luhn checksum). Digital rights management and watermarking protect or mark content after it is classified, and network traffic decryption only lets the DLP inspect encrypted traffic; none of them recognizes the data at rest in the repository.
A systems administrator at a web-hosting provider has been tasked with renewing the public certificates of all customer sites. Which of the following would best support multiple domain names while minimizing the amount of certificates needed?
A.OCSP
B.CRL
C.SANCorrect
D.CA
Explanation
A Subject Alternative Name (SAN) certificate lists several domain names in one certificate, so one renewal can cover many customer sites. OCSP and CRL are ways to check whether a certificate has been revoked and do not cover extra names. A CA issues certificates but is not itself a way to reduce how many certificates are needed.
Which of the following best explain why organizations prefer to utilize code that is digitally signed? (Choose two.)
A.It provides origin assurance.Correct
B.It verifies integrity.Correct
C.It provides increased confidentiality.
D.It integrates with DRMs.
E.It verifies the recipient's identity.
F.It ensures the code is free of malware.
Explanation
A valid digital signature on code proves which publisher signed it (origin assurance) and that the code has not been modified since signing (integrity). Signing does not encrypt the code, so it adds no confidentiality, and it says nothing about the recipient. A signature also does not guarantee the code is free of malware, because signed code can still be malicious, and it is not tied to DRM.
A security engineer receives reports through the organization's bug bounty program about remote code execution in a specific component in a custom application. Management wants to properly secure the component and proactively avoid similar issues. Which of the following is the best approach to uncover additional vulnerable paths in the application?
A.Leverage an exploitation framework to uncover vulnerabilities.
B.Use fuzz testing to uncover potential vulnerabilities in the application.Correct
C.Utilize a software composition analysis tool to report known vulnerabilities.
D.Reverse engineer the application to look for vulnerable code paths.
E.Analyze the use of an HTTP intercepting proxy to dynamically uncover issues.
Explanation
Fuzz testing feeds large volumes of malformed and unexpected input into the component and its interfaces, which exercises many code paths and exposes the crashes and memory-handling flaws that typically lead to remote code execution. An exploitation framework only uses known exploits, and software composition analysis only reports known vulnerabilities in third-party libraries, so neither finds new flaws in custom code. Reverse engineering is unnecessary for the organization's own application, and an intercepting proxy is a manual, web-focused technique with far less coverage.
A security technician is investigating a system that tracks inventory via a batch update each night. The technician is concerned that the system poses a risk to the business, as errors are occasionally generated and reported inventory appears incorrect. The following output log is provided:
```
Starting Boxes = 20
Transaction Operation Running total
1 + 10 30
2 + 30 50
3 + 10 60
4 - 10 50
5 - 40 (Below zero balance!) -10
6 + 30 20
7 + 10 60
8 + 40 60
```
The technician reviews the output of the batch job and discovers that the inventory was never less than zero, and the final inventory was 100 rather than 60. Which of the following should the technician do to resolve this issue?
A.Ensure that the application is using memory-safe functions to prevent integer overflows.
B.Recommend thread-safe processes in the code to eliminate race conditions.Correct
C.Require the developers to include exception handlers to accommodate out-of-bounds results.
D.Move the batch processing from client side to server side to remove client processing inconsistencies.
Explanation
The running totals do not follow from the operations (for example, 20 + 30 is reported as 50 and 20 + 10 as 60), which shows several transactions reading and writing the shared total at the same time and overwriting each other's results. That is a race condition, fixed by making the updates thread-safe with synchronization or locking around the critical section. The values are small, so there is no integer overflow, and exception handlers or moving processing to the server would not stop concurrent updates from corrupting the total.
A programmer is reviewing the following proprietary piece of code that was identified as a vulnerability due to users being authenticated when they provide incorrect credentials:
```
GET USERID
GET PASS
JUMP TO :ALLOWUSER:
IF USERID == GETDBUSER(USERID) AND HASH(PASS) == GETDBPASS(USERID)
EXIT
:ALLOWUSER:
SET USERACL(USERID)
...
...
...
```
Which of the following should the programmer implement to remediate the code vulnerability?
A.Salted hashing via the proprietary SHASH function
B.Input validation in the first two lines of codeCorrect
C.Atomic execution of subroutines
D.TOCTOU remediation in SET USERACL
E.Database connection over encrypted channels
Explanation
The user ID and password are read in the first two lines and then used without any validation, so the flow reaches the ALLOWUSER label and grants access even when the supplied credentials are wrong. Validating the input when it is collected, and only continuing when the credentials are confirmed, closes that path. Salted hashing and encrypted database connections protect stored or transmitted credentials but do not change the flawed flow, and there is no shared resource or time gap that atomic execution or TOCTOU remediation would address.
A senior cybersecurity engineer is solving a digital certificate issue in which the CA denied certificate issuance due to failed subject identity validation. At which of the following steps within the PKI enrollment process would the denial have occurred?
A.RACorrect
B.OCSP
C.CA
D.IdP
Explanation
In PKI enrollment, the registration authority authenticates the subject and verifies its identity before passing the request to the CA for signing, so a failed identity validation is a denial at the RA step. The CA issues and signs certificates once the RA has approved the request. OCSP only reports the revocation status of certificates already issued, and an IdP authenticates users to applications, not to the certificate enrollment process.
Verifying access...
Access Required
You need to purchase this exam to access practice mode
Unlock a few more questions every day for 300 points you earn free on
Godlike Academy. Everything you unlock with the Daily Climb stays open for 7 days after your last unlock.