CompTIA Security + (Part 1)

Front

What should a financial services company do when decommissioning servers with sensitive financial information, considering the need for secure data destruction, regulatory compliance, and environmental sustainability?

Back

Degaussing the servers, rendering the data irretrievable, followed by reselling or recycling the servers after certification.

Answer explanation

Degaussing effectively destroys data by demagnetizing the drives, ensuring irretrievability. This method aligns with the company's data protection policy and allows for environmentally responsible reselling or recycling after certification.

Front

A group of threat actors disrupts the online services of an oil company due to their disagreement with the company's environmental policies. They believe their actions can force the company to change its practices. This type of threat actor is primarily driven by what kind of motivation?

Back

Political/philosophical beliefs

Answer explanation

The threat actors are motivated by their political/philosophical beliefs regarding environmental policies, aiming to influence the company's practices through disruption.

Front

What is the primary role of the Change Management Board (CMB) in the educational institution's digital transformation project?

Back

Assessing, approving, and managing changes in the IT infrastructure

Answer explanation

The primary role of the Change Management Board (CMB) is to assess, approve, and manage changes in the IT infrastructure, ensuring a smooth transition to the digital learning system.

Front

What is the primary role of the Change Management Board (CMB) in the educational institution's digital transformation project?

Back

Assessing, approving, and managing changes in the IT infrastructure

Answer explanation

The primary role of the Change Management Board (CMB) is to assess, approve, and manage changes in the IT infrastructure, ensuring a smooth transition to the digital learning system.

Front

What configuration consideration can ensure that systems and devices within an organization's network adhere to mandatory security configurations?

Back

Configuration enforcement

Answer explanation

Configuration enforcement ensures that all systems and devices comply with mandatory security settings, preventing unauthorized changes and maintaining security integrity, especially after a data exfiltration incident.

Front

What is the primary advantage of using a CSR and a third-party CA for obtaining digital certificates compared to other methods?

Back

Digital certificates obtained through a Certificate Signing Request and a third-party Certificate Authority have a higher level of trust and recognition within the industry.

Answer explanation

Digital certificates from a CSR and third-party CA are widely recognized and trusted, enhancing security and credibility within the industry compared to self-signed certificates or internal CAs.

Front

CloudSecure is facing a cybersecurity challenge where some of its critical software applications are no longer supported by vendors, making them vulnerable to potential exploits. The IT team is exploring various strategies to mitigate the risk posed by these unsupported apps. What’s the MOST effective approach to enhance the security posture?

Back

Isolating the unsupported apps from other systems to reduce the attack surface.

Answer explanation

Isolating the unsupported apps reduces their exposure to potential attacks, effectively minimizing the risk. This approach is more secure than ignoring vulnerabilities or consolidating systems, which could increase risk.

Front

A company is looking to expand its business into new markets despite associated risks. It prepares to accept higher risks for potentially higher returns. Which approach BEST meets the company's risk management approach parameters?

Back

Risk appetite

Answer explanation

The company is willing to accept higher risks for potentially higher returns, which aligns with the concept of risk appetite. This term refers to the level of risk an organization is prepared to take to achieve its objectives.

Front

A global financial institution with a vast network of offices and data centers has faced increasing cybersecurity threats. The organization's IT team realizes that privileged accounts are a prime target for hackers, and manually managing them poses a significant risk. The company implemented a Privileged Access Management (PAM) solution to strengthen its security posture. As part of the implementation, the IT team focuses on password vaulting, a critical component of PAM. As part of the advanced PAM implementation, what is the primary purpose of password vaulting?

Back

Securely store and manage privileged account credentials

Answer explanation

The primary purpose of password vaulting in a PAM solution is to securely store and manage privileged account credentials, reducing the risk of unauthorized access and enhancing overall security.

Front

A network administrator configures the security for data transmitted by employees working remotely. The data includes personal employee information such as addresses and phone numbers. Which category does this scenario BEST fit? Options: Confidential, Private, Regulated, Public

Back

Private

Answer explanation

The scenario involves securing personal employee information, which is sensitive but not subject to regulatory requirements. Therefore, it best fits the 'Private' category, as it pertains to personal data that should be protected.