A security analyst is creating base for the server team to follow when hardening new devices for deployment. Which of the following beet describes what the analyst is creating?
Correct Answer: D
Question 282
Which of the following security control types does an acceptable use policy best represent?
Correct Answer: D
An acceptable use policy (AUP) is a set of rules that govern how users can access and use a corporate network or the internet. The AUP helps companies minimize their exposure to cyber security threats and limit other risks. The AUP also serves as a notice to users about what they are not allowed to do and protects the company against misuse of their network. Users usually have to acknowledge that they understand and agree to the rules before accessing the network1. An AUP best represents a preventive security control type, because it aims to deter or stop potential security incidents from occurring in the first place. A preventive control is proactive and anticipates possible threats and vulnerabilities, and implements measures to prevent them from exploiting or harming the system or the data. A preventive control can be physical, technical, or administrative in nature2. Some examples of preventive controls are: Locks, fences, or guards that prevent unauthorized physical access to a facility or a device Firewalls, antivirus software, or encryption that prevent unauthorized logical access to a network or a system Policies, procedures, or training that prevent unauthorized or inappropriate actions or behaviors by users or employees An AUP is an example of an administrative preventive control, because it defines the policies and procedures that users must follow to ensure the security and proper use of the network and the IT resources. An AUP can prevent users from engaging in activities that could compromise the security, performance, or availability of the network or the system, such as: Downloading or installing unauthorized or malicious software Accessing or sharing sensitive or confidential information without authorization or encryption Using the network or the system for personal, illegal, or unethical purposes Bypassing or disabling security controls or mechanisms Connecting unsecured or unapproved devices to the network By enforcing an AUP, a company can prevent or reduce the likelihood of security breaches, data loss, legal liability, or reputational damage caused by user actions or inactions3. Reference = 1: How to Create an Acceptable Use Policy - CoreTech, 2: [Security Control Types: Preventive, Detective, Corrective, and Compensating], 3: Why You Need A Corporate Acceptable Use Policy - CompTIA
Question 283
A user downloads a patch from an unknown repository... FIM alerts indicate OS file hashes have changed. Which attack most likely occurred?
Correct Answer: D
The scenario indicates that a user downloaded an unofficial patch, applied it, and afterward system files changed-detected by FIM. This strongly suggests the presence of a rootkit, which is designed to deeply embed itself into the operating system, altering core system files, modifying kernels, and hiding its presence. Rootkits commonly replace or modify OS-level files, which results in changed file hashes-exactly what FIM is detecting. Rootkits often gain privileged, persistent control and are frequently disguised as legitimate updates or patches. A logic bomb (A) is triggered by an event but does not typically modify OS files. A keylogger (B) captures keystrokes but doesn't modify system files broadly. Ransomware (C) encrypts files, not silently alters system components. Thus, the best match is D: Rootkit.
Question 284
The marketing department set up its own project management software without telling the appropriate departments. Which of the following describes this scenario?
Correct Answer: A
Shadow IT is the term used to describe the use of unauthorized or unapproved IT resources within an organization. The marketing department set up its own project management software without telling the appropriate departments, such as IT, security, or compliance. This could pose a risk to the organization's security posture, data integrity, and regulatory compliance1. References: CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, Chapter 2, page 35.
Question 285
A security analyst is reviewing the security of a SaaS application that the company intends to purchase. Which of the following documentations should the security analyst request from the SaaS application vendor?
Correct Answer: B
A third-party audit provides an independent assessment of the SaaS vendor's security controls, compliance, and practices. This documentation helps verify that the vendor meets security standards and follows best practices. Reference: CompTIA Security+ SY0-701 Official Study Guide, Domain 5.3: "Third-party audits offer independent verification of vendor security controls." Exam Objectives 5.3: "Summarize third-party risk management concepts."
