SANS SEC401 Security Essentials — Exam Prep Question Bank
SANS SEC401 Security Essentials
Question Bank
Question 1
A hospital's patient records system must ensure that data is not altered without detection while in transit between
the EHR application and the database server. Which security property is primarily being addressed?
A. Confidentiality
B. Integrity
C. Availability
D. Non-repudiation
Correct Answer: B. Integrity
Detailed Solution: Integrity ensures data has not been altered, accidentally or maliciously, in an unauthorized
manner. Confidentiality would apply if the concern were unauthorized disclosure, and availability concerns
uptime and access, neither of which matches the scenario of detecting alteration.
Question 2
Which of the following best describes 'accountability' as a security principle distinct from authentication?
A. The ability to trace actions back to a specific individual through logging and auditing
B. The process of granting or denying access to resources
C. The encryption of data at rest
D. The assurance that a user is who they claim to be
Correct Answer: A. The ability to trace actions back to a specific individual through logging and auditing
Detailed Solution: Accountability relies on reliable logging, unique identities, and audit trails so that actions can
be traced to a specific subject. Authentication only verifies identity at login; it does not by itself provide an
ongoing record of actions taken.
Question 3
An organization requires employees to badge into the server room and sign a log book before accessing
equipment. This is an example of which control type?
A. Physical control
B. Compensating control
C. Technical control
D. Administrative control
Correct Answer: A. Physical control
Detailed Solution: Badge access and physical logbooks are physical controls because they restrict and monitor
physical access to a location. A technical control would involve technology such as access control lists, while
administrative controls are policies and procedures.
Question 4
A company implements a policy requiring background checks before granting employees access to sensitive
financial systems. This is best classified as which type of control?
Page 1
, SANS SEC401 Security Essentials — Exam Prep Question Bank
A. Corrective control
B. Physical control
C. Administrative control
D. Detective control
Correct Answer: C. Administrative control
Detailed Solution: Background check policies are administrative controls: they are procedural safeguards
implemented through organizational policy rather than physical barriers or technology. They also serve a
preventive function by reducing insider risk before access is granted.
Question 5
Which risk management strategy is being applied when an organization purchases cyber insurance to offset the
financial impact of a potential data breach?
A. Risk avoidance
B. Risk mitigation
C. Risk transfer
D. Risk acceptance
Correct Answer: C. Risk transfer
Detailed Solution: Purchasing insurance shifts the financial consequence of a risk to a third party, which is the
definition of risk transfer. Mitigation would involve reducing likelihood or impact directly, and avoidance would
mean eliminating the activity that creates the risk altogether.
Question 6
A defense-in-depth strategy layers antivirus on endpoints, a network firewall, and a SIEM for monitoring. If the
antivirus fails to detect a piece of malware, which principle explains why the organization may still detect the
compromise?
A. Redundant and overlapping controls across layers
B. Least privilege enforcement
C. Non-repudiation through digital signatures
D. Single point of failure elimination
Correct Answer: A. Redundant and overlapping controls across layers
Detailed Solution: Defense-in-depth relies on multiple, overlapping layers of controls so that the failure of one
layer (antivirus) does not result in total compromise, since detective controls like SIEM monitoring can still catch
anomalous behavior downstream.
Question 7
Which of the following is the BEST example of a compensating control for a legacy system that cannot be
patched due to vendor end-of-life status?
A. Ignoring the risk since the system is old
B. Relying solely on user awareness training
C. Uninstalling the application entirely
D. Isolating the system on a segmented VLAN with strict firewall rules and enhanced monitoring
Correct Answer: D. Isolating the system on a segmented VLAN with strict firewall rules and enhanced
monitoring
Page 2
, SANS SEC401 Security Essentials — Exam Prep Question Bank
Detailed Solution: When a primary control (patching) cannot be applied, a compensating control provides an
alternative mitigation of similar strength. Network segmentation combined with monitoring reduces the attack
surface and increases the likelihood of detecting exploitation attempts against the unpatched system.
Question 8
An analyst is asked to categorize security controls as preventive, detective, or corrective. Where does a backup
and restore process fit?
A. Physical
B. Preventive
C. Detective
D. Corrective
Correct Answer: D. Corrective
Detailed Solution: A backup and restore process helps an organization recover after an incident, making it a
corrective (and recovery-oriented) control. It does not stop an incident from occurring (preventive) nor does it
identify that one occurred (detective).
Question 9
Which defense-in-depth layer is primarily concerned with protecting data regardless of where it resides or travels,
such as through encryption and rights management?
A. Perimeter defense
B. Information-centric defense
C. Host-based defense
D. Physical defense
Correct Answer: B. Information-centric defense
Detailed Solution: Information-centric (data-centric) defense focuses on protecting the data itself using
encryption, digital rights management, and classification, so that even if perimeter or host defenses fail, the data
remains protected.
Question 10
A security architect designs a network so that a compromised web server in the DMZ cannot directly reach the
internal database subnet. This design decision primarily reflects which principle?
A. Trust boundary enforcement through segmentation
B. Confidentiality via hashing
C. Federation
D. Non-repudiation
Correct Answer: A. Trust boundary enforcement through segmentation
Detailed Solution: Segmenting the network and enforcing strict trust boundaries between zones (DMZ vs.
internal) limits lateral movement if one zone is compromised, which is a core defense-in-depth and Zero Trust
architecture principle.
Question 11
Which statement BEST describes the relationship between threat intelligence and vulnerability management?
A. Vulnerability management only applies to cloud environments
Page 3
, SANS SEC401 Security Essentials — Exam Prep Question Bank
B. Threat intelligence is only useful for law enforcement
C. Threat intelligence replaces the need for vulnerability scanning
D. Threat intelligence helps prioritize which vulnerabilities are being actively exploited in the wild
Correct Answer: D. Threat intelligence helps prioritize which vulnerabilities are being actively exploited in
the wild
Detailed Solution: Threat intelligence provides context, such as which vulnerabilities threat actors are actively
exploiting, allowing vulnerability management teams to prioritize remediation of high-risk, actively-exploited
weaknesses over theoretical ones with no known exploitation.
Question 12
An analyst reviewing a threat report notes indicators such as file hashes, IP addresses, and domain names
associated with a campaign. What category of threat intelligence does this represent?
A. Executive intelligence
B. Strategic intelligence
C. Operational intelligence
D. Tactical/technical intelligence
Correct Answer: D. Tactical/technical intelligence
Detailed Solution: File hashes, IPs, and domains are technical indicators of compromise (IOCs) used to detect
and block specific artifacts, which falls under tactical or technical threat intelligence, the most granular and
immediately actionable level.
Question 13
A CISO requests a report describing long-term geopolitical trends that may affect the organization's threat
landscape over the next fiscal year. This request is for which type of intelligence?
A. Tactical intelligence
B. Technical intelligence
C. Strategic intelligence
D. Operational intelligence
Correct Answer: C. Strategic intelligence
Detailed Solution: Strategic intelligence addresses high-level trends, actor motivations, and geopolitical factors
intended to inform executive decision-making and long-term planning, rather than immediate technical indicators
or day-to-day operational activity.
Question 14
Which term describes the behaviors, tools, and methods that a specific threat actor group consistently uses to
compromise victims?
A. Tactics, Techniques, and Procedures (TTPs)
B. Common Vulnerabilities and Exposures (CVEs)
C. Service Level Agreements (SLAs)
D. Indicators of Compromise (IOCs)
Correct Answer: A. Tactics, Techniques, and Procedures (TTPs)
Page 4
SANS SEC401 Security Essentials
Question Bank
Question 1
A hospital's patient records system must ensure that data is not altered without detection while in transit between
the EHR application and the database server. Which security property is primarily being addressed?
A. Confidentiality
B. Integrity
C. Availability
D. Non-repudiation
Correct Answer: B. Integrity
Detailed Solution: Integrity ensures data has not been altered, accidentally or maliciously, in an unauthorized
manner. Confidentiality would apply if the concern were unauthorized disclosure, and availability concerns
uptime and access, neither of which matches the scenario of detecting alteration.
Question 2
Which of the following best describes 'accountability' as a security principle distinct from authentication?
A. The ability to trace actions back to a specific individual through logging and auditing
B. The process of granting or denying access to resources
C. The encryption of data at rest
D. The assurance that a user is who they claim to be
Correct Answer: A. The ability to trace actions back to a specific individual through logging and auditing
Detailed Solution: Accountability relies on reliable logging, unique identities, and audit trails so that actions can
be traced to a specific subject. Authentication only verifies identity at login; it does not by itself provide an
ongoing record of actions taken.
Question 3
An organization requires employees to badge into the server room and sign a log book before accessing
equipment. This is an example of which control type?
A. Physical control
B. Compensating control
C. Technical control
D. Administrative control
Correct Answer: A. Physical control
Detailed Solution: Badge access and physical logbooks are physical controls because they restrict and monitor
physical access to a location. A technical control would involve technology such as access control lists, while
administrative controls are policies and procedures.
Question 4
A company implements a policy requiring background checks before granting employees access to sensitive
financial systems. This is best classified as which type of control?
Page 1
, SANS SEC401 Security Essentials — Exam Prep Question Bank
A. Corrective control
B. Physical control
C. Administrative control
D. Detective control
Correct Answer: C. Administrative control
Detailed Solution: Background check policies are administrative controls: they are procedural safeguards
implemented through organizational policy rather than physical barriers or technology. They also serve a
preventive function by reducing insider risk before access is granted.
Question 5
Which risk management strategy is being applied when an organization purchases cyber insurance to offset the
financial impact of a potential data breach?
A. Risk avoidance
B. Risk mitigation
C. Risk transfer
D. Risk acceptance
Correct Answer: C. Risk transfer
Detailed Solution: Purchasing insurance shifts the financial consequence of a risk to a third party, which is the
definition of risk transfer. Mitigation would involve reducing likelihood or impact directly, and avoidance would
mean eliminating the activity that creates the risk altogether.
Question 6
A defense-in-depth strategy layers antivirus on endpoints, a network firewall, and a SIEM for monitoring. If the
antivirus fails to detect a piece of malware, which principle explains why the organization may still detect the
compromise?
A. Redundant and overlapping controls across layers
B. Least privilege enforcement
C. Non-repudiation through digital signatures
D. Single point of failure elimination
Correct Answer: A. Redundant and overlapping controls across layers
Detailed Solution: Defense-in-depth relies on multiple, overlapping layers of controls so that the failure of one
layer (antivirus) does not result in total compromise, since detective controls like SIEM monitoring can still catch
anomalous behavior downstream.
Question 7
Which of the following is the BEST example of a compensating control for a legacy system that cannot be
patched due to vendor end-of-life status?
A. Ignoring the risk since the system is old
B. Relying solely on user awareness training
C. Uninstalling the application entirely
D. Isolating the system on a segmented VLAN with strict firewall rules and enhanced monitoring
Correct Answer: D. Isolating the system on a segmented VLAN with strict firewall rules and enhanced
monitoring
Page 2
, SANS SEC401 Security Essentials — Exam Prep Question Bank
Detailed Solution: When a primary control (patching) cannot be applied, a compensating control provides an
alternative mitigation of similar strength. Network segmentation combined with monitoring reduces the attack
surface and increases the likelihood of detecting exploitation attempts against the unpatched system.
Question 8
An analyst is asked to categorize security controls as preventive, detective, or corrective. Where does a backup
and restore process fit?
A. Physical
B. Preventive
C. Detective
D. Corrective
Correct Answer: D. Corrective
Detailed Solution: A backup and restore process helps an organization recover after an incident, making it a
corrective (and recovery-oriented) control. It does not stop an incident from occurring (preventive) nor does it
identify that one occurred (detective).
Question 9
Which defense-in-depth layer is primarily concerned with protecting data regardless of where it resides or travels,
such as through encryption and rights management?
A. Perimeter defense
B. Information-centric defense
C. Host-based defense
D. Physical defense
Correct Answer: B. Information-centric defense
Detailed Solution: Information-centric (data-centric) defense focuses on protecting the data itself using
encryption, digital rights management, and classification, so that even if perimeter or host defenses fail, the data
remains protected.
Question 10
A security architect designs a network so that a compromised web server in the DMZ cannot directly reach the
internal database subnet. This design decision primarily reflects which principle?
A. Trust boundary enforcement through segmentation
B. Confidentiality via hashing
C. Federation
D. Non-repudiation
Correct Answer: A. Trust boundary enforcement through segmentation
Detailed Solution: Segmenting the network and enforcing strict trust boundaries between zones (DMZ vs.
internal) limits lateral movement if one zone is compromised, which is a core defense-in-depth and Zero Trust
architecture principle.
Question 11
Which statement BEST describes the relationship between threat intelligence and vulnerability management?
A. Vulnerability management only applies to cloud environments
Page 3
, SANS SEC401 Security Essentials — Exam Prep Question Bank
B. Threat intelligence is only useful for law enforcement
C. Threat intelligence replaces the need for vulnerability scanning
D. Threat intelligence helps prioritize which vulnerabilities are being actively exploited in the wild
Correct Answer: D. Threat intelligence helps prioritize which vulnerabilities are being actively exploited in
the wild
Detailed Solution: Threat intelligence provides context, such as which vulnerabilities threat actors are actively
exploiting, allowing vulnerability management teams to prioritize remediation of high-risk, actively-exploited
weaknesses over theoretical ones with no known exploitation.
Question 12
An analyst reviewing a threat report notes indicators such as file hashes, IP addresses, and domain names
associated with a campaign. What category of threat intelligence does this represent?
A. Executive intelligence
B. Strategic intelligence
C. Operational intelligence
D. Tactical/technical intelligence
Correct Answer: D. Tactical/technical intelligence
Detailed Solution: File hashes, IPs, and domains are technical indicators of compromise (IOCs) used to detect
and block specific artifacts, which falls under tactical or technical threat intelligence, the most granular and
immediately actionable level.
Question 13
A CISO requests a report describing long-term geopolitical trends that may affect the organization's threat
landscape over the next fiscal year. This request is for which type of intelligence?
A. Tactical intelligence
B. Technical intelligence
C. Strategic intelligence
D. Operational intelligence
Correct Answer: C. Strategic intelligence
Detailed Solution: Strategic intelligence addresses high-level trends, actor motivations, and geopolitical factors
intended to inform executive decision-making and long-term planning, rather than immediate technical indicators
or day-to-day operational activity.
Question 14
Which term describes the behaviors, tools, and methods that a specific threat actor group consistently uses to
compromise victims?
A. Tactics, Techniques, and Procedures (TTPs)
B. Common Vulnerabilities and Exposures (CVEs)
C. Service Level Agreements (SLAs)
D. Indicators of Compromise (IOCs)
Correct Answer: A. Tactics, Techniques, and Procedures (TTPs)
Page 4
