CompTIA Security+ Certification Kit: Exam SY0-701 (Sybex Study Guide
,PREMIUM TABLE OF CONTENTS
CompTIA Security+ SY0-701 — Comprehensive Exam Bank
Part Section
I General Security Concepts
II Threats, Vulnerabilities & Mitigations
III Security Architecture
IV Security Operations
V Security Program Management & Oversight
VI Performance-Based Questions & Integrated Scenarios
High-Yield Coverage
General Security Concepts
Security principles • Zero Trust • Authentication • Cryptography • PKI • Data
protection • Security controls
Threats, Vulnerabilities & Mitigations
Threat actors • Social engineering • Malware • Credential attacks • Web attacks •
Wireless threats • Cloud vulnerabilities • Mitigation
Security Architecture
Cloud models • Virtualization • Containers • Segmentation • Secure infrastructure •
IoT/ICS • Resilience • Backups • Recovery
Security Operations
Hardening • Vulnerability management • IAM • PAM • SIEM • SOAR • EDR • DLP •
Threat hunting • Incident response • Forensics
Security Program Management & Oversight
Governance • Risk management • Compliance • Privacy • Vendor risk • Audits •
Security awareness • Business continuity • Disaster recovery
Performance-Based Questions & Integrated Scenarios
Firewall analysis • Log correlation • Cloud IAM • Access control • Certificate
troubleshooting • Risk calculations • Incident sequencing • Integrated security
challenges
Premium Features
550 High-Difficulty Questions & PBQs • Detailed Rationales • Incorrect-Option
Analysis • Exam Strategy Tips • Security Pearls • Realistic SOC, Cloud,
Network, IAM & Risk Scenarios
,General Security Concepts
1. While reviewing a payroll application, a security analyst discovers that employee salary records are
encrypted on the database server but are transmitted to a remote backup system using an unencrypted
protocol. Which security objective is MOST directly at risk?
A. Availability
B. Confidentiality
C. Non-repudiation
D. Authentication
Correct Answer: B. Confidentiality
Rationale:
Confidentiality ensures sensitive information is accessible only to authorized individuals, systems, or processes.
Although the payroll records are encrypted while stored, they become exposed when transmitted through an
unencrypted channel.
An attacker performing packet capture or a man-in-the-middle attack could potentially read the salary
information while it is moving across the network.
Protecting confidentiality therefore requires appropriate safeguards for data at rest, data in transit, and
sometimes data in use.
Using TLS or another secure encrypted protocol would address the weakness identified in this scenario.
Why the other options are less appropriate:
• A. Availability: Availability concerns whether authorized users can access systems and data when
needed.
• C. Non-repudiation: This provides evidence that a particular user or system performed an action.
• D. Authentication: Authentication verifies identity but does not automatically protect transmitted data
from interception.
Exam Strategy: When the issue involves someone potentially reading information they should not see,
select confidentiality.
Security Pearl: Encryption at rest does not protect information once it leaves the encrypted storage
environment.
2. After recovering from a ransomware attack, an organization restores its customer database successfully.
However, users still cannot log in because the identity and authentication servers remain unavailable. Which
element of the CIA triad is primarily affected?
A. Integrity
B. Confidentiality
,C. Accountability
D. Availability
Correct Answer: D. Availability
Rationale:
Availability ensures that authorized users can access systems, applications, and information whenever required
for legitimate business operations.
In this situation, the database itself has been restored, but users still cannot reach the service because
authentication infrastructure is unavailable.
A dependency such as DNS, identity management, storage, or networking can therefore make an otherwise
functioning application effectively unavailable.
The scenario does not indicate that information was improperly changed or exposed to unauthorized
individuals.
The primary security problem is the inability of legitimate users to access the system.
Why the other options are less appropriate:
• A. Integrity: Integrity addresses unauthorized or improper modification of data.
• B. Confidentiality: Confidentiality focuses on preventing unauthorized disclosure.
• C. Accountability: Accountability involves associating activities with identifiable users or entities.
Exam Strategy: If legitimate users cannot use the system, even though data still exists, think availability.
Security Pearl: Availability depends on the entire service chain, not just the main application or database.
3. A software vendor digitally signs every application update before customers install it. What security
benefit does the digital signature MOST directly provide?
A. Confidentiality of the application
B. Availability of the update server
C. Integrity and authenticity
D. Data minimization
Correct Answer: C. Integrity and authenticity
Rationale:
A digital signature allows recipients to confirm that software originated from the expected publisher and has
not been altered since it was signed.
The sender first creates a hash of the software and signs that hash using the sender's private key.
The recipient can verify the signature using the associated public key and compare the resulting hash with the
downloaded software.
Any unauthorized modification will cause the verification process to fail because the hashes will no longer
match.
Digital signatures therefore support integrity, authenticity, and in many contexts non-repudiation.
,Why the other options are less appropriate:
• A. Confidentiality: Digital signatures do not normally hide the contents of the signed file.
• B. Availability: Signing an update does not ensure the server remains operational.
• D. Data minimization: Data minimization limits unnecessary collection or retention of information.
Exam Strategy: Remember: Encryption = confidentiality; hashing = integrity; digital signature = integrity +
authenticity + non-repudiation.
Security Pearl: Code signing helps users detect malicious or tampered software updates before installation.
4. Before modifying a production firewall, an engineer must document the requested configuration, obtain
management approval, test the change, schedule a maintenance window, and prepare a rollback procedure.
Which process is being followed?
A. Zero trust
B. Gap analysis
C. Separation of duties
D. Change management
Correct Answer: D. Change management
Rationale:
Change management provides a formal and controlled process for modifying production systems and
infrastructure.
A proper change process normally includes documentation, risk and impact assessment, approval, testing,
scheduling, implementation, and rollback planning.
These activities reduce the likelihood that an authorized configuration change will accidentally cause
downtime or introduce security vulnerabilities.
Rollback procedures are particularly important because they allow administrators to restore the previous
known-good configuration if the change fails.
The scenario describes a structured change-management workflow rather than an access-control mechanism.
Why the other options are less appropriate:
• A. Zero trust: Zero trust focuses on continuously verifying users, devices, and access requests.
• B. Gap analysis: Gap analysis compares the current security posture with a desired future state.
• C. Separation of duties: Separation of duties prevents one individual from controlling an entire
sensitive process.
Exam Strategy: Approval + testing + documentation + maintenance window + rollback almost always
indicates change management.
, Security Pearl: Even technically correct changes can create security incidents if implemented without
adequate testing or rollback planning.
5. Within a banking system, one employee can create a wire-transfer request, but a different employee must
approve it before money can be released. Which security principle is BEST demonstrated?
A. Separation of duties
B. Least functionality
C. Mandatory access control
D. Federation
Correct Answer: A. Separation of duties
Rationale:
Separation of duties divides sensitive responsibilities among multiple individuals so that no single person
controls an entire high-risk process.
The employee who initiates the wire transfer cannot independently approve and release the same transaction.
This reduces opportunities for fraud, intentional abuse, and undetected mistakes because another authorized
person must participate.
The principle is widely used in financial systems, privileged administration, payroll processing, and
cryptographic-key handling.
The scenario specifically focuses on distributing responsibilities rather than merely restricting individual
permissions.
Why the other options are less appropriate:
• B. Least functionality: Least functionality removes unnecessary applications, ports, services, or
features.
• C. Mandatory access control: MAC bases access decisions on centrally managed labels and
classifications.
• D. Federation: Federation allows identities from one security domain to be trusted by another.
Exam Strategy: If different people perform different stages of the same sensitive process, choose
separation of duties.
Security Pearl: Separation of duties reduces both insider risk and accidental errors in high-impact
transactions.
6. Administrators currently maintain permanent elevated privileges on production systems. Management
wants those privileges activated only during approved administrative work and automatically removed
afterward. Which solution BEST meets this requirement?
,A. Data masking
B. Network segmentation
C. Job rotation
D. Just-in-time permissions
Correct Answer: D. Just-in-time permissions
Rationale:
Just-in-time permissions provide privileged access only when it is required and typically only for a limited,
approved duration.
Instead of giving administrators permanent elevated rights, the system temporarily grants the required
permissions for a specific administrative task.
Once the approved period expires, the privileges are automatically removed, thereby reducing the window in
which privileged credentials can be abused.
This approach decreases the risk associated with standing administrative privileges and supports the principle
of least privilege.
It is particularly valuable for privileged access management in modern enterprise and cloud environments.
Why the other options are less appropriate:
• A. Data masking: Data masking hides sensitive values rather than controlling administrative access.
• B. Network segmentation: Segmentation separates systems or networks to restrict communication.
• C. Job rotation: Job rotation changes employee responsibilities periodically and can help identify fraud.
Exam Strategy: Words such as temporary, time-limited, approved elevation, or on-demand privilege
strongly indicate JIT access.
Security Pearl: Removing standing privileged access reduces the damage that can result from
compromised administrator accounts.
7. Following a disputed configuration change, investigators must prove which administrator approved the
modification and demonstrate that the administrator cannot reasonably deny having done so. Which
concept is MOST relevant?
A. Obfuscation
B. Non-repudiation
C. Availability
D. Data sovereignty
Correct Answer: B. Non-repudiation
Rationale:
Non-repudiation provides reliable evidence that a specific person, system, or entity performed a particular
action.
It is commonly supported by digital signatures, authenticated timestamps, tamper-resistant logs, and strong
,identity verification.
In this case, investigators need evidence proving that the administrator approved the configuration change and
cannot credibly deny the action later.
A properly implemented digital signature can associate the administrator's identity with the approval while
also protecting the integrity of the record.
This makes non-repudiation the security property most directly relevant to the scenario.
Why the other options are less appropriate:
• A. Obfuscation: Obfuscation makes information or code more difficult to understand.
• C. Availability: Availability concerns reliable access to systems and information.
• D. Data sovereignty: Data sovereignty concerns legal requirements based on where data is stored or
processed.
Exam Strategy: Whenever you see cannot deny, proof of action, or proof of origin, think non-repudiation.
Security Pearl: Strong non-repudiation typically combines authentication, digital signatures, timestamps,
and protected audit records.
8. Instead of automatically trusting users connected to the internal network, an organization evaluates
identity, device posture, application sensitivity, location, and contextual risk every time access is requested.
Which security architecture is being implemented?
A. Air-gapped architecture
B. Implicit trust
C. Zero trust
D. High availability
Correct Answer: C. Zero trust
Rationale:
Zero trust is based on the idea that no user, device, workload, or network location should receive automatic
trust simply because of where it is located.
Each access request should be explicitly evaluated using identity, device health, resource sensitivity, contextual
information, and organizational policy.
Access may also be continuously reevaluated after the user has successfully authenticated rather than trusted
indefinitely for the entire session.
This architecture reduces reliance on traditional perimeter security and limits lateral movement after an
account or endpoint becomes compromised.
The scenario clearly describes continuous verification rather than implicit internal-network trust.
Why the other options are less appropriate:
• A. Air-gapped architecture: An air gap isolates systems from external or less trusted networks.
, • B. Implicit trust: This is exactly the behavior zero trust is designed to eliminate.
• D. High availability: High availability focuses on maintaining services despite component failures.
Exam Strategy: Never trust, always verify and evaluate every access request are classic zero-trust clues.
Security Pearl: Zero trust is an architectural approach involving identity, devices, workloads, applications,
and data—not a single security product.
9. Developers need realistic customer account information for software testing, but management does not
want the actual production account numbers visible in the test environment. Which technique BEST satisfies
the requirement?
A. Data masking
B. Digital signing
C. Hash collision
D. Replication
Correct Answer: A. Data masking
Rationale:
Data masking replaces sensitive production values with altered, fictitious, or obscured values that retain a
useful format for testing purposes.
Developers can therefore work with realistic-looking information without having direct access to actual
customer account numbers.
This helps reduce unnecessary exposure of sensitive information in development, quality assurance, training,
and demonstration environments.
Proper masking should prevent unauthorized users from reconstructing or discovering the original protected
values.
The technique reduces confidentiality risk while maintaining the usability of the dataset.
Why the other options are less appropriate:
• B. Digital signing: Digital signing verifies integrity and authenticity but does not hide sensitive data.
• C. Hash collision: A collision occurs when different inputs generate the same hash and is generally an
undesirable condition.
• D. Replication: Replication simply copies information and could increase exposure if sensitive data is
duplicated.
Exam Strategy: If information must remain usable and realistic but not reveal its real values, think data
masking.
Security Pearl: Test and development environments should generally receive sanitized or masked data
rather than unrestricted production data.
, 10. Executives want to compare the organization's existing security controls with the controls required by a
newly adopted cybersecurity framework. Which activity would BEST identify what is missing?
A. Penetration testing
B. Tokenization
C. Load balancing
D. Gap analysis
Correct Answer: D. Gap analysis
Rationale:
A gap analysis compares an organization's current security state against a defined target state, standard,
framework, or regulatory requirement.
The process identifies security controls, procedures, technologies, or capabilities that are currently missing or
insufficient.
Organizations can then prioritize remediation activities based on risk, compliance requirements, cost, and
business impact.
Unlike penetration testing, a gap analysis is not primarily focused on actively exploiting vulnerabilities within
technical systems.
Its central purpose is determining the difference between where the organization is now and where it needs to
be.
Why the other options are less appropriate:
• A. Penetration testing: Penetration testing identifies exploitable technical weaknesses through
simulated attacks.
• B. Tokenization: Tokenization substitutes sensitive information with non-sensitive tokens.
• C. Load balancing: Load balancing distributes traffic across multiple resources to improve performance
and availability.
Exam Strategy: Current state versus desired state = gap analysis.
Security Pearl: Gap analyses are often performed before major compliance projects, audits, and security-
maturity initiatives.
11. A database administrator configures access so employees can retrieve only the records and functions
necessary for their assigned job duties. Which principle is BEST represented?
A. Open authorization
B. Repudiation
C. Least privilege
D. Fault tolerance
Correct Answer: C. Least privilege
,PREMIUM TABLE OF CONTENTS
CompTIA Security+ SY0-701 — Comprehensive Exam Bank
Part Section
I General Security Concepts
II Threats, Vulnerabilities & Mitigations
III Security Architecture
IV Security Operations
V Security Program Management & Oversight
VI Performance-Based Questions & Integrated Scenarios
High-Yield Coverage
General Security Concepts
Security principles • Zero Trust • Authentication • Cryptography • PKI • Data
protection • Security controls
Threats, Vulnerabilities & Mitigations
Threat actors • Social engineering • Malware • Credential attacks • Web attacks •
Wireless threats • Cloud vulnerabilities • Mitigation
Security Architecture
Cloud models • Virtualization • Containers • Segmentation • Secure infrastructure •
IoT/ICS • Resilience • Backups • Recovery
Security Operations
Hardening • Vulnerability management • IAM • PAM • SIEM • SOAR • EDR • DLP •
Threat hunting • Incident response • Forensics
Security Program Management & Oversight
Governance • Risk management • Compliance • Privacy • Vendor risk • Audits •
Security awareness • Business continuity • Disaster recovery
Performance-Based Questions & Integrated Scenarios
Firewall analysis • Log correlation • Cloud IAM • Access control • Certificate
troubleshooting • Risk calculations • Incident sequencing • Integrated security
challenges
Premium Features
550 High-Difficulty Questions & PBQs • Detailed Rationales • Incorrect-Option
Analysis • Exam Strategy Tips • Security Pearls • Realistic SOC, Cloud,
Network, IAM & Risk Scenarios
,General Security Concepts
1. While reviewing a payroll application, a security analyst discovers that employee salary records are
encrypted on the database server but are transmitted to a remote backup system using an unencrypted
protocol. Which security objective is MOST directly at risk?
A. Availability
B. Confidentiality
C. Non-repudiation
D. Authentication
Correct Answer: B. Confidentiality
Rationale:
Confidentiality ensures sensitive information is accessible only to authorized individuals, systems, or processes.
Although the payroll records are encrypted while stored, they become exposed when transmitted through an
unencrypted channel.
An attacker performing packet capture or a man-in-the-middle attack could potentially read the salary
information while it is moving across the network.
Protecting confidentiality therefore requires appropriate safeguards for data at rest, data in transit, and
sometimes data in use.
Using TLS or another secure encrypted protocol would address the weakness identified in this scenario.
Why the other options are less appropriate:
• A. Availability: Availability concerns whether authorized users can access systems and data when
needed.
• C. Non-repudiation: This provides evidence that a particular user or system performed an action.
• D. Authentication: Authentication verifies identity but does not automatically protect transmitted data
from interception.
Exam Strategy: When the issue involves someone potentially reading information they should not see,
select confidentiality.
Security Pearl: Encryption at rest does not protect information once it leaves the encrypted storage
environment.
2. After recovering from a ransomware attack, an organization restores its customer database successfully.
However, users still cannot log in because the identity and authentication servers remain unavailable. Which
element of the CIA triad is primarily affected?
A. Integrity
B. Confidentiality
,C. Accountability
D. Availability
Correct Answer: D. Availability
Rationale:
Availability ensures that authorized users can access systems, applications, and information whenever required
for legitimate business operations.
In this situation, the database itself has been restored, but users still cannot reach the service because
authentication infrastructure is unavailable.
A dependency such as DNS, identity management, storage, or networking can therefore make an otherwise
functioning application effectively unavailable.
The scenario does not indicate that information was improperly changed or exposed to unauthorized
individuals.
The primary security problem is the inability of legitimate users to access the system.
Why the other options are less appropriate:
• A. Integrity: Integrity addresses unauthorized or improper modification of data.
• B. Confidentiality: Confidentiality focuses on preventing unauthorized disclosure.
• C. Accountability: Accountability involves associating activities with identifiable users or entities.
Exam Strategy: If legitimate users cannot use the system, even though data still exists, think availability.
Security Pearl: Availability depends on the entire service chain, not just the main application or database.
3. A software vendor digitally signs every application update before customers install it. What security
benefit does the digital signature MOST directly provide?
A. Confidentiality of the application
B. Availability of the update server
C. Integrity and authenticity
D. Data minimization
Correct Answer: C. Integrity and authenticity
Rationale:
A digital signature allows recipients to confirm that software originated from the expected publisher and has
not been altered since it was signed.
The sender first creates a hash of the software and signs that hash using the sender's private key.
The recipient can verify the signature using the associated public key and compare the resulting hash with the
downloaded software.
Any unauthorized modification will cause the verification process to fail because the hashes will no longer
match.
Digital signatures therefore support integrity, authenticity, and in many contexts non-repudiation.
,Why the other options are less appropriate:
• A. Confidentiality: Digital signatures do not normally hide the contents of the signed file.
• B. Availability: Signing an update does not ensure the server remains operational.
• D. Data minimization: Data minimization limits unnecessary collection or retention of information.
Exam Strategy: Remember: Encryption = confidentiality; hashing = integrity; digital signature = integrity +
authenticity + non-repudiation.
Security Pearl: Code signing helps users detect malicious or tampered software updates before installation.
4. Before modifying a production firewall, an engineer must document the requested configuration, obtain
management approval, test the change, schedule a maintenance window, and prepare a rollback procedure.
Which process is being followed?
A. Zero trust
B. Gap analysis
C. Separation of duties
D. Change management
Correct Answer: D. Change management
Rationale:
Change management provides a formal and controlled process for modifying production systems and
infrastructure.
A proper change process normally includes documentation, risk and impact assessment, approval, testing,
scheduling, implementation, and rollback planning.
These activities reduce the likelihood that an authorized configuration change will accidentally cause
downtime or introduce security vulnerabilities.
Rollback procedures are particularly important because they allow administrators to restore the previous
known-good configuration if the change fails.
The scenario describes a structured change-management workflow rather than an access-control mechanism.
Why the other options are less appropriate:
• A. Zero trust: Zero trust focuses on continuously verifying users, devices, and access requests.
• B. Gap analysis: Gap analysis compares the current security posture with a desired future state.
• C. Separation of duties: Separation of duties prevents one individual from controlling an entire
sensitive process.
Exam Strategy: Approval + testing + documentation + maintenance window + rollback almost always
indicates change management.
, Security Pearl: Even technically correct changes can create security incidents if implemented without
adequate testing or rollback planning.
5. Within a banking system, one employee can create a wire-transfer request, but a different employee must
approve it before money can be released. Which security principle is BEST demonstrated?
A. Separation of duties
B. Least functionality
C. Mandatory access control
D. Federation
Correct Answer: A. Separation of duties
Rationale:
Separation of duties divides sensitive responsibilities among multiple individuals so that no single person
controls an entire high-risk process.
The employee who initiates the wire transfer cannot independently approve and release the same transaction.
This reduces opportunities for fraud, intentional abuse, and undetected mistakes because another authorized
person must participate.
The principle is widely used in financial systems, privileged administration, payroll processing, and
cryptographic-key handling.
The scenario specifically focuses on distributing responsibilities rather than merely restricting individual
permissions.
Why the other options are less appropriate:
• B. Least functionality: Least functionality removes unnecessary applications, ports, services, or
features.
• C. Mandatory access control: MAC bases access decisions on centrally managed labels and
classifications.
• D. Federation: Federation allows identities from one security domain to be trusted by another.
Exam Strategy: If different people perform different stages of the same sensitive process, choose
separation of duties.
Security Pearl: Separation of duties reduces both insider risk and accidental errors in high-impact
transactions.
6. Administrators currently maintain permanent elevated privileges on production systems. Management
wants those privileges activated only during approved administrative work and automatically removed
afterward. Which solution BEST meets this requirement?
,A. Data masking
B. Network segmentation
C. Job rotation
D. Just-in-time permissions
Correct Answer: D. Just-in-time permissions
Rationale:
Just-in-time permissions provide privileged access only when it is required and typically only for a limited,
approved duration.
Instead of giving administrators permanent elevated rights, the system temporarily grants the required
permissions for a specific administrative task.
Once the approved period expires, the privileges are automatically removed, thereby reducing the window in
which privileged credentials can be abused.
This approach decreases the risk associated with standing administrative privileges and supports the principle
of least privilege.
It is particularly valuable for privileged access management in modern enterprise and cloud environments.
Why the other options are less appropriate:
• A. Data masking: Data masking hides sensitive values rather than controlling administrative access.
• B. Network segmentation: Segmentation separates systems or networks to restrict communication.
• C. Job rotation: Job rotation changes employee responsibilities periodically and can help identify fraud.
Exam Strategy: Words such as temporary, time-limited, approved elevation, or on-demand privilege
strongly indicate JIT access.
Security Pearl: Removing standing privileged access reduces the damage that can result from
compromised administrator accounts.
7. Following a disputed configuration change, investigators must prove which administrator approved the
modification and demonstrate that the administrator cannot reasonably deny having done so. Which
concept is MOST relevant?
A. Obfuscation
B. Non-repudiation
C. Availability
D. Data sovereignty
Correct Answer: B. Non-repudiation
Rationale:
Non-repudiation provides reliable evidence that a specific person, system, or entity performed a particular
action.
It is commonly supported by digital signatures, authenticated timestamps, tamper-resistant logs, and strong
,identity verification.
In this case, investigators need evidence proving that the administrator approved the configuration change and
cannot credibly deny the action later.
A properly implemented digital signature can associate the administrator's identity with the approval while
also protecting the integrity of the record.
This makes non-repudiation the security property most directly relevant to the scenario.
Why the other options are less appropriate:
• A. Obfuscation: Obfuscation makes information or code more difficult to understand.
• C. Availability: Availability concerns reliable access to systems and information.
• D. Data sovereignty: Data sovereignty concerns legal requirements based on where data is stored or
processed.
Exam Strategy: Whenever you see cannot deny, proof of action, or proof of origin, think non-repudiation.
Security Pearl: Strong non-repudiation typically combines authentication, digital signatures, timestamps,
and protected audit records.
8. Instead of automatically trusting users connected to the internal network, an organization evaluates
identity, device posture, application sensitivity, location, and contextual risk every time access is requested.
Which security architecture is being implemented?
A. Air-gapped architecture
B. Implicit trust
C. Zero trust
D. High availability
Correct Answer: C. Zero trust
Rationale:
Zero trust is based on the idea that no user, device, workload, or network location should receive automatic
trust simply because of where it is located.
Each access request should be explicitly evaluated using identity, device health, resource sensitivity, contextual
information, and organizational policy.
Access may also be continuously reevaluated after the user has successfully authenticated rather than trusted
indefinitely for the entire session.
This architecture reduces reliance on traditional perimeter security and limits lateral movement after an
account or endpoint becomes compromised.
The scenario clearly describes continuous verification rather than implicit internal-network trust.
Why the other options are less appropriate:
• A. Air-gapped architecture: An air gap isolates systems from external or less trusted networks.
, • B. Implicit trust: This is exactly the behavior zero trust is designed to eliminate.
• D. High availability: High availability focuses on maintaining services despite component failures.
Exam Strategy: Never trust, always verify and evaluate every access request are classic zero-trust clues.
Security Pearl: Zero trust is an architectural approach involving identity, devices, workloads, applications,
and data—not a single security product.
9. Developers need realistic customer account information for software testing, but management does not
want the actual production account numbers visible in the test environment. Which technique BEST satisfies
the requirement?
A. Data masking
B. Digital signing
C. Hash collision
D. Replication
Correct Answer: A. Data masking
Rationale:
Data masking replaces sensitive production values with altered, fictitious, or obscured values that retain a
useful format for testing purposes.
Developers can therefore work with realistic-looking information without having direct access to actual
customer account numbers.
This helps reduce unnecessary exposure of sensitive information in development, quality assurance, training,
and demonstration environments.
Proper masking should prevent unauthorized users from reconstructing or discovering the original protected
values.
The technique reduces confidentiality risk while maintaining the usability of the dataset.
Why the other options are less appropriate:
• B. Digital signing: Digital signing verifies integrity and authenticity but does not hide sensitive data.
• C. Hash collision: A collision occurs when different inputs generate the same hash and is generally an
undesirable condition.
• D. Replication: Replication simply copies information and could increase exposure if sensitive data is
duplicated.
Exam Strategy: If information must remain usable and realistic but not reveal its real values, think data
masking.
Security Pearl: Test and development environments should generally receive sanitized or masked data
rather than unrestricted production data.
, 10. Executives want to compare the organization's existing security controls with the controls required by a
newly adopted cybersecurity framework. Which activity would BEST identify what is missing?
A. Penetration testing
B. Tokenization
C. Load balancing
D. Gap analysis
Correct Answer: D. Gap analysis
Rationale:
A gap analysis compares an organization's current security state against a defined target state, standard,
framework, or regulatory requirement.
The process identifies security controls, procedures, technologies, or capabilities that are currently missing or
insufficient.
Organizations can then prioritize remediation activities based on risk, compliance requirements, cost, and
business impact.
Unlike penetration testing, a gap analysis is not primarily focused on actively exploiting vulnerabilities within
technical systems.
Its central purpose is determining the difference between where the organization is now and where it needs to
be.
Why the other options are less appropriate:
• A. Penetration testing: Penetration testing identifies exploitable technical weaknesses through
simulated attacks.
• B. Tokenization: Tokenization substitutes sensitive information with non-sensitive tokens.
• C. Load balancing: Load balancing distributes traffic across multiple resources to improve performance
and availability.
Exam Strategy: Current state versus desired state = gap analysis.
Security Pearl: Gap analyses are often performed before major compliance projects, audits, and security-
maturity initiatives.
11. A database administrator configures access so employees can retrieve only the records and functions
necessary for their assigned job duties. Which principle is BEST represented?
A. Open authorization
B. Repudiation
C. Least privilege
D. Fault tolerance
Correct Answer: C. Least privilege
