CompTIA Security+ (SY0-801): study guide and free practice questions The ideas the Security+ SY0-801 exam tests, one page each: what the standards say, the traps the questions set, and real practice questions to try. Every page is written from primary sources (NIST, MITRE, the IETF, OWASP, FIRST and CISA) and links to them.
Topics General security concepts Threats, vulnerabilities and mitigations Security program management and oversight 10 free practice questions Drawn from every domain. Pick an answer to see why each option is right or wrong.
A security engineer configures the company's certificate-checking clients to include the nonce extension in every OCSP request and to reject any response that does not carry the same nonce. Which of the following attacks does this defend against? Right. In the game that’s Renown for your General Security Concepts building.
Not that one: A is right. In the game your General Security Concepts building would lose a little Renown, and this question would come back later.
The answer A. ReplayRFC 6960 section 4.4.1 states that the nonce 'cryptographically binds a request and a response to prevent replay attacks'. A captured, validly signed response from earlier carries an old nonce or none, so a client that demands its own nonce rejects it. Your answer B. SpoofingEchoing a nonce does not show who sent the response, since the nonce travels in the request where an attacker can read and copy it. What proves the response came from a legitimate responder is its digital signature, which OCSP requires on every definitive response. Your answer C. Brute forceA brute-force attack tries many passwords or keys until one works. Binding each OCSP response to its request does nothing to stop that kind of guessing. Your answer D. Protocol downgradeA protocol downgrade tricks two parties into using an older or weaker protocol version or algorithm. The nonce extension does not negotiate versions or algorithms, so it is not a defence against that.
A company protects its customer database with a perimeter firewall, host-based intrusion prevention, database encryption and staff security training. Which of the following principles is the company applying? Right. In the game that’s Renown for your General Security Concepts building.
Not that one: D is right. In the game your General Security Concepts building would lose a little Renown, and this question would come back later.
Your answer A. Least privilegeLeast privilege gives each user only the access needed for their job. The company here is stacking several different protections, not trimming anyone's permissions. Your answer B. Zero TrustZero Trust means no user or device is trusted just because of where it sits on the network. Adding layered controls around one database is not that principle. Your answer C. Non-repudiationNon-repudiation makes it impossible to deny having performed an action. Firewalls, intrusion prevention, encryption and training are not aimed at that. The answer D. Defense in depthNIST describes defense in depth as a strategy that integrates people, technology and operations capabilities to establish variable barriers across multiple layers.
A tester submits a malformed date to a web form, and the application returns a page showing a full stack trace, the framework version and internal file paths. Which of the following vulnerabilities does this reveal? Right. In the game that’s Renown for your Threats, Vulnerabilities, and Attacks building.
Not that one: B is right. In the game your Threats, Vulnerabilities, and Attacks building would lose a little Renown, and this question would come back later.
Your answer A. Hardcoded secretsHardcoded secrets are passwords or keys embedded in source code. The page revealed a stack trace, version and paths, which come from how the error was handled. The answer B. Unsafe exception handlingMITRE CWE-209 describes a product that generates an error message including sensitive information about its environment, users or data, and notes that automated tools can spot exposed stack traces or pathnames. Your answer C. Race conditionsA race condition arises when the timing between a check and a use can be exploited. One malformed value produced this page, with no timing involved. Your answer D. Malicious updateA malicious update is a compromised software update. The tester only submitted bad input to a form.
Show the full explanation and doc quotes Its mitigation is to handle exceptions internally and not display detailed errors to users, so showing a stack trace on bad input is unsafe exception handling.
Written from cwe.mitre.org/data/definitions/209.html
Finding the approved file-sharing app cumbersome, a sales team stores customer contracts in a free cloud service that the organization's administrators do not know about. Which of the following does this represent? Right. In the game that’s Renown for your Threats, Vulnerabilities, and Attacks building.
Not that one: C is right. In the game your Threats, Vulnerabilities, and Attacks building would lose a little Renown, and this question would come back later.
Your answer A. Rogue devicesA rogue device is unauthorized hardware attached to the network. The sales team connected no hardware; it signed up for an outside service. Your answer B. Unmanaged systemsUnmanaged systems are the organization's own assets that fall outside its management, such as hosts missing from inventory. Staff choosing an outside service without IT's knowledge is what NIST calls shadow IT. The answer C. Shadow ITNIST SP 800-124r2 (section 3.1.13) says shadow IT denotes staff members' work-related use of IT-related hardware, software or cloud services without the knowledge of the IT organization, and that staff often resort to it when enterprise-provided systems are seen as cumbersome. Your answer D. Public repositoriesA public repository is a shared store of code or packages open to anyone. The contracts are in the team's own cloud account.
A security architect is placing a network intrusion detection system (NIDS) sensor to inspect teleworkers' traffic, which arrives through an IPsec VPN gateway at the network perimeter. Which of the following sensor placements best achieves this? Right. In the game that’s Renown for your Security Architecture building.
Not that one: D is right. In the game your Security Architecture building would lose a little Renown, and this question would come back later.
Your answer A. Outside the VPN gatewayOutside the gateway, teleworker traffic is still inside the encrypted IPsec tunnel, and SP 800-46 notes that intrusion detection systems cannot examine encrypted remote access contents. Your answer B. On the out-of-band networkAn out-of-band management network carries administrative access to devices; teleworker sessions never cross it. Your answer C. At teleworkers' home routersTeleworkers' home routers are not organization-controlled, and the traffic leaving them is already encrypted by the VPN. The answer D. Behind the VPN gatewayNIST SP 800-46 Rev. 2 says the contents of encrypted remote access communications cannot be examined by network firewalls or intrusion detection systems, and recommends designing the remote access architecture so an unencrypted form of the communications can be examined.
A company buys its core network switches from two unrelated manufacturers, each with its own chip design, so one hardware flaw cannot disable every switch. Which of the following best describes this approach? Right. In the game that’s Renown for your Security Architecture building.
Not that one: D is right. In the game your Security Architecture building would lose a little Renown, and this question would come back later.
Your answer A. ClusteringA cluster provides redundancy, but it is usually built from identical nodes. That does not protect against a flaw that every identical node shares. Your answer B. Load balancingLoad balancing shares traffic between devices. It does not require those devices to come from different manufacturers or use different designs. Your answer C. Redundant power supplyA redundant power supply keeps one switch running if a power supply fails. It does nothing about a flaw in the switch's chips. The answer D. Platform diversityNIST SP 800-160 Vol. 2 Rev. 1 describes supply chain diversity as using multiple independent supply chains for critical components, and design diversity as using different designs to meet the same requirements.
A security analyst suspects that an account on a file server was granted administrative rights without approval. The analyst needs records of privilege assignments and security policy changes. Which of the following log types should the analyst review? Right. In the game that’s Renown for your Security Operations building.
Not that one: A is right. In the game your Security Operations building would lose a little Renown, and this question would come back later.
The answer A. Audit logsNIST SP 800-92 describes operating system audit records as holding security event information such as successful and failed authentication attempts, file accesses, security policy changes, account changes including privilege assignment, and use of privileges. Your answer B. Network logsNetwork logs show connections and traffic; they do not record that an account received new privileges on the server. Your answer C. File metadataFile metadata describes attributes such as a file's owner and timestamps; it is not a log of privilege or policy changes. Your answer D. Communication logsCommunication logs cover email, messaging and voice traffic, not changes to accounts on a file server.
A company changes its SAML single sign-on so that users' browsers carry only a reference, which each web application uses to retrieve the assertion directly from the identity provider. Which of the following does this change primarily reduce? Right. In the game that’s Renown for your Security Operations building.
Not that one: A is right. In the game your Security Operations building would lose a little Renown, and this question would come back later.
The answer A. Attack surfaceNIST SP 800-63C-4 describes this back-channel presentation: the subscriber carries only an assertion reference and the relying party fetches the assertion from the identity provider. Your answer B. Network trafficSP 800-63C-4 notes that back-channel presentation requires more network transactions than front-channel presentation, not fewer. Your answer C. ComplexityAdding a direct retrieval between the application and the identity provider adds a step; it does not reduce complexity. Your answer D. DowntimeChanging where the assertion travels does nothing to keep the service running; downtime is not what this addresses.
Show the full explanation and doc quotes Because the relying party only accepts assertions that come directly from the identity provider, the attack surface is reduced.
Written from pages.nist.gov/800-63-4/sp800-63c.html
After a breach of customer data, a company's risk team separates the costs that follow the breach directly from later losses that cascade from it. Which of the following belongs with the later, cascading losses? Right. In the game that’s Renown for your Security Program Management and Oversight building.
Not that one: C is right. In the game your Security Program Management and Oversight building would lose a little Renown, and this question would come back later.
Your answer A. Customer restitutionRestitution, such as paying for credit monitoring, is one of the direct costs IR 8286A lists for responding to the breach. Regulatory fines are among its later, cascading losses. Your answer B. Investigation costsInvestigating the breach is a direct cost that begins as soon as it is discovered. Fines from regulators come later as a downstream consequence. The answer C. Fines from regulatorsNIST IR 8286A lists primary impacts of a customer-data breach as the cost of investigation, restitution for customer losses such as credit monitoring, third-party forensic specialists and immediate capital investment. Your answer D. Forensic specialist feesOutside forensic specialists are hired as part of the immediate response. IR 8286A places regulators' fines among the secondary effects.
To align with NIST SP 800-63B-4, a company is choosing which password control will determine when employees must change their passwords. Which of the following should the company use? Right. In the game that’s Renown for your Security Program Management and Oversight building.
Not that one: B is right. In the game your Security Program Management and Oversight building would lose a little Renown, and this question would come back later.
Your answer A. Minimum password ageA minimum password age stops a user from changing a password again too quickly. It does not tell the company when a change is needed, so it cannot be the trigger. The answer B. Compromised credential monitoringSP 800-63B-4 says verifiers SHALL NOT require subscribers to change passwords periodically, but SHALL force a change if there is evidence the authenticator has been compromised. Your answer C. Scheduled password expirationFixed-schedule expiration is exactly what SP 800-63B-4 forbids: verifiers shall not require periodic password changes. Forced periodic changes tend to produce predictable, weaker passwords. Your answer D. Password complexity rulesComplexity rules govern what characters a password contains, not when it must be changed. SP 800-63B-4 also says verifiers shall not impose composition rules such as mixtures of character types.
Show the full explanation and doc quotes Compromised credential monitoring supplies that evidence, so it is what should decide when a change is required.
Written from pages.nist.gov/800-63-4/sp800-63b.html
Certopolis is an independent study game. It is not affiliated with, endorsed by or sponsored by CompTIA, and its questions are not the exams' questions. Exam names are trademarks of their owners.