Security+ SY0-701

One question per exam domain, 5 in all, each with the answer, the reasoning behind it, and the public source it was written from. Read them here with no account. These are original questions written against the published exam outline, not real exam items.

1. Question 1 · General Security Concepts

   A SaaS company's shared PostgreSQL cluster uses encrypted volumes and TLS. A new contract requires one field to stay unreadable to database administrators and anyone holding a backup. Which measure meets that?

   1. ARotate volume encryption keys more often and store them in a managed cloud key service
   2. BEnable transparent database encryption so the engine encrypts data files and backups at rest
   3. CEnforce mutually authenticated TLS 1.3 on every client connection to the cluster
   4. DEncrypt the field in the application with keys database administrators cannot reach
   Show answer and explanation

   Correct answer

   Encrypt the field in the application with keys database administrators cannot reach

   The level at which encryption is applied determines who is excluded, and only encryption performed above the database, with keys the database operators cannot reach, keeps plaintext away from an administrator who can run queries. Transparent database encryption protects files and backups but decrypts transparently for any authorized session, so a database administrator still reads the column. Volume encryption defends against physical drive loss and does nothing against a logged in operator. Transport encryption protects data in motion only and leaves stored values readable. The requirement names a specific adversary, and the control has to sit above that adversary's access.

   Source: NIST SP 800-57 Part 1 Rev. 5: Recommendation for Key Management

2. Question 2 · Threats, Vulnerabilities, and Mitigations

   A vendor advisory reports active exploitation of a nonprofit's internet-facing appliance. No patch exists, but the advisory documents a workaround and indicators of compromise. Which action should be taken FIRST?

   1. AWait for the vendor patch, recording a documented risk acceptance meanwhile
   2. BDecommission the appliance immediately and route traffic around it
   3. CApply the workaround, restrict management access, and hunt the indicators
   4. DRun an authenticated vulnerability scan to confirm the appliance is affected
   Show answer and explanation

   Correct answer

   Apply the workaround, restrict management access, and hunt the indicators

   When a flaw is under active exploitation and no patch exists, the accepted response is to apply the vendor's mitigation, shrink exposure of the most valuable interface, and check whether compromise has already occurred using the published indicators. Waiting for a patch leaves a reachable and actively attacked service untouched for an unknown period. Decommissioning is the safest outcome in isolation but removes a production capability the nonprofit depends on, so it is disproportionate while a workaround exists. Scanning to confirm the version is reasonable diligence, yet it delays mitigation to learn something the advisory and the deployment inventory already establish.

   Source: NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning

3. Question 3 · Security Architecture

   A transit agency runs fare processing on two load-balanced servers, each near 70% CPU at peak. Rebooting one during the morning rush saturated the other and riders saw payment timeouts. What does this reveal about the design?

   1. AThe health check interval is too long, so requests kept reaching the rebooting node.
   2. BThe pair is redundant only on paper: neither node can carry full peak load alone.
   3. CThe nodes should switch to active-passive so the standby stays idle until needed.
   4. DSession persistence was missing, so failover forced riders to reauthenticate.
   Show answer and explanation

   Correct answer

   The pair is redundant only on paper: neither node can carry full peak load alone.

   High availability requires capacity planning, not merely a second box: with each node at 70 percent of peak, one node must absorb roughly 140 percent of its own capacity during a failure, which is arithmetically impossible. The correct reading is that the cluster needs headroom, a third node, or automatic scaling before it can honour its availability claim. A slow health check would produce a brief burst of errors at the moment of reboot rather than sustained saturation for the whole window. Moving to active-passive makes the problem worse, since an idle standby would then have to carry the entire peak alone. Missing session persistence causes lost sessions and re-login symptoms, not the CPU exhaustion described.

   Source: NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems

4. Question 4 · Security Operations

   An authenticated scan flags a critical flaw in a web server package. The administrator says the distribution backported the fix and only the version string is stale. What should the analyst do NEXT?

   1. ARe-scan with a different engine to see whether it reports the same finding
   2. BOpen an emergency change to upgrade to the latest upstream release regardless of the backport
   3. CClose the finding as a false positive based on the administrator's explanation
   4. DCheck the distribution's security advisory and changelog, then document the evidence
   Show answer and explanation

   Correct answer

   Check the distribution's security advisory and changelog, then document the evidence

   Validation is a defined step of the remediation process, and a false positive disposition has to rest on evidence such as the vendor advisory and package changelog rather than on an assertion, because that evidence is what an auditor or the next analyst will need. Closing on the administrator's word alone is how genuinely unpatched systems disappear from the backlog. Forcing an upstream upgrade against the distribution's packaging can break dependencies and support, and it treats a possible reporting artifact as a confirmed vulnerability. Running a second scanner is a reasonable corroboration step but two tools reading the same version banner can easily produce the same wrong answer.

   Source: NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning

5. Question 5 · Security Program Management and Oversight

   A grocery cooperative's board-approved security policy requires "strong authentication" but never defines it, so each store has configured multifactor differently. Without reopening the policy, which document should the analyst write?

   1. AA procedure listing the click-by-click steps for enrolling a hardware token in the identity provider
   2. BA standard specifying the approved multifactor methods, enrollment requirements and prohibited factors
   3. CA guideline recommending several multifactor options that each store can evaluate for itself locally
   4. DAn exception request documenting the store-by-store variation as a risk the board knowingly accepts
   Show answer and explanation

   Correct answer

   A standard specifying the approved multifactor methods, enrollment requirements and prohibited factors

   A standard is the mandatory, specific requirement that translates broad policy intent into something enforceable and testable, which is precisely the missing layer here. A guideline is advisory, so stores could keep choosing different factors and still be compliant. A procedure documents how to carry out a task but never establishes which authentication methods are acceptable in the first place. An exception request records a deviation rather than resolving it. The hierarchy is policy for intent, standards for the required bar, procedures for the steps, guidelines for recommended practice.

   Source: NIST SP 800-12 Rev. 1: An Introduction to Information Security