Security+ SY0-701

One question per exam domain, 5 in all, each with the answer, the reasoning behind it, and the public source it was written from. Read them here with no account. These are original questions written against the published exam outline, not real exam items.

1. Question 1 · General Security Concepts

   A SaaS company's shared PostgreSQL cluster uses encrypted volumes and TLS. A new contract requires one field to stay unreadable to the database administrators and to anyone holding a backup. Which measure meets that?

   1. ARotate the volume encryption keys more frequently and store them in a managed cloud key service
   2. BEnable transparent database encryption so data files and backups are encrypted at rest by the engine
   3. CEnforce TLS 1.3 with mutual authentication on every client connection to the database cluster
   4. DEncrypt the field in the application using keys in a service database administrators cannot reach
   Show answer and explanation

   Correct answer

   Encrypt the field in the application using keys in a service database administrators cannot reach

   The level at which encryption is applied determines who is excluded, and only encryption performed above the database, with keys the database operators cannot reach, keeps plaintext away from an administrator who can run queries. Transparent database encryption protects files and backups but decrypts transparently for any authorized session, so a database administrator still reads the column. Volume encryption defends against physical drive loss and does nothing against a logged in operator. Transport encryption protects data in motion only and leaves stored values readable. The requirement names a specific adversary, and the control has to sit above that adversary's access.

   Source: NIST SP 800-57 Part 1 Rev. 5: Recommendation for Key Management

2. Question 2 · Threats, Vulnerabilities, and Mitigations

   A vendor advisory reports active exploitation of a nonprofit's internet facing appliance. No patch exists, but the advisory documents a configuration workaround and indicators of compromise. Which action should be taken FIRST?

   1. AWait for the vendor patch, recording a documented risk acceptance for the interim
   2. BDecommission the appliance immediately and route production traffic around it for now
   3. CApply the documented workaround now, restrict the management interface, and hunt the indicators
   4. DRun an authenticated vulnerability scan first to confirm the appliance is truly affected
   Show answer and explanation

   Correct answer

   Apply the documented workaround now, restrict the management interface, and hunt the indicators

   When a flaw is under active exploitation and no patch exists, the accepted response is to apply the vendor's mitigation, shrink exposure of the most valuable interface, and check whether compromise has already occurred using the published indicators. Waiting for a patch leaves a reachable and actively attacked service untouched for an unknown period. Decommissioning is the safest outcome in isolation but removes a production capability the nonprofit depends on, so it is disproportionate while a workaround exists. Scanning to confirm the version is reasonable diligence, yet it delays mitigation to learn something the advisory and the deployment inventory already establish.

   Source: NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning

3. Question 3 · Security Architecture

   A transit agency runs fare processing on two servers behind a load balancer, each near 70 percent CPU at peak. Rebooting one during the morning rush saturated the survivor and riders saw payment timeouts. What does this reveal about the design?

   1. AThe load balancer health check interval is too long, so requests continued to reach the node while it rebooted.
   2. BThe pair is redundant on paper only, because neither node has enough spare capacity to carry full peak load alone.
   3. CThe nodes should be reconfigured from active-active to active-passive so the standby stays idle until needed.
   4. DSession persistence was not configured, so the failover forced riders to reauthenticate in mid-transaction.
   Show answer and explanation

   Correct answer

   The pair is redundant on paper only, because neither node has enough spare capacity to carry full peak load alone.

   High availability requires capacity planning, not merely a second box: with each node at 70 percent of peak, one node must absorb roughly 140 percent of its own capacity during a failure, which is arithmetically impossible. The correct reading is that the cluster needs headroom, a third node, or automatic scaling before it can honour its availability claim. A slow health check would produce a brief burst of errors at the moment of reboot rather than sustained saturation for the whole window. Moving to active-passive makes the problem worse, since an idle standby would then have to carry the entire peak alone. Missing session persistence causes lost sessions and re-login symptoms, not the CPU exhaustion described.

   Source: NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems

4. Question 4 · Security Operations

   An authenticated scan flags a critical flaw in a web server package. The administrator says the distribution backported the fix and only the version string is stale. What should the analyst do NEXT?

   1. ARe-run the scan with a different scanning engine to see whether the second tool reports the same finding on that host
   2. BOpen an emergency change request to upgrade the package to the latest upstream release regardless of the backported vendor fix
   3. CClose the finding as a false positive on the basis of the administrator's explanation and note that in the ticket
   4. DVerify the claim against the distribution's published security advisory and the package changelog, then document the evidence
   Show answer and explanation

   Correct answer

   Verify the claim against the distribution's published security advisory and the package changelog, then document the evidence

   Validation is a defined step of the remediation process, and a false positive disposition has to rest on evidence such as the vendor advisory and package changelog rather than on an assertion, because that evidence is what an auditor or the next analyst will need. Closing on the administrator's word alone is how genuinely unpatched systems disappear from the backlog. Forcing an upstream upgrade against the distribution's packaging can break dependencies and support, and it treats a possible reporting artifact as a confirmed vulnerability. Running a second scanner is a reasonable corroboration step but two tools reading the same version banner can easily produce the same wrong answer.

   Source: NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning

5. Question 5 · Security Program Management and Oversight

   A grocery cooperative's board-approved security policy requires "strong authentication" but never defines it, so each store has configured multifactor differently. Without reopening the policy, which document should the analyst write?

   1. AA procedure listing the click-by-click steps for enrolling a hardware token in the identity provider
   2. BA standard specifying the approved multifactor methods, enrollment requirements and prohibited factors
   3. CA guideline recommending several multifactor options that each store can evaluate for itself locally
   4. DAn exception request documenting the store-by-store variation as a risk the board knowingly accepts
   Show answer and explanation

   Correct answer

   A standard specifying the approved multifactor methods, enrollment requirements and prohibited factors

   A standard is the mandatory, specific requirement that translates broad policy intent into something enforceable and testable, which is precisely the missing layer here. A guideline is advisory, so stores could keep choosing different factors and still be compliant. A procedure documents how to carry out a task but never establishes which authentication methods are acceptable in the first place. An exception request records a deviation rather than resolving it. The hierarchy is policy for intent, standards for the required bar, procedures for the steps, guidelines for recommended practice.

   Source: NIST SP 800-12 Rev. 1: An Introduction to Information Security