CompTIA SecurityX Practice Test

Answer choices

1. A. Add the origin IP and bucket URL to external scanning scope, but do not model ownership, credentials, data flows, or trust relationships until an incident occurs.
2. B. Add the discovered account to the CMDB and defer threat-model changes until the next scheduled architecture review confirms that it processes sensitive data.
3. C. Treat the account as a governance violation, close public access immediately, and leave the existing threat model unchanged because the exposure has been removed.
4. D. Add unsanctioned cloud services and public digital presence to attack-surface discovery and map ownership, data flows, and trust relationships before selecting controls.

Wrong-answer review

• A. Add the origin IP and bucket URL to external scanning scope, but do not model ownership, credentials, data flows, or trust relationships until an incident occurs.: Incorrect. This is a plausible governance, risk, or compliance action, but it does not resolve the decisive policy, accountability, risk, or evidence requirement in the scenario. Threat models need the real attack surface, including unsanctioned assets/accounts, cloud services, and public presence.
• B. Add the discovered account to the CMDB and defer threat-model changes until the next scheduled architecture review confirms that it processes sensitive data.: Incorrect. This is a plausible governance, risk, or compliance action, but it does not resolve the decisive policy, accountability, risk, or evidence requirement in the scenario. Threat models need the real attack surface, including unsanctioned assets/accounts, cloud services, and public presence.
• C. Treat the account as a governance violation, close public access immediately, and leave the existing threat model unchanged because the exposure has been removed.: Incorrect. This is a plausible governance, risk, or compliance action, but it does not resolve the decisive policy, accountability, risk, or evidence requirement in the scenario. Threat models need the real attack surface, including unsanctioned assets/accounts, cloud services, and public presence.

Answer choices

1. A. At a point after authorized TLS termination where decrypted request metadata/content is available, before it is re-encrypted or transformed beyond the required visibility.
2. B. Place the sensor after the application servers and before the database, where it can observe SQL traffic and infer the original HTTP request semantics.
3. C. Terminate TLS a second time on a passive monitoring appliance using copied server keys, even though the deployed TLS configuration uses forward-secret key exchange.
4. D. Place the sensor before the reverse proxy and enable full packet capture there, relying on TLS handshake metadata to reconstruct application request bodies.

Answer choices

1. A. Use an approved symmetric cipher such as AES for bulk encryption with keys protected and lifecycle-managed in a separate key-management/HSM boundary.
2. B. Use an unkeyed cryptographic hash for sensitive fields and treat the digest as reversible encrypted storage for authorized applications.
3. C. Encrypt every record directly with an asymmetric public-key algorithm so database hosts never need access to any symmetric data-encryption key.
4. D. Use AES for bulk encryption but embed the long-lived master key in application configuration on the database host to avoid dependency on an external key service.

Answer choices

1. A. Rebuild the firewall connector with the previous firmware's schema and force the firewall to emit legacy field names where possible.
2. B. Retune alert thresholds for the lower post-upgrade event volume before checking field extraction, because firmware changes commonly reduce true-positive event rates.
3. C. Validate the parser/schema mapping against the new log format and reprocess sample events before tuning detection thresholds.
4. D. Treat raw event receipt as proof that collection is healthy and investigate missing rule IDs only after confirming threat volume has actually increased.

Answer choices

1. A. Mirror the boundary traffic to an IDS from a switch SPAN session and allow the IDS to issue switch ACL changes automatically when a signature fires.
2. B. Deploy host-based IPS agents on the historian servers and engineering workstations and use them as the primary visibility source for the deterministic control network.
3. C. Place an inline IPS at the enclave boundary but configure it in fail-open mode and permit automatic blocking only for signatures rated high confidence.
4. D. Use a passive network tap feeding an IDS/collector at the boundary, with response actions handled through validated controls rather than inline blocking.

Answer choices

1. A. Enforce only operating-system version and encryption in conditional access, using policy documentation rather than device signals for root/jailbreak and screen-lock requirements.
2. B. Require MDM enrollment and report compliance status, but permit the application when the device is noncompliant as long as the user completes phishing-resistant MFA.
3. C. Allow access from any device with a valid client certificate issued at enrollment, without reevaluating the device's current compliance state.
4. D. Have MDM/endpoint compliance report device posture to conditional access and deny or restrict the application when required controls are not met.

Answer choices

1. A. Run the sample in a sandbox and record behavior, but do not capture or dump unpacked memory because decrypted code is considered nonpersistent and unreliable evidence.
2. B. Unpack the binary manually by editing headers and import tables on the original evidence file, without preserving a working copy or controlled execution trace.
3. C. Continue static analysis only by searching for additional string encodings and larger signature databases, avoiding execution because packed samples cannot be safely debugged.
4. D. Use controlled dynamic analysis/debugging to observe unpacked memory and behavior, then dump/decompile the revealed code as needed.

Answer choices

1. A. Create a common control catalog with authoritative control owners/evidence and map each external requirement to those controls in the GRC platform.
2. B. Create one evidence repository but keep separate control implementations and control identifiers for each framework so assessors can review them independently.
3. C. Centralize the evidence artifacts, but allow each audit team to independently determine which controls and artifacts satisfy its requirements.
4. D. Normalize every external requirement into the NIST CSF taxonomy and stop tracking source-specific clauses once the mapping is complete.

Answer choices

1. A. Keep the broad execution role but place the function in a private subnet so compromise cannot reach cloud storage through the public internet.
2. B. Scope the function's workload identity to the specific source/destination objects and actions required, using separate roles for unrelated workflows.
3. C. Retain full bucket permissions and add an API-gateway rate limit so a compromised function cannot modify too many objects in a short period.
4. D. Split the function into separate source and destination functions but give each function full access to all buckets so workflows remain operationally simple.

Answer choices

1. A. Both are post-quantum digital-signature standards with different constructions and performance/implementation tradeoffs; neither is a symmetric bulk-encryption replacement for AES.
2. B. ML-DSA and SLH-DSA are both post-quantum key-encapsulation standards; the primary difference is whether they use lattice-based or hash-based symmetric encryption.
3. C. Both are post-quantum digital-signature standards, but SLH-DSA is simply a deprecated compatibility profile of ML-DSA with no independent construction or tradeoffs.
4. D. SLH-DSA is a hash-based digital-signature standard, while ML-DSA is a post-quantum block cipher intended to replace AES for high-throughput data encryption.