Question Q-6024 During an incident response, a security analyst discovers a compromised…
2 comments · last active Jun 8, 2026
CompTIA Security+ SY0-701 - Domains 3 4 5 Architecture Operations Program Management
By Jordan Blake · Updated May 25, 2026
| Questions | 25 |
| Passing Score | 75% |
| Format | 100% Multiple Choice |
| Sessions Logged | 975 |
| Your progress | Log in / Register to track times taken, best score, questions mastered, and coverage on this quiz. |
| Rating |
Topics covered
Uncategorized25 questions
Discussion
Log in to post a comment, reply, or expand a question.
Risk register: likelihood × impact, then treatment (accept/mitigate/transfer/avoid). Quantitative vs qualitative still tested.
Third-party risk / supply chain is huge on 701. Vendor SOC 2 reports ≠ you can skip due diligence.
DMZ / tiered segmentation: web in DMZ, app inside, DB deepest. Exam loves 'where do you place the database?'
+2 votesJump boxes and VLANs are the implementation detail; architecture answer is least privilege between zones.
Zero trust = never trust, always verify, assume breach. Not a single product; it's architecture + identity-centric access.
Micro-segmentation and continuous auth show up as distractors — pick principles over vendor buzzwords.
SIEM use cases: correlation, not just log storage. UEBA / impossible travel ties back to domain 2 if you did that set first.
SOAR automates playbooks — know when human approval is still required (legal hold, exec comms).
Change management: test → approve → implement → backout plan. Emergency change still needs documentation after the fact.
GRC frameworks (NIST, ISO, CIS) — exam wants you to match control to goal, not recite entire standard numbers.
Data classification + labeling drives DLP policies. Public/internal/confidential/restricted — match control to label.
Encryption at rest vs in transit vs in use (confidential compute) — Sec+ 701 mentions all three now.
IaaS vs PaaS vs SaaS responsibility split — you patch the OS in IaaS, not in SaaS. Cloud provider secures the hypervisor in all models.
Memorize the matrix: customer always owns data + identity; provider owns physical security. Everything else shifts by model.
BCP vs DRP: BCP keeps business functions alive; DRP restores IT systems. RTO/RPO definitions trip people up.
Tabletop exercise = test the plan without failing over production. Hot/warm/cold site question was fair.
Automation in security ops: reduce toil, not remove humans. False positive tuning on detections is a recurring theme.
Finished domains 3–5 set — hardest for me was cloud legal/compliance. Anyone have a good cheat sheet for GDPR vs CCPA basics?
Question catalog for this preview
Catalog listing of the 5 preview questions for this quiz.
Question 1
An organization's risk assessment identifies a potential data breach with an annual probability of 10% and a single occurrence loss of $500,000. What is the ALE (Annual Loss Expectancy)?
Explanation
ALE = SLE × ARO (Annual Rate of Occurrence). SLE = $500,000 (Single Loss Expectancy). ARO = 10% = 0.10. ALE = $500,000 × 0.10 = $50,000. Organizations use ALE to justify security investment — if a control costs less than the ALE it mitigates, it's cost-effective.
Question 2
A security engineer is configuring email security. They want to prevent email spoofing by verifying that emails come from authorized mail servers for a domain. Which protocol/mechanism accomplishes this?
Explanation
SPF verifies the sending mail server is authorized for the domain. DKIM adds a cryptographic signature to verify the email wasn't modified in transit. DMARC ties them together, defining policy (none/quarantine/reject) and providing reporting. Full email authentication requires all three working together.
Question 3
A security operations center (SOC) analyst receives an alert for a known malware signature detected on a workstation. The workstation is confirmed to be running a licensed PDF reader with no recent changes. Investigation reveals the "malware" signature matches a legitimate PDF library function. What type of alert is this?
Explanation
A false positive (FP) is an alert generated for activity that is actually benign. The AV/IDS flagged a legitimate application as malicious. FPs waste analyst time and erode trust in security tools. The signature should be tuned to exclude this legitimate software.
Question 4
A company's security policy requires that privileged administrative access to servers be performed through a dedicated workstation in a secured room, never directly. What is this dedicated workstation called?
Explanation
A jump server (bastion host) or PAW (Privileged Access Workstation) is a hardened, monitored system that serves as a secure intermediary for administrative access to servers. All admin sessions are routed through it, providing centralized logging, session recording, and access control.
Question 5
A security analyst is reviewing an endpoint detection and response (EDR) alert. A process called "explorer.exe" is making outbound connections to a suspicious IP on port 4444. What is the MOST likely interpretation?
Explanation
explorer.exe should not make outbound network connections. Port 4444 is commonly used by Metasploit Meterpreter. This pattern indicates process injection or hollow process attack — malware injected into explorer.exe to appear legitimate while establishing C2 communications.
IR containment on a Linux server — isolate network first, preserve memory if you can, then eradicate. Order matters on PBQs.
Don't wipe before imaging if legal/compliance needs forensics. Scenario usually hints regulated data.