Security+ Threats, Vulnerabilities, and Mitigations: 425 practice questions

12 of the 425 Threats, Vulnerabilities, and Mitigations questions in the Certsqill Security+ bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for Security+? Take the free 5-min readiness check →

1. Apply least privilege and department-based role: Which control directly meets this objective?

1. Require multifactor authentication for every clerk account.

   Multifactor authentication reduces account takeover but does not limit actions performed by a legitimately authenticated insider.
2. Segment public-facing systems from internal resident-record networks.

   Segmentation can limit lateral movement but does not directly restrict excessive permissions within resident-record applications.
3. Apply least privilege and department-based role permissions. ✓

   Least privilege and department-based roles restrict each clerk to records and functions required for assigned duties, directly reducing insider misuse.
4. Create immutable backups so altered resident records can be restored after an incident.

   Immutable backups support recovery after alteration or deletion but do not prevent an authorized clerk from viewing records.

Least privilege and role permissions limit what authorized insiders can access.

2. Use threat intelligence to prioritize targeted defensive: Which control most directly supports that objective?

1. Replace all employee passwords every thirty days.

   Frequent password changes do not specifically detect espionage and may create weak reuse or predictable password behaviors.
2. Use threat intelligence to prioritize targeted defensive monitoring. ✓

   Threat intelligence helps identify relevant nation-state patterns and focus monitoring on likely espionage techniques and targets.
3. Require annual security awareness training for all employees.

   Awareness training can reduce user-driven attacks, but it is less direct against persistent, resourceful external espionage.
4. Install additional badge readers at telecommunications facilities.

   Badge readers strengthen physical access control, but the described exposure involves external reconnaissance of sensitive information.

Threat intelligence focuses defensive monitoring on capable actors and espionage-relevant behavior.

3. Maintain tested: Which control most directly supports recovery from this financially motivated attack?

1. Add security awareness posters near warehouse workstations.

   Posters may improve awareness, but they provide limited recovery value after systems have already been encrypted.
2. Maintain tested, offline, immutable backups of shipping data. ✓

   Offline immutable backups provide recoverable copies that ransomware cannot easily alter or encrypt with production systems.
3. Require stronger badge authentication at loading docks.

   Physical authentication can restrict dock access, but it does not restore data or address ransomware encryption directly.
4. Deploy endpoint detection and response agents.

   Endpoint detection may identify malicious activity, but it does not by itself restore encrypted warehouse systems.

Tested offline and immutable backups directly enable recovery from financially motivated ransomware.

4. Use DDoS protection and traffic scrubbing for public: Which control most directly addresses the likely hacktiv

1. Use DDoS protection and traffic scrubbing for public services. ✓

   DDoS protection and scrubbing preserve service availability against disruption, matching the likely hacktivist objective.
2. Encrypt confidential source code stored in development systems.

   Encryption protects confidentiality of source code, but does not directly maintain availability of public services during flooding.
3. Increase retention of employee security-training records.

   Training records support governance and awareness measurement, but they do not mitigate deliberate public-service disruption.
4. Require privileged developers to use hardware security keys.

   Hardware keys strengthen privileged authentication, but do not absorb or filter distributed availability attacks.

DDoS protection directly targets hacktivist disruption of public-facing services.

5. Use cloud access security controls to discover and govern: Which control most directly reduces this shadow IT

1. Install additional cameras near support-center workstations.

   Cameras may deter physical misuse but do not provide visibility into cloud accounts or sharing policies.
2. Require annual privacy training for support representatives.

   Training may influence behavior but does not discover or govern unmanaged services handling customer documents.
3. Create local backup copies of every customer document.

   Local copies may aid availability but increase duplication without controlling where employees upload sensitive documents.
4. Use cloud access security controls to discover and govern unsanctioned services. ✓

   Cloud access security controls provide visibility and policy enforcement for unapproved services and sensitive-data use.

Cloud access security controls discover and govern unapproved services and their data use.

6. Independently verify unusual payment changes through: Which control is most direct?

1. Require employees to complete quarterly phishing awareness modules.

   Training helps users recognize suspicious messages, but does not provide reliable transaction verification for urgent account changes.
2. Independently verify unusual payment changes through a trusted channel. ✓

   Independent verification prevents fraudulent account changes even when an attacker convincingly impersonates a customer or executive.
3. Block all external email attachments at the gateway.

   Attachment blocking may reduce malware delivery, but does not independently validate payment-account change requests.
4. Encrypt all payment-request messages before delivery.

   Encryption protects message confidentiality, but cannot prove that the requester or destination account is legitimate.

Independent verification through a trusted channel directly counters payment impersonation and business email compromise.

7. Preserve evidence: Which action is best?

1. Publicly name the suspected group because the tool matches its activity.

   A tool association alone cannot establish actor identity and could create inaccurate public claims.
2. Replace the workstation immediately and discard it without collecting additional evidence.

   Replacement may destroy useful forensic evidence and does not establish whether the alert represents compromise.
3. Temporarily isolate the workstation pending validation.

   Temporary containment may be appropriate, but isolation alone does not address the need to preserve evidence and assess attribution.
4. Preserve evidence, correlate independent indicators, and defer attribution. ✓

   Evidence preservation and corroboration support proportionate defensive decisions without treating one alert as conclusive actor attribution.

Preserve evidence and corroborate indicators before attributing activity.

8. Provide targeted data-handling training: Which control most directly reduces recurrence of this negligent insi

1. Deploy a second internet firewall at the laboratory perimeter.

   Additional perimeter filtering may block some traffic, but does not correct employee understanding or distinguish approved storage reliably.
2. Provide targeted data-handling training. ✓

   Targeted training corrects the outdated procedure and helps employees recognize approved handling requirements before repeating the mistake.
3. Create an isolated backup copy of the experimental dataset.

   Backups support recovery from loss, but do not stop employees from uploading data to unauthorized personal storage.
4. Require biometric access to every research room.

   Biometrics strengthen physical entry controls, but do not prevent an authorized employee from mishandling data online.

Targeted training directly corrects the procedural mistake behind the negligent upload.

9. Investigate, preserve evidence, and communicate: Which action is best?

1. Block every public tool associated with criminal activity across library systems.

   Broad blocking may disrupt legitimate operations and cannot reliably distinguish benign use from malicious activity.
2. Assume the named group caused the event and notify the media.

   A public accusation based on a shared technique is unsupported and could misdirect response or damage credibility.
3. Ignore the alert until attribution is confirmed.

   Uncertain attribution does not eliminate potential risk; the library should investigate and apply proportionate defensive measures.
4. Investigate, preserve evidence, and communicate attribution uncertainty. ✓

   Investigation and evidence preservation support a useful response while acknowledging that a shared technique cannot establish actor identity.

Investigate and preserve evidence while communicating attribution uncertainty.

10. Malicious insider: What threat category best describes the observed context?

1. Accidental insider

   An accidental insider mishandles information unintentionally, whereas copying restricted files before resignation suggests purposeful behavior.
2. Compromised account

   A compromised account remains possible, but the evidence does not establish unauthorized takeover or malware involvement.
3. External attacker

   An external attacker lacks the employee’s authorized access and does not best explain the observed internal handling.
4. Malicious insider ✓

   An authorized user deliberately copying restricted files represents a malicious-insider context, although investigators should still verify intent and facts.

Authorized access and apparently deliberate copying indicate a malicious-insider context.

11. Strategic espionage: Which actor motive is most likely?

1. Accidental disclosure

   Accidental disclosure does not explain persistence, custom tooling, or deliberate targeting of strategic designs.
2. Strategic espionage ✓

   Long-term collection of strategic research aligns with nation-state espionage objectives rather than immediate financial gain.
3. Ideological publicity

   Ideological actors generally seek attention or disruption, not quiet sustained acquisition of proprietary research.
4. Ransom demand

   Ransom activity primarily seeks payment by restricting or threatening access, which is not described here.

Patient collection of strategic intellectual property and persistence most strongly indicate nation-state espionage motivation.

12. Organized financial crime: Which actor motivation best fits this pattern?

1. Unskilled experimentation

   Unskilled actors may use available tools, but this pattern provides stronger evidence of organized financial motivation.
2. Organized financial crime ✓

   Credential sales, billing-data access, and payment demands collectively indicate coordinated financially motivated criminal activity.
3. Ideological protest

   Ideological protest normally seeks a political message or disruption, not repeated credential monetization and payment demands.
4. Strategic intelligence collection

   Intelligence collection seeks information or advantage, whereas this activity directly monetizes stolen access.

Credential monetization and payment demands are characteristic of organized financial crime rather than espionage or ideology.

Other Security+ domains

• Security Operations — 528 questions →
• Security Program Management and Oversight — 384 questions →
• Security Architecture — 349 questions →
• General Security Concepts — 232 questions →
• All 1918 Security+ questions →