SY0-701 practice questions: General Security Concepts

Answer: C. Objective 1.2 lists honeypot, honeynet, honeyfile and honeytoken under deception and disruption technology. NIST SP 800-94 section 8.3.4 describes honeypots as hosts that have no authorized users other than their administrators because they serve no business function, so all activity directed at them is considered suspicious - and notes they supplement, never replace, intrusion detection. Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 1: General Security Concepts

Answer: A. Objective 1.4 lists the trusted platform module, the hardware security module, the key management system and the secure enclave side by side under tools, and the scenario turns on which of them holds one key for many machines. NIST's glossary, citing SP 800-57 Part 2 Revision 1, defines a hardware security module as a physical computing device that safeguards and manages cryptographic keys and provides cryptographic processing, and further entries add that it provides tamper-evident and intrusion-resistant safeguarding of digital keys with FIPS 140 specifying its requirements. The same glossary, citing SP 800-147, defines the trusted platform module as a tamper-resistant integrated circuit built into some computer motherboards that protects small amounts of sensitive information - a per-machine component by construction, as a processor enclave is. A key management system governs the life cycle rather than performing the operation, so on its own it delivers the key to whatever asks for it. Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 1: General Security Concepts

Answer: A. Objective 1.4 lists database and record among the levels at which encryption can be applied, and the level decides what an attacker must hold to read the data. Microsoft's documentation describes the threat TDE was built for: "a malicious party who steals physical media like drives or backup tapes can restore or attach the database and browse its data." It states that "TDE protects data at rest, which is the data and log files", that pages "are encrypted before they're written to disk and are decrypted when read into memory", and that "Backup files of databases that have TDE enabled, are also encrypted by using the DEK. As a result, when you restore from these backups, the certificate protecting the DEK must be available." It adds: "TDE doesn't provide encryption across communication channels." Because decryption is transparent to every session the engine serves, injected queries and administrators' queries see plaintext; only a copy of the files taken away from the server is defeated. Source: https://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/transparent-data-encryption

Answer: A. Program policy is a high-level document, so it does not normally spell out penalties. Instead it may authorize the creation of compliance structures covering violations and specific disciplinary actions, with legal counsel consulted. It also recognizes that violations may be unintentional. Source: NIST SP 800-12 Rev. 1, An Introduction to Information Security (2017), SP80012r1-p38 (5.2.1 Basic Components of Program Policy), p. 38 Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 4: Security Operations

Answer: A. When systems are interconnected, security responsibilities may be shared. Section 2.5 states that system owners are responsible for sharing the security measures used by the organization to provide confidence to the user that the system is adequately secure. The other options assign the duty to a partner role or to a role with a different function (2.5, 3.4, 3.6). Source: NIST SP 800-12 Rev. 1, An Introduction to Information Security (2017), SP80012r1-p19 2.5 Information security responsibilities for system owners go beyond their own organization, p. 19 Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 4: Security Operations