CompTIA Security+ SY0-701 - Free Practice Quiz

Question 1 of 60

A security analyst discovers that a threat actor used DNS over HTTPS (DoH) to exfiltrate data from a compromised host, bypassing traditional DNS monitoring. Which detection approach is MOST effective against DoH-based data exfiltration?

A Blocking port 53 at the perimeter firewall B Deploying a DNS sinkhole for malicious domains C Inspecting HTTPS traffic via TLS inspection proxy to identify anomalous DoH patterns, combined with restricting DoH resolvers to approved corporate resolvers D Increasing antivirus signature update frequency

1 / 60

Question 2 of 60

An organization deploys a SIEM with 200+ correlation rules. The security operations team is overwhelmed by 10,000+ alerts per day with a 95% false positive rate. Which approach MOST effectively improves alert fidelity?

A Adding more correlation rules to catch more threats B Increasing SIEM storage capacity C Implementing risk-based alert tuning using asset criticality and threat intelligence scoring to prioritize alerts, combined with SOAR automation for high-confidence, low-risk alert categories D Hiring additional SOC analysts

2 / 60

Question 3 of 60

A security analyst discovers that a web application uses JWT (JSON Web Tokens) with the 'alg' header set to 'none', effectively disabling signature verification. Which attack does this enable?

A XSS via JWT header injection B SQL injection via JWT payload C JWT algorithm confusion attack allowing forged tokens by removing signature verification entirely D Brute-force attack against JWT secret

3 / 60

Question 4 of 60

A forensic analyst examines a Windows system for evidence of anti-forensics techniques. The analyst discovers that the $LogFile, $MFT, and $UsnJrnl NTFS metadata files have been wiped. What does this MOST likely indicate?

A Normal disk defragmentation activity B Windows update process clearing temporary files C Deliberate anti-forensics to eliminate evidence of file system operations, indicating a sophisticated attacker or insider with system-level access D Disk failure causing metadata corruption

4 / 60

Question 5 of 60

An organization's threat hunting team identifies that a threat actor established persistence using a Windows Management Instrumentation (WMI) event subscription that triggers a PowerShell script whenever a user logs in. Which forensic artifact would MOST conclusively confirm this persistence mechanism?

A Windows Security Event Log login events B PowerShell transcription logs C WMI repository database (OBJECTS.DATA) containing the event filter and consumer bindings D Prefetch files for PowerShell.exe

5 / 60

Question 6 of 60

A red team successfully bypasses a web application firewall by encoding their SQL injection payload using URL encoding and Unicode normalization to evade signature detection. Which defense MOST effectively addresses WAF bypass techniques?

A Adding more WAF signatures B Blocking all non-standard character encodings C Defense in depth â€” combining WAF with parameterized queries in application code, runtime application self-protection (RASP), and database activity monitoring (DAM) so bypassing the WAF does not result in successful exploitation D Increasing WAF sensitivity to maximum

6 / 60

Question 7 of 60

An organization's incident response plan specifies that all evidence must be collected following the order of volatility. A responder must choose between capturing network connections, running processes, RAM, and the swap file. Which should be captured FIRST?

A Network connections B Running processes C RAM (Random Access Memory) â€” the most volatile artifact before running processes D Swap file

7 / 60

Question 8 of 60

An organization implements a bug bounty program. Which security concept does this BEST exemplify compared to traditional penetration testing?

A Compliance-driven security assessment B Annual point-in-time security validation C Continuous crowdsourced vulnerability discovery leveraging diverse researcher skills to find issues that internal assessments miss, with economic incentives aligned to discovery D Internal red team operations

8 / 60

Question 9 of 60

A security architect evaluates a proposed microservices architecture where services authenticate to each other using long-lived API keys stored in environment variables. Which security improvement MOST significantly reduces the risk of credential compromise?

A Rotating API keys quarterly B Encrypting API keys using AES-256 before storing in environment variables C Implementing mutual TLS (mTLS) with short-lived certificates issued by a service mesh certificate authority, replacing static API keys entirely D Storing API keys in a secrets manager and retrieving them at runtime

9 / 60

Question 10 of 60

Which advanced Security+ SY0-701 topic describes using machine learning models trained on normal network and user behavior to detect novel threats that have no known signatures?

A Signature-based intrusion detection B Pattern matching via Snort rules C User and Entity Behavior Analytics (UEBA) with ML-based anomaly detection D Hash-based malware detection

10 / 60

Question 11 of 60

A security analyst examines a suspicious email that passed through the organization's email gateway undetected. The email contained a PDF with an embedded JavaScript that triggered a zero-day vulnerability in the PDF reader. Which email security control gap does this expose?

A Anti-spam filtering based on content patterns B DMARC/DKIM/SPF authentication C Sandboxing-based email analysis with behavioral detonation â€” the only control capable of detecting zero-day exploits in embedded content through observed malicious behavior D Blocklist-based URL filtering

11 / 60

Question 12 of 60

A security engineer reviews an application's authentication flow and discovers that after successful MFA, the application issues a session token that is valid for 30 days without re-authentication. An attacker who steals this token has 30-day access. Which principle does this MOST violate?

A Separation of duties B Defense in depth C Continuous validation / reauthentication for sensitive operations â€” the MFA benefit is negated by long-lived tokens that become a high-value target D Non-repudiation

12 / 60

Question 13 of 60

An organization detects that an attacker performed a Kerberoasting attack against its Active Directory environment. Which condition in the AD environment made this attack possible?

A Domain controllers lacking security patches B Users having administrator rights C Service accounts configured with SPNs and weak passwords that are vulnerable to offline cracking of Kerberos TGS tickets D Weak NTLM authentication configuration

13 / 60

Question 14 of 60

A security architect designs a PKI hierarchy for an organization with 50,000 employees globally. Which design decision MOST improves resilience and operational security?

A A single online root CA issuing all end-entity certificates B Using only self-signed certificates for cost savings C An offline root CA issuing certificates to multiple regional online issuing CAs, with the root CA's private key stored in air-gapped HSMs and only brought online for issuing CA certificate renewal D Sharing the root CA private key between two data centers for redundancy

14 / 60

Question 15 of 60

Which Security+ SY0-701 cryptographic primitive enables two parties to establish a shared encryption key over an untrusted channel without any prior shared secret, providing perfect forward secrecy when combined with ephemeral key pairs?

A AES-GCM authenticated encryption B RSA key encapsulation C Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) key exchange D SHA-3 hashing

15 / 60

Question 16 of 60

A security team deploys a deception technology platform including canary tokens â€” specifically, fake AWS credentials embedded in publicly accessible configuration files. Which attacker action would these canary tokens MOST effectively detect?

A Malware scanning the corporate network for open ports B Brute-force attacks against corporate VPN C Passive network eavesdropping D Attackers finding and attempting to use the fake credentials â€” triggering CloudTrail alerts that confirm an active intrusion and the attacker's network location

16 / 60

Question 17 of 60

Which Security+ SY0-701 architectural pattern uses policy decision points (PDPs) and policy enforcement points (PEPs) to implement continuous, context-aware access control aligned with Zero Trust principles?

A Traditional perimeter firewall architecture B VLAN-based network segmentation C Demilitarized Zone (DMZ) architecture D Software-Defined Perimeter (SDP) with policy-based access control engine

17 / 60

Question 18 of 60

An organization's cloud security team discovers that a developer accidentally published a Terraform state file to a public GitHub repository. The state file contains plaintext AWS access keys, database passwords, and API tokens. Which immediate response actions are required?

A Delete the GitHub repository and consider the incident resolved B Rotate only the AWS access keys as they pose the greatest cloud risk C Enable MFA on all affected cloud accounts and monitor for suspicious activity D Immediately rotate ALL exposed credentials, revoke all affected API tokens, enable CloudTrail analysis for unauthorized API calls using the exposed keys (checking access logs for the period the file was public), remove the file and its entire git history, and notify affected service owners

18 / 60

Question 19 of 60

A penetration tester gains access to an internal network after exploiting a vulnerability in an externally facing web application. The tester then enumerates internal systems to identify additional targets. Which kill chain phase does this describe?

A Command and control establishment B Initial exploitation C Post-exploitation persistence D Reconnaissance (internal) / lateral movement preparation phase

19 / 60

Question 20 of 60

Which Security+ SY0-701 attack technique leverages legitimate cloud services â€” such as GitHub, Google Drive, or Pastebin â€” as command-and-control infrastructure to blend malicious traffic with legitimate HTTPS traffic to trusted destinations?

A DNS tunneling for C2 communication B Encrypted channel over port 443 to dedicated C2 server C DoH-based C2 communication D Living-off-the-cloud (LoC) / C2 via legitimate cloud services

20 / 60

Question 21 of 60

A penetration tester successfully performs an NTLM relay attack against a domain environment, gaining access to a domain-joined server without knowing any credentials. Which Active Directory misconfiguration MOST directly enabled this attack?

A Weak password policy for domain users B Lack of multi-factor authentication C Windows Defender disabled on endpoints D SMB signing disabled on domain-joined workstations and servers

21 / 60

Question 22 of 60

Which Security+ SY0-701 concept describes the use of threat intelligence to proactively search for indicators of compromise within an environment before alerts are triggered?

A Vulnerability scanning B Penetration testing C Compliance auditing D Threat hunting â€” hypothesis-driven proactive investigation using TTPs and IoCs from threat intelligence

22 / 60

Question 23 of 60

An attacker exploits a Server-Side Request Forgery (SSRF) vulnerability in a web application to access the cloud metadata service endpoint (169.254.169.254) and retrieve IAM role credentials. Which security control MOST directly prevents this cloud-specific SSRF impact?

A Network segmentation between the application and internet B Using a WAF to filter SSRF patterns in requests C Encrypting all cloud API communications D Blocking access to 169.254.169.254 from application servers, requiring IMDSv2 (Instance Metadata Service v2) which uses session-oriented requests, and applying IMDSv2 enforcement SCPs

23 / 60

Question 24 of 60

An organization implements software-defined WAN (SD-WAN) to connect 50 branch offices. Which security risk is UNIQUE to SD-WAN deployments compared to traditional MPLS WAN?

A Physical link failure between sites B Latency on international connections C Loss of quality of service guarantees D Increased attack surface from internet-connected branches and SD-WAN orchestrators that become high-value targets, combined with the risk of misconfigured security policies applied across all branches simultaneously

24 / 60

Question 25 of 60

An organization runs a critical application that processes credit card transactions. The application vendor announces a critical RCE vulnerability but will not release a patch for 60 days due to testing requirements. Which compensating control strategy BEST reduces risk during this period?

A Accepting the risk and continuing operations until the patch is available B Migrating to a different application immediately C Notifying customers of the vulnerability D Implementing a WAF with virtual patching rules for the specific vulnerability, combined with enhanced monitoring and network micro-segmentation to limit the application's network exposure

25 / 60

Question 26 of 60

A security engineer implements certificate pinning in a mobile application to prevent MitM attacks. During a penetration test, the tester successfully bypasses the pinning using a Frida script that hooks the certificate validation function at runtime. Which additional control would make this bypass significantly harder?

A Using a longer certificate validity period B Adding more pinned certificates C Increasing the TLS version to 1.3 D Implementing root detection and anti-tampering controls that terminate the application if a rooted device or debugging framework is detected, combined with certificate pinning bypass detection

26 / 60

Question 27 of 60

A security architect must choose between storing encryption keys in a software key management service (KMS) versus hardware security modules (HSMs). Which factor MOST strongly justifies the significantly higher cost of HSMs?

A HSMs eliminate the need for key rotation B HSMs offer better performance than software KMS C HSMs are easier to configure and manage D Physical tamper protection ensuring private key material is never exposed in plaintext outside the HSM boundary, providing FIPS 140-2 Level 3 or Level 4 certification required for government and regulated financial applications

27 / 60

Question 28 of 60

A penetration tester discovers an IDOR (Insecure Direct Object Reference) vulnerability in a healthcare application where changing the patient ID in the URL (from /records?id=1001 to /records?id=1002) reveals another patient's records. Which vulnerability class does IDOR belong to?

A Injection vulnerabilities B Session management failures C Authentication weaknesses D Broken access control â€” the application fails to verify that the requesting user is authorized to access the referenced object

28 / 60

Question 29 of 60

Which cryptographic attack against RSA encryption exploits the mathematical relationship between related RSA keys to recover private key material when two RSA moduli share a common prime factor?

A Timing side-channel attack B Birthday attack C Chosen ciphertext attack D Common modulus attack / GCD attack against shared prime factors

29 / 60

Question 30 of 60

An incident response team discovers that an attacker used a compromised service account to move laterally across 47 servers over 8 days. The account had Domain Admin privileges granted for 'a quick project' 2 years ago and never revoked. Which governance failures DIRECTLY contributed to this breach?

A Failure to implement multi-factor authentication only B Failure to conduct annual penetration testing C Failure to monitor network traffic for anomalies D Both failure to enforce privilege access management (PAM) with time-limited administrative access AND failure to conduct periodic access certification reviews that would have detected the stale Domain Admin privilege

30 / 60

Question 31 of 60

Which Security+ SY0-701 attack exploits the trust that end users place in a certificate authority by obtaining a fraudulently issued certificate for a domain the attacker does not own, enabling undetected HTTPS MitM attacks?

A Rogue CA certificate attack / CA compromise enabling fraudulent certificate issuance for legitimate domains B Certificate pinning bypass C Self-signed certificate acceptance D TLS downgrade attack

31 / 60

Question 32 of 60

Which Security+ SY0-701 privacy engineering concept requires that data collection, storage, and processing be designed to protect privacy from the ground up â€” rather than adding privacy controls as an afterthought?

A Privacy by design (PbD) â€” integrating privacy principles into system design from the earliest stage, including data minimization, purpose limitation, and technical controls that enforce privacy protections automatically B Privacy by audit C Privacy by default only D Privacy by compliance

32 / 60

Question 33 of 60

A blue team analyst is investigating an alert from the EDR tool showing that svchost.exe is running from C:\Users\user\AppData\Local\Temp\svchost.exe rather than C:\Windows\System32\svchost.exe. Which attack technique does this MOST likely indicate?

A Masquerading â€” malware using a legitimate Windows executable name to evade detection B Process hollowing C Legitimate Windows update process D Buffer overflow attack

33 / 60

Question 34 of 60

Which Security+ SY0-701 cryptographic concept ensures that even if a long-term private key is compromised, past encrypted communications cannot be decrypted by an attacker who captures the historic ciphertext?

A Perfect Forward Secrecy (PFS) B Key escrow C Non-repudiation D Certificate pinning

34 / 60

Question 35 of 60

An organization discovers that an employee with legitimate database access has been exfiltrating customer data by executing queries during normal business hours, mimicking legitimate reporting activity. Which control would MOST effectively detect this insider threat?

A Database Activity Monitoring (DAM) with behavioral analytics detecting anomalous query patterns â€” unusual data volumes, off-profile table access, or export operations compared to established baselines B Multi-factor authentication for database access C Database encryption at rest D Network-based IDS monitoring database traffic

35 / 60

Question 36 of 60

A security analyst uses the MITRE ATT&CK Navigator to map detection coverage. The analyst identifies that Technique T1078 (Valid Accounts) has no corresponding detection rule in the SIEM. Which threat does this detection gap MOST expose the organization to?

A Attackers using stolen or compromised legitimate credentials to authenticate as valid users â€” a technique used by virtually all APT groups that is invisible to signature-based controls B External port scanning attacks C Ransomware encryption activity D Malware using novel zero-day exploits

36 / 60

Question 37 of 60

An organization implements continuous automated compliance monitoring using Infrastructure as Code scanning. Which security benefit does this provide over periodic manual compliance audits?

A Near-real-time detection of configuration drift from compliant baselines, enabling immediate remediation before non-compliance persists or is exploited B Provides a one-time snapshot of compliance status C Reduces compliance scope through risk acceptance D Eliminates the need for security staff

37 / 60

Question 38 of 60

A security team performs a purple team exercise targeting its identity infrastructure. The red team successfully extracts the NTDS.dit database from a domain controller, offline crack domain accounts, and use DCSync to simulate a pass-the-hash attack. Which combination of controls would MOST comprehensively address ALL three attack paths?

A Implementing Tiered Administration model (isolating DC admin credentials), enabling Protected Users security group for privileged accounts, monitoring for DCSync via Directory Service Access audit events (Event 4662), and using Microsoft Credential Guard to prevent in-memory credential theft B Enabling BitLocker on domain controllers C Blocking SMB traffic between endpoints D Enforcing strong password complexity requirements

38 / 60

Question 39 of 60

A security engineer must implement secure inter-service communication in a containerized microservices environment where services authenticate each other's identity before processing requests. Which solution provides BOTH mutual authentication AND encryption?

A Mutual TLS (mTLS) with a service mesh where each service has a unique certificate validating its identity, combined with automatic certificate rotation B Shared API keys distributed to all services C Network-level firewall rules restricting inter-service communication D IPsec tunnel between all container hosts

39 / 60

Question 40 of 60

Which Security+ SY0-701 cryptographic concept allows a sender to encrypt a message so that multiple different recipients can each decrypt it with their own private key, without the sender needing multiple encryption keys?

A Public key encryption â€” encrypting with each recipient's individual public key creates separate ciphertext for each recipient; alternatively, encrypting a symmetric session key with each recipient's public key (hybrid encryption with multiple wrapped keys) provides efficient multi-recipient encryption B Symmetric encryption with a shared key C Hybrid encryption using multiple symmetric keys D Symmetric key distribution

40 / 60

Question 41 of 60

A security team discovers that an insider threat stole intellectual property by encoding it in image files using steganography before exfiltrating via email. Which detection capability would MOST likely have identified this technique?

A Steganalysis tools analyzing statistical properties of images for hidden data, combined with DLP policies flagging large image transfers from sensitive systems B Blocking all email attachments C Content filtering of email attachments for known malware signatures D Network bandwidth monitoring

41 / 60

Question 42 of 60

Which Security+ SY0-701 attack technique attempts to exhaust application resources by sending a large volume of requests that trigger computationally expensive operations â€” such as hash computation or regex matching â€” on the server?

A ReDoS (Regular Expression Denial of Service) or algorithmic complexity attack B Bandwidth exhaustion attack C XML bomb / billion laughs attack D SYN flood DDoS

42 / 60

Question 43 of 60

Which Security+ SY0-701 security governance document establishes quantitative security objectives, defines metrics for measuring control effectiveness, and tracks security program performance over time?

A Security scorecard / security metrics program with defined KPIs and KRIs (Key Risk Indicators) B Security policy document C Incident response plan D Vulnerability scan report

43 / 60

Question 44 of 60

An organization experiences a ransomware attack that encrypts all file servers. The security team discovers that backups stored on network-attached storage were also encrypted because the backup service account had write access to the backup share. Which backup architecture change would have PREVENTED backup encryption?

A Implementing immutable backup storage with WORM (Write Once Read Many) protection, combined with a backup account that has only write-append permissions and a separate read-only account for restoration â€” preventing any account from deleting or overwriting existing backups B Increasing backup frequency C Encrypting backups before storage D Storing backups on tape

44 / 60

Question 45 of 60

Which Security+ SY0-701 concept describes the structured process of identifying, classifying, and preserving electronically stored information in anticipation of litigation?

A eDiscovery / legal hold process B Incident response process C Chain of custody documentation D Forensic imaging

45 / 60

Question 46 of 60

An organization deploys a cloud-native application using serverless functions (FaaS). Which security challenge is UNIQUE to serverless architectures compared to traditional server-based deployments?

A The need for operating system patching B Short-lived function execution context requiring secrets to be injected at runtime from a secrets manager, combined with the expanded attack surface from event triggers (APIs, queues, storage events) each representing a potential injection point C Physical server security D Requirement for network firewalls

46 / 60

Question 47 of 60

A threat intelligence analyst receives a report that a threat actor group uses a specific file hash, IP address, and registry key as indicators of compromise. Thirty days later, the attacker changes these indicators but uses the same overall attack methodology. Which intelligence concept explains why TTPs are more durable than IoCs?

A IoCs are more actionable than TTPs B Attackers can easily change specific IoCs (file hashes, IPs, domains) with minimal effort â€” these are the bottom of the Pyramid of Pain. TTPs represent how attackers operate, requiring significant retooling to change â€” these are the top of the Pyramid of Pain and the most valuable intelligence C TTPs are always derived from IoCs D File hashes are the most reliable IoC type

47 / 60

Question 48 of 60

A security architect designs authentication for a new mobile banking application. Which authentication design provides the strongest protection against both account takeover and SIM-swapping attacks?

A SMS OTP (one-time password) via text message as second factor B FIDO2/WebAuthn with biometric authenticator or hardware security key â€” providing phishing-resistant authentication bound to the device with no shareable credentials C Email OTP as second factor D TOTP (Time-based One-Time Password) via authenticator app

48 / 60

Question 49 of 60

An attacker performs a watering hole attack against a manufacturing company's supply chain partners. Which attack pattern does this represent?

A Direct phishing of target organization employees B Compromising a website frequently visited by target employees, then infecting visitors with malware when they visit the site C Exploiting a zero-day in the target's web application D DDoS attack against target infrastructure

49 / 60

Question 50 of 60

A security analyst performing threat intelligence analysis maps a recent intrusion to a known APT group's TTP profile. The attacker used spear phishing â†’ Cobalt Strike beacon â†’ LSASS dump â†’ DCSync â†’ domain compromise over 3 weeks. Which threat intelligence framework BEST structures this analysis?

A CVE database B MITRE ATT&CK framework mapping to Initial Access (T1566), Execution (T1059), Credential Access (T1003), Lateral Movement/Privilege Escalation (T1098), and Enterprise technique chains C CVSS scoring system D CWE classification system

50 / 60

Question 51 of 60

An organization's DevSecOps team wants to automatically identify and prevent secrets (API keys, passwords, private keys) from being committed to source code repositories. Which solution operates at the correct point in the pipeline to prevent this before code is pushed?

A Post-deployment vulnerability scanning B Pre-commit git hooks combined with secret scanning tools that block commits containing credential patterns, plus CI/CD pipeline secret scanning for defense-in-depth C WAF with credential detection D SIEM correlation of code repository events

51 / 60

Question 52 of 60

Which Security+ SY0-701 governance principle requires organizations to formally document their risk appetite â€” the level of risk they are willing to accept in pursuit of business objectives â€” before making risk treatment decisions?

A Risk transfer policy B Risk appetite statement / risk tolerance definition â€” establishing the boundaries within which risk treatment decisions are evaluated C Risk acceptance by default D Annual risk assessment only

52 / 60

Question 53 of 60

A security engineer must implement key management for a system that processes payments for a healthcare organization subject to both PCI DSS and HIPAA. Which key management practice satisfies BOTH frameworks' requirements?

A Using cloud provider-managed encryption keys for simplicity B AES-256 encryption with customer-managed keys in an HSM, documented key lifecycle management, annual key rotation, split-knowledge key access controls, and formal key custodian procedures C Storing encryption keys in the same database as encrypted data D Using the same key for all data types to simplify management

53 / 60

Question 54 of 60

Which Security+ SY0-701 privacy concept requires organizations to implement technical and administrative controls that allow data subjects to request deletion of their personal data from all systems where it is stored?

A Data retention requirements B Right to erasure / right to be forgotten (GDPR Article 17) C Privacy by design D Data portability

54 / 60

Question 55 of 60

Which Security+ SY0-701 concept describes configuring network devices and applications to automatically block traffic from IP addresses that exhibit scanning behavior or repeated authentication failures?

A Static IP blocklist management B Automated threat response / fail2ban-style dynamic blocking using IDS/IPS reputation-based and behavioral triggers C Geoblocking based on country of origin D Rate limiting only

55 / 60

Question 56 of 60

An organization's security team discovers that their EDR tool failed to detect a sophisticated attacker who used process hollowing to inject into a trusted Windows process. Which detection capability would MOST likely have caught this technique?

A Signature-based antivirus scanning B Memory forensics combined with behavioral EDR detecting the unusual memory characteristics of hollowed processes â€” such as executable sections in memory not backed by a file on disk C Network traffic analysis D Log correlation in SIEM

56 / 60

Question 57 of 60

Which Security+ SY0-701 attack exploits insecure deserialization vulnerabilities in web applications, potentially leading to remote code execution when malicious serialized objects are processed by the application?

A XML External Entity (XXE) injection B Insecure deserialization attack C SQL injection D Path traversal

57 / 60

Question 58 of 60

An organization implements a zero-knowledge proof system for authentication that allows a user to prove knowledge of a secret without revealing the secret itself. Which authentication problem does this MOST directly solve compared to traditional password authentication?

A Password complexity requirements B Server-side password database compromise risk â€” if the authentication server is breached, no password hashes (or any secret material) are exposed since the server never receives or stores the secret C Password reuse across services D Multi-factor authentication gaps

58 / 60

Question 59 of 60

A security architect must design a system handling patient health records that must satisfy HIPAA's minimum necessary standard and right of access requirements while preventing unauthorized internal access. Which access control model BEST satisfies ALL requirements?

A Role-based access control only B Attribute-based access control (ABAC) with patient-level access policies requiring treating_provider=True AND department=authorized AND patient_consent=granted, with comprehensive audit logging of every access C Discretionary access control D Mandatory access control with clearance levels

59 / 60

Question 60 of 60

A security program manager tracks that the mean time to detect (MTTD) security incidents has increased from 8 hours to 47 hours over the past quarter. Which program areas warrant IMMEDIATE investigation to understand this trend?

A Network bandwidth and latency issues B SIEM alert tuning effectiveness, threat detection rule coverage gaps (unmapped ATT&CK techniques), log source ingestion completeness, and SOC analyst capacity â€” all of which directly impact MTTD C Compliance certification status D Physical security controls

60 / 60

CompTIA Security+ SY0-701 Advanced Quiz