Topic 09 Practice Test 1 covers Enterprise Mitigation Techniques for CompTIA Security+ SY0-701 and maps to objective 2.5: Explain the purpose of mitigation techniques used to secure the enterprise. For broader exam preparation, review the CompTIA Security+ Exam Dumps. Every option includes focused editorial reasoning explaining both the concept and its fit to the scenario.
Question 1
To prevent malicious actions locally before they succeed, which security approach should be selected?
- Default-credential replacement
- Host-based intrusion prevention system (HIPS)
- Host-based firewall
- Isolation
Correct Answer: B
Correct Answer
Answer B is correct because Host-based intrusion prevention system (HIPS) means an endpoint control that detects and blocks suspicious host activity based on rules or behavior. That makes it the best answer here; Host-based firewall addresses a firewall running on an individual endpoint that filters inbound and outbound traffic for that host, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Default-credential replacement refers to changing factory-set usernames or passwords before production use. This could be appropriate elsewhere, but the required function is an endpoint control that detects and blocks suspicious host activity based on rules or behavior; that makes Host-based intrusion prevention system (HIPS) the precise choice.
Answer C is incorrect because Host-based firewall refers to a firewall running on an individual endpoint that filters inbound and outbound traffic for that host. The concept is valid, but it does not match this stem. The required function is an endpoint control that detects and blocks suspicious host activity based on rules or behavior, which maps to Host-based intrusion prevention system (HIPS).
Answer D is incorrect because Isolation refers to separation of a suspicious or high-risk system from normal resources. That concept can be valid in another scenario, but this question is testing an endpoint control that detects and blocks suspicious host activity based on rules or behavior; Host-based intrusion prevention system (HIPS) therefore fits the requirement more directly.
Question 2
To reduce data exposure if storage or communications are accessed by an unauthorized party, which security approach should be selected?
- Security monitoring
- Endpoint protection
- Configuration enforcement
- Encryption
Correct Answer: D
Correct Answer
Answer D is correct because Encryption means cryptographic protection that makes information unreadable without the appropriate key. The requirement maps directly to this function, whereas Security monitoring is aimed at continuous or periodic observation of logs, activity, and system state for suspicious conditions.
Incorrect Answers
Answer A is incorrect because Security monitoring refers to continuous or periodic observation of logs, activity, and system state for suspicious conditions. The key mismatch is functional: Encryption addresses cryptographic protection that makes information unreadable without the appropriate key, the need stated by the question.
Answer B is incorrect because Endpoint protection refers to host software that prevents, detects, or responds to malicious activity on endpoints. The key mismatch is functional: Encryption addresses cryptographic protection that makes information unreadable without the appropriate key, the need stated by the question.
Answer C is incorrect because Configuration enforcement refers to use of policy, automation, or management controls to maintain approved secure settings. That concept can be valid in another scenario, but this question is testing cryptographic protection that makes information unreadable without the appropriate key; Encryption therefore fits the requirement more directly.
Question 3
During an enterprise hardening and mitigation review, the team has two independent requirements: (1) application of vendor fixes that correct vulnerabilities and software defects; and (2) cryptographic protection that makes information unreadable without the appropriate key. Which TWO choices best satisfy those requirements? Choose TWO.
- Patching
- Encryption
- Host-based firewall
- Endpoint protection
- Permissions
Correct Answers: A, B
Correct Answers
Answer A is correct because Patching means application of vendor fixes that correct vulnerabilities and software defects. This selection maps directly to one of the named needs. Host-based firewall addresses a firewall running on an individual endpoint that filters inbound and outbound traffic for that host, so it does not satisfy the same slot.
Answer B is correct because Encryption means cryptographic protection that makes information unreadable without the appropriate key. One required function is exactly what this option provides. Host-based firewall may be useful elsewhere, but it is used for a firewall running on an individual endpoint that filters inbound and outbound traffic for that host.
Incorrect Answers
Answer C is incorrect because Host-based firewall means a firewall running on an individual endpoint that filters inbound and outbound traffic for that host. The scenario calls for Encryption, Patching. Selecting this option would leave one of those required functions uncovered.
Answer D is incorrect because Endpoint protection means host software that prevents, detects, or responds to malicious activity on endpoints. The fixed-count answer set is Encryption, Patching; this option does not fill one of those named functions. For example, Encryption is required for cryptographic protection that makes information unreadable without the appropriate key.
Answer E is incorrect because Permissions means authorization settings defining what actions identities can perform on resources. Every answer slot must map to a stated requirement. The correct set is Encryption, Patching, so this option cannot replace one of those selections.
Question 4
A review during an enterprise hardening and mitigation review identifies two gaps. One requires application of vendor fixes that correct vulnerabilities and software defects. The other requires granting only the minimum permissions necessary for a subject to perform its required function. Which TWO options should be included in the remediation plan? Choose TWO.
- Access control list (ACL)
- Network segmentation
- Patching
- Least privilege
- Application allow list
Correct Answers: C, D
Correct Answers
Answer C is correct because Patching means application of vendor fixes that correct vulnerabilities and software defects. One required function is exactly what this option provides. Access control list (ACL) may be useful elsewhere, but it is used for an ordered rule set that permits or denies traffic or access based on defined criteria.
Answer D is correct because Least privilege means granting only the minimum permissions necessary for a subject to perform its required function. This selection maps directly to one of the named needs. Access control list (ACL) addresses an ordered rule set that permits or denies traffic or access based on defined criteria, so it does not satisfy the same slot.
Incorrect Answers
Answer A is incorrect because Access control list (ACL) means an ordered rule set that permits or denies traffic or access based on defined criteria. The required choices are Patching, Least privilege. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer B is incorrect because Network segmentation means division of a network into controlled zones or segments to limit communication and reduce blast radius. The question requires exactly 2 selections: Patching, Least privilege. This option falls outside that required set.
Answer E is incorrect because Application allow list means a control that permits execution only for approved applications or binaries. The required choices are Patching, Least privilege. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Question 5
Reviewers working through an enterprise hardening and mitigation review identify three separate needs: division of a network into controlled zones or segments to limit communication and reduce blast radius; cryptographic protection that makes information unreadable without the appropriate key; uninstalling applications and services that are not required for the system’s role. Which THREE choices map to those needs? Choose THREE.
- Network segmentation
- Encryption
- Port and protocol reduction
- Unnecessary-software removal
- Host-based intrusion prevention system (HIPS)
- Secure decommissioning
Correct Answers: A, B, D
Correct Answers
Answer A is correct because Network segmentation means division of a network into controlled zones or segments to limit communication and reduce blast radius. The fixed-count item needs this function in the answer set. Host-based intrusion prevention system (HIPS) covers an endpoint control that detects and blocks suspicious host activity based on rules or behavior, a different requirement.
Answer B is correct because Encryption means cryptographic protection that makes information unreadable without the appropriate key. One required function is exactly what this option provides. Host-based intrusion prevention system (HIPS) may be useful elsewhere, but it is used for an endpoint control that detects and blocks suspicious host activity based on rules or behavior.
Answer D is correct because Unnecessary-software removal means uninstalling applications and services that are not required for the system’s role. It belongs in the fixed-count answer set because it covers one of the stated requirements. Port and protocol reduction instead serves disabling unnecessary services, ports, or protocols and cannot replace this function.
Incorrect Answers
Answer C is incorrect because Port and protocol reduction means disabling unnecessary services, ports, or protocols. The question requires exactly 3 selections: Network segmentation, Unnecessary-software removal, Encryption. This option falls outside that required set. For example, Network segmentation is required for division of a network into controlled zones or segments to limit communication and reduce blast radius.
Answer E is incorrect because Host-based intrusion prevention system (HIPS) means an endpoint control that detects and blocks suspicious host activity based on rules or behavior. The question requires exactly 3 selections: Network segmentation, Unnecessary-software removal, Encryption. This option falls outside that required set.
Answer F is incorrect because Secure decommissioning means controlled removal of systems or assets from service with data protection and access cleanup. The scenario calls for Network segmentation, Unnecessary-software removal, Encryption. Selecting this option would leave one of those required functions uncovered.
Question 6
Which term describes disabling unnecessary services, ports, or protocols?
- Least privilege
- Host-based intrusion prevention system (HIPS)
- Network segmentation
- Port and protocol reduction
Correct Answer: D
Correct Answer
Answer D is correct because Port and protocol reduction means disabling unnecessary services, ports, or protocols. That makes it the best answer here; Host-based intrusion prevention system (HIPS) addresses an endpoint control that detects and blocks suspicious host activity based on rules or behavior, not the function requested in the stem.
Incorrect Answers
Answer A is incorrect because Least privilege refers to granting only the minimum permissions necessary for a subject to perform its required function. The scenario instead requires disabling unnecessary services, ports, or protocols, which is why Port and protocol reduction is the better answer; this option serves the different function defined above.
Answer B is incorrect because Host-based intrusion prevention system (HIPS) refers to an endpoint control that detects and blocks suspicious host activity based on rules or behavior. The key mismatch is functional: Port and protocol reduction addresses disabling unnecessary services, ports, or protocols, the need stated by the question.
Answer C is incorrect because Network segmentation refers to division of a network into controlled zones or segments to limit communication and reduce blast radius. The scenario instead requires disabling unnecessary services, ports, or protocols, which is why Port and protocol reduction is the better answer; this option serves the different function defined above.
Question 7
Which term describes authorization settings defining what actions identities can perform on resources?
- Encryption
- Port and protocol reduction
- Permissions
- Host-based firewall
Correct Answer: C
Correct Answer
Answer C is correct because Permissions means authorization settings defining what actions identities can perform on resources. That is the function the question is testing. Host-based firewall would instead be used for a firewall running on an individual endpoint that filters inbound and outbound traffic for that host.
Incorrect Answers
Answer A is incorrect because Encryption refers to cryptographic protection that makes information unreadable without the appropriate key. The scenario instead requires authorization settings defining what actions identities can perform on resources, which is why Permissions is the better answer; this option serves the different function defined above.
Answer B is incorrect because Port and protocol reduction refers to disabling unnecessary services, ports, or protocols. That concept can be valid in another scenario, but this question is testing authorization settings defining what actions identities can perform on resources; Permissions therefore fits the requirement more directly.
Answer D is incorrect because Host-based firewall refers to a firewall running on an individual endpoint that filters inbound and outbound traffic for that host. The key mismatch is functional: Permissions addresses authorization settings defining what actions identities can perform on resources, the need stated by the question.
Question 8
Which term describes granting only the minimum permissions necessary for a subject to perform its required function?
- Secure decommissioning
- Configuration enforcement
- Least privilege
- Host-based firewall
Correct Answer: C
Correct Answer
Answer C is correct because Least privilege means granting only the minimum permissions necessary for a subject to perform its required function. The deciding point is functional fit: this option covers the stated need, while Host-based firewall addresses a firewall running on an individual endpoint that filters inbound and outbound traffic for that host.
Incorrect Answers
Answer A is incorrect because Secure decommissioning refers to controlled removal of systems or assets from service with data protection and access cleanup. The question is not asking for this function. It is testing granting only the minimum permissions necessary for a subject to perform its required function, so Least privilege is the stronger fit.
Answer B is incorrect because Configuration enforcement refers to use of policy, automation, or management controls to maintain approved secure settings. This could be appropriate elsewhere, but the required function is granting only the minimum permissions necessary for a subject to perform its required function; that makes Least privilege the precise choice.
Answer D is incorrect because Host-based firewall refers to a firewall running on an individual endpoint that filters inbound and outbound traffic for that host. The question is not asking for this function. It is testing granting only the minimum permissions necessary for a subject to perform its required function, so Least privilege is the stronger fit.
Question 9
To block unknown or unauthorized software from running, which security approach should be selected?
- Isolation
- Application allow list
- Patching
- Host-based intrusion prevention system (HIPS)
Correct Answer: B
Correct Answer
Answer B is correct because Application allow list means a control that permits execution only for approved applications or binaries. This matches the requirement as written. Isolation can be valid in another context, but it is used for separation of a suspicious or high-risk system from normal resources.
Incorrect Answers
Answer A is incorrect because Isolation refers to separation of a suspicious or high-risk system from normal resources. This could be appropriate elsewhere, but the required function is a control that permits execution only for approved applications or binaries; that makes Application allow list the precise choice.
Answer C is incorrect because Patching refers to application of vendor fixes that correct vulnerabilities and software defects. The scenario instead requires a control that permits execution only for approved applications or binaries, which is why Application allow list is the better answer; this option serves the different function defined above.
Answer D is incorrect because Host-based intrusion prevention system (HIPS) refers to an endpoint control that detects and blocks suspicious host activity based on rules or behavior. The question is not asking for this function. It is testing a control that permits execution only for approved applications or binaries, so Application allow list is the stronger fit.
Question 10
Which term describes uninstalling applications and services that are not required for the system’s role?
- Encryption
- Port and protocol reduction
- Unnecessary-software removal
- Endpoint protection
Correct Answer: C
Correct Answer
Answer C is correct because Unnecessary-software removal means uninstalling applications and services that are not required for the system’s role. That is the function the question is testing. Encryption would instead be used for cryptographic protection that makes information unreadable without the appropriate key.
Incorrect Answers
Answer A is incorrect because Encryption refers to cryptographic protection that makes information unreadable without the appropriate key. The key mismatch is functional: Unnecessary-software removal addresses uninstalling applications and services that are not required for the system’s role, the need stated by the question.
Answer B is incorrect because Port and protocol reduction refers to disabling unnecessary services, ports, or protocols. The question is not asking for this function. It is testing uninstalling applications and services that are not required for the system’s role, so Unnecessary-software removal is the stronger fit.
Answer D is incorrect because Endpoint protection refers to host software that prevents, detects, or responds to malicious activity on endpoints. The question is not asking for this function. It is testing uninstalling applications and services that are not required for the system’s role, so Unnecessary-software removal is the stronger fit.
Question 11
During an enterprise hardening and mitigation review, the team has two independent requirements: (1) application of vendor fixes that correct vulnerabilities and software defects; and (2) controlled removal of systems or assets from service with data protection and access cleanup. Which TWO choices best satisfy those requirements? Choose TWO.
- Security monitoring
- Least privilege
- Patching
- Secure decommissioning
- Host-based intrusion prevention system (HIPS)
Correct Answers: C, D
Correct Answers
Answer C is correct because Patching means application of vendor fixes that correct vulnerabilities and software defects. This selection maps directly to one of the named needs. Host-based intrusion prevention system (HIPS) addresses an endpoint control that detects and blocks suspicious host activity based on rules or behavior, so it does not satisfy the same slot.
Answer D is correct because Secure decommissioning means controlled removal of systems or assets from service with data protection and access cleanup. One required function is exactly what this option provides. Host-based intrusion prevention system (HIPS) may be useful elsewhere, but it is used for an endpoint control that detects and blocks suspicious host activity based on rules or behavior.
Incorrect Answers
Answer A is incorrect because Security monitoring means continuous or periodic observation of logs, activity, and system state for suspicious conditions. The question requires exactly 2 selections: Secure decommissioning, Patching. This option falls outside that required set. For example, Patching is required for application of vendor fixes that correct vulnerabilities and software defects.
Answer B is incorrect because Least privilege means granting only the minimum permissions necessary for a subject to perform its required function. The required choices are Secure decommissioning, Patching. Although this option is security-relevant, it does not satisfy one of the functions named in the stem.
Answer E is incorrect because Host-based intrusion prevention system (HIPS) means an endpoint control that detects and blocks suspicious host activity based on rules or behavior. The question requires exactly 2 selections: Secure decommissioning, Patching. This option falls outside that required set.
Question 12
Which firewall running on an individual endpoint filters inbound and outbound traffic for that host?
- Host-based firewall
- Permissions
- Encryption
- Port and protocol reduction
Correct Answer: A
Correct Answer
Answer A is correct because Host-based firewall means a firewall running on an individual endpoint that filters inbound and outbound traffic for that host. That makes it the best answer here; Permissions addresses authorization settings defining what actions identities can perform on resources, not the function requested in the stem.
Incorrect Answers
Answer B is incorrect because Permissions refers to authorization settings defining what actions identities can perform on resources. The concept is valid, but it does not match this stem. The required function is a firewall running on an individual endpoint that filters inbound and outbound traffic for that host, which maps to Host-based firewall.
Answer C is incorrect because Encryption refers to cryptographic protection that makes information unreadable without the appropriate key. The scenario instead requires a firewall running on an individual endpoint that filters inbound and outbound traffic for that host, which is why Host-based firewall is the better answer; this option serves the different function defined above.
Answer D is incorrect because Port and protocol reduction refers to disabling unnecessary services, ports, or protocols. The question is not asking for this function. It is testing a firewall running on an individual endpoint that filters inbound and outbound traffic for that host, so Host-based firewall is the stronger fit.
Question 13
The control set for an enterprise hardening and mitigation review must address both controlled removal of systems or assets from service with data protection and access cleanup and disabling unnecessary services, ports, or protocols. Which TWO choices map directly to those needs? Choose TWO.
- Default-credential replacement
- Secure decommissioning
- Port and protocol reduction
- Permissions
- Encryption
Correct Answers: B, C
Correct Answers
Answer B is correct because Secure decommissioning means controlled removal of systems or assets from service with data protection and access cleanup. This option satisfies a specific requirement in the stem; Permissions serves authorization settings defining what actions identities can perform on resources and therefore is not interchangeable with it.
Answer C is correct because Port and protocol reduction means disabling unnecessary services, ports, or protocols. It belongs in the fixed-count answer set because it covers one of the stated requirements. Permissions instead serves authorization settings defining what actions identities can perform on resources and cannot replace this function.
Incorrect Answers
Answer A is incorrect because Default-credential replacement means changing factory-set usernames or passwords before production use. The question requires exactly 2 selections: Secure decommissioning, Port and protocol reduction. This option falls outside that required set. For example, Port and protocol reduction is required for disabling unnecessary services, ports, or protocols.
Answer D is incorrect because Permissions means authorization settings defining what actions identities can perform on resources. The fixed-count answer set is Secure decommissioning, Port and protocol reduction; this option does not fill one of those named functions. For example, Secure decommissioning is required for controlled removal of systems or assets from service with data protection and access cleanup.
Answer E is incorrect because Encryption means cryptographic protection that makes information unreadable without the appropriate key. Every answer slot must map to a stated requirement. The correct set is Secure decommissioning, Port and protocol reduction, so this option cannot replace one of those selections.
Question 14
To contain compromise and restrict unnecessary east-west movement, which security approach should be selected?
- Network segmentation
- Least privilege
- Host-based firewall
- Port and protocol reduction
Correct Answer: A
Correct Answer
Answer A is correct because Network segmentation means division of a network into controlled zones or segments to limit communication and reduce blast radius. This is the precise fit for the scenario. Host-based firewall serves the different purpose of a firewall running on an individual endpoint that filters inbound and outbound traffic for that host.
Incorrect Answers
Answer B is incorrect because Least privilege refers to granting only the minimum permissions necessary for a subject to perform its required function. That concept can be valid in another scenario, but this question is testing division of a network into controlled zones or segments to limit communication and reduce blast radius; Network segmentation therefore fits the requirement more directly.
Answer C is incorrect because Host-based firewall refers to a firewall running on an individual endpoint that filters inbound and outbound traffic for that host. The key mismatch is functional: Network segmentation addresses division of a network into controlled zones or segments to limit communication and reduce blast radius, the need stated by the question.
Answer D is incorrect because Port and protocol reduction refers to disabling unnecessary services, ports, or protocols. The concept is valid, but it does not match this stem. The required function is division of a network into controlled zones or segments to limit communication and reduce blast radius, which maps to Network segmentation.
Question 15
Two requirements remain open in an enterprise hardening and mitigation review: separation of a suspicious or high-risk system from normal resources; endpoint control that detects and blocks suspicious host activity based on rules or behavior. Which TWO options close those specific gaps? Choose TWO.
- Default-credential replacement
- Host-based intrusion prevention system (HIPS)
- Isolation
- Access control list (ACL)
- Configuration enforcement
Correct Answers: B, C
Correct Answers
Answer B is correct because Host-based intrusion prevention system (HIPS) means an endpoint control that detects and blocks suspicious host activity based on rules or behavior. It belongs in the fixed-count answer set because it covers one of the stated requirements. Configuration enforcement instead serves use of policy, automation, or management controls to maintain approved secure settings and cannot replace this function.
Answer C is correct because Isolation means separation of a suspicious or high-risk system from normal resources. One required function is exactly what this option provides. Default-credential replacement may be useful elsewhere, but it is used for changing factory-set usernames or passwords before production use.
Incorrect Answers
Answer A is incorrect because Default-credential replacement means changing factory-set usernames or passwords before production use. The question requires exactly 2 selections: Isolation, Host-based intrusion prevention system (HIPS). This option falls outside that required set. For example, Host-based intrusion prevention system (HIPS) is required for an endpoint control that detects and blocks suspicious host activity based on rules or behavior.
Answer D is incorrect because Access control list (ACL) means an ordered rule set that permits or denies traffic or access based on defined criteria. The question requires exactly 2 selections: Isolation, Host-based intrusion prevention system (HIPS). This option falls outside that required set.
Answer E is incorrect because Configuration enforcement means use of policy, automation, or management controls to maintain approved secure settings. The fixed-count answer set is Isolation, Host-based intrusion prevention system (HIPS); this option does not fill one of those named functions.
Question 16
To remove known exploitable weaknesses from supported systems, which security approach should be selected?
- Secure decommissioning
- Patching
- Port and protocol reduction
- Default-credential replacement
Correct Answer: B
Correct Answer
Answer B is correct because Patching means application of vendor fixes that correct vulnerabilities and software defects. The deciding point is functional fit: this option covers the stated need, while Default-credential replacement addresses changing factory-set usernames or passwords before production use.
Incorrect Answers
Answer A is incorrect because Secure decommissioning refers to controlled removal of systems or assets from service with data protection and access cleanup. The scenario instead requires application of vendor fixes that correct vulnerabilities and software defects, which is why Patching is the better answer; this option serves the different function defined above.
Answer C is incorrect because Port and protocol reduction refers to disabling unnecessary services, ports, or protocols. The question is not asking for this function. It is testing application of vendor fixes that correct vulnerabilities and software defects, so Patching is the stronger fit.
Answer D is incorrect because Default-credential replacement refers to changing factory-set usernames or passwords before production use. The concept is valid, but it does not match this stem. The required function is application of vendor fixes that correct vulnerabilities and software defects, which maps to Patching.
Question 17
To prevent drift from hardened baselines, which security approach should be selected?
- Host-based firewall
- Patching
- Configuration enforcement
- Secure decommissioning
Correct Answer: C
Correct Answer
Answer C is correct because Configuration enforcement means use of policy, automation, or management controls to maintain approved secure settings. The deciding point is functional fit: this option covers the stated need, while Host-based firewall addresses a firewall running on an individual endpoint that filters inbound and outbound traffic for that host.
Incorrect Answers
Answer A is incorrect because Host-based firewall refers to a firewall running on an individual endpoint that filters inbound and outbound traffic for that host. The question is not asking for this function. It is testing use of policy, automation, or management controls to maintain approved secure settings, so Configuration enforcement is the stronger fit.
Answer B is incorrect because Patching refers to application of vendor fixes that correct vulnerabilities and software defects. The key mismatch is functional: Configuration enforcement addresses use of policy, automation, or management controls to maintain approved secure settings, the need stated by the question.
Answer D is incorrect because Secure decommissioning refers to controlled removal of systems or assets from service with data protection and access cleanup. The key mismatch is functional: Configuration enforcement addresses use of policy, automation, or management controls to maintain approved secure settings, the need stated by the question.
Question 18
Which term describes cryptographic protection that makes information unreadable without the appropriate key?
- Host-based firewall
- Host-based intrusion prevention system (HIPS)
- Isolation
- Encryption
Correct Answer: D
Correct Answer
Answer D is correct because Encryption means cryptographic protection that makes information unreadable without the appropriate key. The deciding point is functional fit: this option covers the stated need, while Host-based intrusion prevention system (HIPS) addresses an endpoint control that detects and blocks suspicious host activity based on rules or behavior.
Incorrect Answers
Answer A is incorrect because Host-based firewall refers to a firewall running on an individual endpoint that filters inbound and outbound traffic for that host. The question is not asking for this function. It is testing cryptographic protection that makes information unreadable without the appropriate key, so Encryption is the stronger fit.
Answer B is incorrect because Host-based intrusion prevention system (HIPS) refers to an endpoint control that detects and blocks suspicious host activity based on rules or behavior. The question is not asking for this function. It is testing cryptographic protection that makes information unreadable without the appropriate key, so Encryption is the stronger fit.
Answer C is incorrect because Isolation refers to separation of a suspicious or high-risk system from normal resources. The scenario instead requires cryptographic protection that makes information unreadable without the appropriate key, which is why Encryption is the better answer; this option serves the different function defined above.
Question 19
To detect attacks, policy violations, and abnormal behavior early, which security approach should be selected?
- Security monitoring
- Application allow list
- Default-credential replacement
- Endpoint protection
Correct Answer: A
Correct Answer
Answer A is correct because Security monitoring means continuous or periodic observation of logs, activity, and system state for suspicious conditions. That makes it the best answer here; Endpoint protection addresses host software that prevents, detects, or responds to malicious activity on endpoints, not the function requested in the stem.
Incorrect Answers
Answer B is incorrect because Application allow list refers to a control that permits execution only for approved applications or binaries. The concept is valid, but it does not match this stem. The required function is continuous or periodic observation of logs, activity, and system state for suspicious conditions, which maps to Security monitoring.
Answer C is incorrect because Default-credential replacement refers to changing factory-set usernames or passwords before production use. The key mismatch is functional: Security monitoring addresses continuous or periodic observation of logs, activity, and system state for suspicious conditions, the need stated by the question.
Answer D is incorrect because Endpoint protection refers to host software that prevents, detects, or responds to malicious activity on endpoints. That concept can be valid in another scenario, but this question is testing continuous or periodic observation of logs, activity, and system state for suspicious conditions; Security monitoring therefore fits the requirement more directly.
Question 20
Which term describes controlled removal of systems or assets from service with data protection and access cleanup?
- Port and protocol reduction
- Unnecessary-software removal
- Network segmentation
- Secure decommissioning
Correct Answer: D
Correct Answer
Answer D is correct because Secure decommissioning means controlled removal of systems or assets from service with data protection and access cleanup. The requirement maps directly to this function, whereas Network segmentation is aimed at division of a network into controlled zones or segments to limit communication and reduce blast radius.
Incorrect Answers
Answer A is incorrect because Port and protocol reduction refers to disabling unnecessary services, ports, or protocols. The question is not asking for this function. It is testing controlled removal of systems or assets from service with data protection and access cleanup, so Secure decommissioning is the stronger fit.
Answer B is incorrect because Unnecessary-software removal refers to uninstalling applications and services that are not required for the system’s role. The key mismatch is functional: Secure decommissioning addresses controlled removal of systems or assets from service with data protection and access cleanup, the need stated by the question.
Answer C is incorrect because Network segmentation refers to division of a network into controlled zones or segments to limit communication and reduce blast radius. The concept is valid, but it does not match this stem. The required function is controlled removal of systems or assets from service with data protection and access cleanup, which maps to Secure decommissioning.
