CompTIA CySA+ CS0-003 Vulnerability Response, Handling, And Management Practice Test

 

Objective 2.5 • 36 original questions

This CompTIA CySA+ CS0-003 practice test focuses on objective 2.5: vulnerability response, handling, and management. All questions are original ExamSnap scenarios aligned to the official CS0-003 objective set; they are not copied from live CompTIA exam content. Review every option explanation to understand why a choice fits or does not fit the scenario. For broader exam preparation, review the CompTIA CySA+ CS0-003 Exam Dumps page.

Instructions: Select the best answer unless the question explicitly says Select TWO or Select THREE. Review the explanation and option review after answering.

Question 1

For a global corporate network, the team must accomplish both of these goals: reduce risk temporarily because the primary remediation cannot yet be deployed, and eliminate the risky service instead of operating it with controls. Which TWO choices together provide the best match? The organization wants a vendor-neutral approach that can be explained during audit review.

1. Threat modeling
2. Penetration testing and adversary emulation
3. Responsive control
4. Risk avoidance
5. Compensating control

Correct answers: D, E

Why: Risk avoidance removes the activity or asset that creates the risk. It directly fits this scenario because the requirement is to eliminate the risky service instead of operating it with controls. A compensating control provides alternative risk reduction when the preferred control cannot be implemented as designed. It directly fits this scenario because the requirement is to reduce risk temporarily because the primary remediation cannot yet be deployed.

Option review:

A: Threat modeling systematically identifies assets, trust boundaries, abuse cases, likely threats, and mitigations before or during design. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce risk temporarily because the primary remediation cannot yet be deployed; eliminate the risky service instead of operating it with controls.

B: Authorized offensive testing validates exploitable attack paths and defensive effectiveness under controlled conditions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce risk temporarily because the primary remediation cannot yet be deployed; eliminate the risky service instead of operating it with controls.

C: Responsive controls trigger actions after detection to contain or manage an event. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce risk temporarily because the primary remediation cannot yet be deployed; eliminate the risky service instead of operating it with controls.

D: Risk avoidance removes the activity or asset that creates the risk. It directly fits this scenario because the requirement is to eliminate the risky service instead of operating it with controls.

E: A compensating control provides alternative risk reduction when the preferred control cannot be implemented as designed. It directly fits this scenario because the requirement is to reduce risk temporarily because the primary remediation cannot yet be deployed.

Learning point: Use Compensating control, Risk avoidance when the key requirement is to reduce risk temporarily because the primary remediation cannot yet be deployed; eliminate the risky service instead of operating it with controls.

Question 2

In a mixed Windows and Linux estate, a security architect must address vulnerability risk through policy, governance, or management decision. Which approach is MOST appropriate? Base the decision on the primary security requirement, not on implementation convenience.

1. Managerial control
2. Bug bounty program
3. Post-remediation validation
4. Governance and service-level objectives
5. Technical control

Correct answer: A

Why: Managerial controls include governance, policy, risk decisions, oversight, and administrative direction. It directly fits this scenario because the requirement is to address vulnerability risk through policy, governance, or management decision.

Option review:

A: Managerial controls include governance, policy, risk decisions, oversight, and administrative direction. It directly fits this scenario because the requirement is to address vulnerability risk through policy, governance, or management decision.

B: A bug bounty invites external researchers to report vulnerabilities under defined scope, rules, and reward terms. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to address vulnerability risk through policy, governance, or management decision.

C: Validation rescans or otherwise verifies that remediation succeeded and did not leave the exposure in place. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to address vulnerability risk through policy, governance, or management decision.

D: Policies, governance, and SLOs define responsibilities, expected remediation performance, and measurable targets. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to address vulnerability risk through policy, governance, or management decision.

E: Technical controls use systems or technology such as access control, filtering, endpoint security, or encryption. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to address vulnerability risk through policy, governance, or management decision.

Learning point: Use Managerial control when the key requirement is to address vulnerability risk through policy, governance, or management decision.

Question 3

A review at Tailspin Toys finds a gap: the team cannot reliably reduce vulnerability risk through a repeatable human or process activity. Which option best closes that gap? The environment follows least privilege and preserves evidence where incident handling is involved.

1. Compensating control
2. Maintenance window
3. Operational control
4. Secure authentication implementation
5. Security-control testing

Correct answer: C

Why: Operational controls are implemented through people and processes such as procedures, training, and manual review. It directly fits this scenario because the requirement is to reduce vulnerability risk through a repeatable human or process activity.

Option review:

A: A compensating control provides alternative risk reduction when the preferred control cannot be implemented as designed. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce vulnerability risk through a repeatable human or process activity.

B: A maintenance window is an approved period for changes that may affect availability or performance. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce vulnerability risk through a repeatable human or process activity.

C: Operational controls are implemented through people and processes such as procedures, training, and manual review. It directly fits this scenario because the requirement is to reduce vulnerability risk through a repeatable human or process activity.

D: Authentication code should use proven identity libraries, secure credential storage, MFA where appropriate, and safe recovery flows. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce vulnerability risk through a repeatable human or process activity.

E: Control testing verifies whether deployed safeguards actually prevent, detect, or respond as intended. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce vulnerability risk through a repeatable human or process activity.

Learning point: Use Operational control when the key requirement is to reduce vulnerability risk through a repeatable human or process activity.

Question 4

At Proseware Research, a malware analyst has two simultaneous requirements: apply a technology-enforced safeguard to reduce vulnerability exposure, and route an overdue critical finding to the appropriate decision maker. Which TWO options should be selected? Use the choice that most directly addresses the stated evidence rather than a broader control.

1. Application data protection
2. Bug bounty program
3. Governance and service-level objectives
4. Technical control
5. Prioritization and escalation

Correct answers: D, E

Why: Technical controls use systems or technology such as access control, filtering, endpoint security, or encryption. It directly fits this scenario because the requirement is to apply a technology-enforced safeguard to reduce vulnerability exposure. Vulnerabilities are escalated based on severity, exploitability, exposure, asset criticality, deadlines, and ownership. It directly fits this scenario because the requirement is to route an overdue critical finding to the appropriate decision maker.

Option review:

A: Applications should minimize, encrypt, authorize, and safely retain sensitive data throughout its lifecycle. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to apply a technology-enforced safeguard to reduce vulnerability exposure; route an overdue critical finding to the appropriate decision maker.

B: A bug bounty invites external researchers to report vulnerabilities under defined scope, rules, and reward terms. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to apply a technology-enforced safeguard to reduce vulnerability exposure; route an overdue critical finding to the appropriate decision maker.

C: Policies, governance, and SLOs define responsibilities, expected remediation performance, and measurable targets. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to apply a technology-enforced safeguard to reduce vulnerability exposure; route an overdue critical finding to the appropriate decision maker.

D: Technical controls use systems or technology such as access control, filtering, endpoint security, or encryption. It directly fits this scenario because the requirement is to apply a technology-enforced safeguard to reduce vulnerability exposure.

E: Vulnerabilities are escalated based on severity, exploitability, exposure, asset criticality, deadlines, and ownership. It directly fits this scenario because the requirement is to route an overdue critical finding to the appropriate decision maker.

Learning point: Use Technical control, Prioritization and escalation when the key requirement is to apply a technology-enforced safeguard to reduce vulnerability exposure; route an overdue critical finding to the appropriate decision maker.

Question 5

While supporting a managed cloud environment, a SOC analyst is asked to block exploitation before it succeeds. Which concept or tool is the clearest match? The team wants the most defensible analyst action before expanding the investigation.

1. Preventive control
2. Parameterized queries
3. Session management
4. Risk acceptance
5. Risk transfer

Correct answer: A

Why: Preventive controls aim to stop an unwanted event before it occurs. It directly fits this scenario because the requirement is to block exploitation before it succeeds.

Option review:

A: Preventive controls aim to stop an unwanted event before it occurs. It directly fits this scenario because the requirement is to block exploitation before it succeeds.

B: Parameterized database queries keep user data separate from query syntax and are a primary defense against SQL injection. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to block exploitation before it succeeds.

C: Secure session management uses strong identifiers, expiration, rotation, cookie protections, and logout/invalidation controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to block exploitation before it succeeds.

D: Risk acceptance means knowingly retaining a risk because it is within tolerance or remediation cost outweighs benefit. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to block exploitation before it succeeds.

E: Risk transfer shifts some financial or operational impact to another party through contracts, insurance, or service arrangements. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to block exploitation before it succeeds.

Learning point: Use Preventive control when the key requirement is to block exploitation before it succeeds.

Question 6

Woodgrove Bank is designing a combined control. It must identify attempted or successful exploitation for investigation, and confirm that a security control works in practice rather than only on paper. Which TWO options are most appropriate? Select based on the scenario’s decisive constraint, not on which technology is newest.

1. Risk acceptance
2. Security-control testing
3. Detective control
4. Documented exception
5. Parameterized queries

Correct answers: B, C

Why: Control testing verifies whether deployed safeguards actually prevent, detect, or respond as intended. It directly fits this scenario because the requirement is to confirm that a security control works in practice rather than only on paper. Detective controls identify events or conditions that have occurred or are occurring. It directly fits this scenario because the requirement is to identify attempted or successful exploitation for investigation.

Option review:

A: Risk acceptance means knowingly retaining a risk because it is within tolerance or remediation cost outweighs benefit. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify attempted or successful exploitation for investigation; confirm that a security control works in practice rather than only on paper.

B: Control testing verifies whether deployed safeguards actually prevent, detect, or respond as intended. It directly fits this scenario because the requirement is to confirm that a security control works in practice rather than only on paper.

C: Detective controls identify events or conditions that have occurred or are occurring. It directly fits this scenario because the requirement is to identify attempted or successful exploitation for investigation.

D: An exception formally records why a requirement cannot be met, the accepted residual risk, compensating controls, owner, and expiration or review date. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify attempted or successful exploitation for investigation; confirm that a security control works in practice rather than only on paper.

E: Parameterized database queries keep user data separate from query syntax and are a primary defense against SQL injection. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify attempted or successful exploitation for investigation; confirm that a security control works in practice rather than only on paper.

Learning point: Use Detective control, Security-control testing when the key requirement is to identify attempted or successful exploitation for investigation; confirm that a security control works in practice rather than only on paper.

Question 7

The primary objective for Humongous Insurance is to take immediate action after a vulnerability exploitation alert. Which selection best satisfies that objective in a regulated customer-data environment? Assume the activity is authorized and must follow normal enterprise change control.

1. Threat modeling
2. Secure SDLC
3. Prioritization and escalation
4. Responsive control
5. Preventive control

Correct answer: D

Why: Responsive controls trigger actions after detection to contain or manage an event. It directly fits this scenario because the requirement is to take immediate action after a vulnerability exploitation alert.

Option review:

A: Threat modeling systematically identifies assets, trust boundaries, abuse cases, likely threats, and mitigations before or during design. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to take immediate action after a vulnerability exploitation alert.

B: A secure SDLC integrates requirements, threat modeling, secure design, code review, testing, dependency management, and release controls throughout development. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to take immediate action after a vulnerability exploitation alert.

C: Vulnerabilities are escalated based on severity, exploitability, exposure, asset criticality, deadlines, and ownership. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to take immediate action after a vulnerability exploitation alert.

D: Responsive controls trigger actions after detection to contain or manage an event. It directly fits this scenario because the requirement is to take immediate action after a vulnerability exploitation alert.

E: Preventive controls aim to stop an unwanted event before it occurs. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to take immediate action after a vulnerability exploitation alert.

Learning point: Use Responsive control when the key requirement is to take immediate action after a vulnerability exploitation alert.

Question 8

At Contoso Health, a SOC analyst needs to repair the vulnerable state after a security event. Which option is the BEST fit for a hospital network? Assume no additional product-specific features are available beyond the concepts listed.

1. Post-remediation validation
2. Application data protection
3. Input validation
4. Secure SDLC
5. Corrective control

Correct answer: E

Why: Corrective controls restore systems or remove the underlying condition after a problem occurs. It directly fits this scenario because the requirement is to repair the vulnerable state after a security event.

Option review:

A: Validation rescans or otherwise verifies that remediation succeeded and did not leave the exposure in place. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to repair the vulnerable state after a security event.

B: Applications should minimize, encrypt, authorize, and safely retain sensitive data throughout its lifecycle. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to repair the vulnerable state after a security event.

C: Input validation rejects or normalizes unacceptable input before it reaches sensitive processing logic. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to repair the vulnerable state after a security event.

D: A secure SDLC integrates requirements, threat modeling, secure design, code review, testing, dependency management, and release controls throughout development. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to repair the vulnerable state after a security event.

E: Corrective controls restore systems or remove the underlying condition after a problem occurs. It directly fits this scenario because the requirement is to repair the vulnerable state after a security event.

Learning point: Use Corrective control when the key requirement is to repair the vulnerable state after a security event.

Question 9

For an airline operations network, a security operations engineer must satisfy all three needs: reduce deployment risk before rolling a security update into production; route an overdue critical finding to the appropriate decision maker; and prevent user input from changing SQL command structure. Select THREE. The organization wants a vendor-neutral approach that can be explained during audit review.

1. Patch testing
2. Input validation
3. Prioritization and escalation
4. Parameterized queries
5. Operational control

Correct answers: A, C, D

Why: Patch testing validates compatibility, security impact, dependencies, and rollback readiness before broad deployment. It directly fits this scenario because the requirement is to reduce deployment risk before rolling a security update into production. Vulnerabilities are escalated based on severity, exploitability, exposure, asset criticality, deadlines, and ownership. It directly fits this scenario because the requirement is to route an overdue critical finding to the appropriate decision maker. Parameterized database queries keep user data separate from query syntax and are a primary defense against SQL injection. It directly fits this scenario because the requirement is to prevent user input from changing SQL command structure.

Option review:

A: Patch testing validates compatibility, security impact, dependencies, and rollback readiness before broad deployment. It directly fits this scenario because the requirement is to reduce deployment risk before rolling a security update into production.

B: Input validation rejects or normalizes unacceptable input before it reaches sensitive processing logic. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce deployment risk before rolling a security update into production; route an overdue critical finding to the appropriate decision maker; prevent user input from changing SQL command structure.

C: Vulnerabilities are escalated based on severity, exploitability, exposure, asset criticality, deadlines, and ownership. It directly fits this scenario because the requirement is to route an overdue critical finding to the appropriate decision maker.

D: Parameterized database queries keep user data separate from query syntax and are a primary defense against SQL injection. It directly fits this scenario because the requirement is to prevent user input from changing SQL command structure.

E: Operational controls are implemented through people and processes such as procedures, training, and manual review. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce deployment risk before rolling a security update into production; route an overdue critical finding to the appropriate decision maker; prevent user input from changing SQL command structure.

Learning point: Use Patch testing, Prioritization and escalation, Parameterized queries when the key requirement is to reduce deployment risk before rolling a security update into production; route an overdue critical finding to the appropriate decision maker; prevent user input from changing SQL command structure.

Question 10

Lucerne Publishing is updating its security operations standard for a remote-work environment. Which option most directly helps the team deploy an approved security fix after testing? Base the decision on the primary security requirement, not on implementation convenience.

1. Detective control
2. Documented exception
3. Patch implementation
4. Output encoding
5. Attack-surface discovery

Correct answer: C

Why: Implementation applies the approved patch or configuration change to the defined target population. It directly fits this scenario because the requirement is to deploy an approved security fix after testing.

Option review:

A: Detective controls identify events or conditions that have occurred or are occurring. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to deploy an approved security fix after testing.

B: An exception formally records why a requirement cannot be met, the accepted residual risk, compensating controls, owner, and expiration or review date. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to deploy an approved security fix after testing.

C: Implementation applies the approved patch or configuration change to the defined target population. It directly fits this scenario because the requirement is to deploy an approved security fix after testing.

D: Context-aware output encoding ensures untrusted data is rendered as data rather than executable syntax. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to deploy an approved security fix after testing.

E: Edge and passive discovery identify exposed or unknown assets so the organization can reduce unmanaged attack surface. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to deploy an approved security fix after testing.

Learning point: Use Patch implementation when the key requirement is to deploy an approved security fix after testing.

Question 11

During a security review, a vulnerability analyst must address two separate needs: recover quickly if a security update breaks a critical application, and prevent user-controlled text from being interpreted as active script in output. Select TWO. The environment follows least privilege and preserves evidence where incident handling is involved.

1. Operational control
2. Rollback planning
3. Output encoding
4. Attack-surface reduction
5. Bug bounty program

Correct answers: B, C

Why: Rollback planning defines how to restore the previous known-good state if a remediation causes unacceptable problems. It directly fits this scenario because the requirement is to recover quickly if a security update breaks a critical application. Context-aware output encoding ensures untrusted data is rendered as data rather than executable syntax. It directly fits this scenario because the requirement is to prevent user-controlled text from being interpreted as active script in output.

Option review:

A: Operational controls are implemented through people and processes such as procedures, training, and manual review. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to recover quickly if a security update breaks a critical application; prevent user-controlled text from being interpreted as active script in output.

B: Rollback planning defines how to restore the previous known-good state if a remediation causes unacceptable problems. It directly fits this scenario because the requirement is to recover quickly if a security update breaks a critical application.

C: Context-aware output encoding ensures untrusted data is rendered as data rather than executable syntax. It directly fits this scenario because the requirement is to prevent user-controlled text from being interpreted as active script in output.

D: Attack-surface reduction removes unnecessary services, privileges, paths, exposure, or components. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to recover quickly if a security update breaks a critical application; prevent user-controlled text from being interpreted as active script in output.

E: A bug bounty invites external researchers to report vulnerabilities under defined scope, rules, and reward terms. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to recover quickly if a security update breaks a critical application; prevent user-controlled text from being interpreted as active script in output.

Learning point: Use Rollback planning, Output encoding when the key requirement is to recover quickly if a security update breaks a critical application; prevent user-controlled text from being interpreted as active script in output.

Question 12

At City Power Utilities, an OT security analyst has two simultaneous requirements: prove that a patch actually removed the vulnerability, and prevent stolen or predictable sessions from remaining usable. Which TWO options should be selected? Use the choice that most directly addresses the stated evidence rather than a broader control.

1. Preventive control
2. Session management
3. Threat modeling
4. Post-remediation validation
5. Risk acceptance

Correct answers: B, D

Why: Secure session management uses strong identifiers, expiration, rotation, cookie protections, and logout/invalidation controls. It directly fits this scenario because the requirement is to prevent stolen or predictable sessions from remaining usable. Validation rescans or otherwise verifies that remediation succeeded and did not leave the exposure in place. It directly fits this scenario because the requirement is to prove that a patch actually removed the vulnerability.

Option review:

A: Preventive controls aim to stop an unwanted event before it occurs. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prove that a patch actually removed the vulnerability; prevent stolen or predictable sessions from remaining usable.

B: Secure session management uses strong identifiers, expiration, rotation, cookie protections, and logout/invalidation controls. It directly fits this scenario because the requirement is to prevent stolen or predictable sessions from remaining usable.

C: Threat modeling systematically identifies assets, trust boundaries, abuse cases, likely threats, and mitigations before or during design. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prove that a patch actually removed the vulnerability; prevent stolen or predictable sessions from remaining usable.

D: Validation rescans or otherwise verifies that remediation succeeded and did not leave the exposure in place. It directly fits this scenario because the requirement is to prove that a patch actually removed the vulnerability.

E: Risk acceptance means knowingly retaining a risk because it is within tolerance or remediation cost outweighs benefit. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prove that a patch actually removed the vulnerability; prevent stolen or predictable sessions from remaining usable.

Learning point: Use Post-remediation validation, Session management when the key requirement is to prove that a patch actually removed the vulnerability; prevent stolen or predictable sessions from remaining usable.

Question 13

A review at A. Datum Logistics finds a gap: the team cannot reliably schedule disruptive remediation during an authorized period. Which option best closes that gap? The team wants the most defensible analyst action before expanding the investigation.

1. Prioritization and escalation
2. Maintenance window
3. Threat modeling
4. Technical control
5. Risk mitigation

Correct answer: B

Why: A maintenance window is an approved period for changes that may affect availability or performance. It directly fits this scenario because the requirement is to schedule disruptive remediation during an authorized period.

Option review:

A: Vulnerabilities are escalated based on severity, exploitability, exposure, asset criticality, deadlines, and ownership. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to schedule disruptive remediation during an authorized period.

B: A maintenance window is an approved period for changes that may affect availability or performance. It directly fits this scenario because the requirement is to schedule disruptive remediation during an authorized period.

C: Threat modeling systematically identifies assets, trust boundaries, abuse cases, likely threats, and mitigations before or during design. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to schedule disruptive remediation during an authorized period.

D: Technical controls use systems or technology such as access control, filtering, endpoint security, or encryption. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to schedule disruptive remediation during an authorized period.

E: Risk mitigation reduces likelihood or impact through remediation or controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to schedule disruptive remediation during an authorized period.

Learning point: Use Maintenance window when the key requirement is to schedule disruptive remediation during an authorized period.

Question 14

Northwind Traders is designing a combined control. It must temporarily defer remediation with formal approval and review conditions, and protect sensitive application data at rest and in transit. Which TWO options are most appropriate? Select based on the scenario’s decisive constraint, not on which technology is newest.

1. Application data protection
2. Threat modeling
3. Detective control
4. Documented exception
5. Risk acceptance

Correct answers: A, D

Why: Applications should minimize, encrypt, authorize, and safely retain sensitive data throughout its lifecycle. It directly fits this scenario because the requirement is to protect sensitive application data at rest and in transit. An exception formally records why a requirement cannot be met, the accepted residual risk, compensating controls, owner, and expiration or review date. It directly fits this scenario because the requirement is to temporarily defer remediation with formal approval and review conditions.

Option review:

A: Applications should minimize, encrypt, authorize, and safely retain sensitive data throughout its lifecycle. It directly fits this scenario because the requirement is to protect sensitive application data at rest and in transit.

B: Threat modeling systematically identifies assets, trust boundaries, abuse cases, likely threats, and mitigations before or during design. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to temporarily defer remediation with formal approval and review conditions; protect sensitive application data at rest and in transit.

C: Detective controls identify events or conditions that have occurred or are occurring. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to temporarily defer remediation with formal approval and review conditions; protect sensitive application data at rest and in transit.

D: An exception formally records why a requirement cannot be met, the accepted residual risk, compensating controls, owner, and expiration or review date. It directly fits this scenario because the requirement is to temporarily defer remediation with formal approval and review conditions.

E: Risk acceptance means knowingly retaining a risk because it is within tolerance or remediation cost outweighs benefit. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to temporarily defer remediation with formal approval and review conditions; protect sensitive application data at rest and in transit.

Learning point: Use Documented exception, Application data protection when the key requirement is to temporarily defer remediation with formal approval and review conditions; protect sensitive application data at rest and in transit.

Question 15

While supporting a SaaS-heavy business, a cloud security analyst is asked to decide to retain a low-impact risk with documented approval. Which concept or tool is the clearest match? Assume the activity is authorized and must follow normal enterprise change control.

1. Patch implementation
2. Risk acceptance
3. Managerial control
4. Threat modeling
5. Responsive control

Correct answer: B

Why: Risk acceptance means knowingly retaining a risk because it is within tolerance or remediation cost outweighs benefit. It directly fits this scenario because the requirement is to decide to retain a low-impact risk with documented approval.

Option review:

A: Implementation applies the approved patch or configuration change to the defined target population. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to decide to retain a low-impact risk with documented approval.

B: Risk acceptance means knowingly retaining a risk because it is within tolerance or remediation cost outweighs benefit. It directly fits this scenario because the requirement is to decide to retain a low-impact risk with documented approval.

C: Managerial controls include governance, policy, risk decisions, oversight, and administrative direction. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to decide to retain a low-impact risk with documented approval.

D: Threat modeling systematically identifies assets, trust boundaries, abuse cases, likely threats, and mitigations before or during design. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to decide to retain a low-impact risk with documented approval.

E: Responsive controls trigger actions after detection to contain or manage an event. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to decide to retain a low-impact risk with documented approval.

Learning point: Use Risk acceptance when the key requirement is to decide to retain a low-impact risk with documented approval.

Question 16

A new security procedure at Coho Winery must enable analysts to shift part of the impact to an insurer or contractual provider. Which option is the BEST choice? Assume no additional product-specific features are available beyond the concepts listed.

1. Risk mitigation
2. Risk transfer
3. Prioritization and escalation
4. Technical control
5. Patch testing

Correct answer: B

Why: Risk transfer shifts some financial or operational impact to another party through contracts, insurance, or service arrangements. It directly fits this scenario because the requirement is to shift part of the impact to an insurer or contractual provider.

Option review:

A: Risk mitigation reduces likelihood or impact through remediation or controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to shift part of the impact to an insurer or contractual provider.

B: Risk transfer shifts some financial or operational impact to another party through contracts, insurance, or service arrangements. It directly fits this scenario because the requirement is to shift part of the impact to an insurer or contractual provider.

C: Vulnerabilities are escalated based on severity, exploitability, exposure, asset criticality, deadlines, and ownership. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to shift part of the impact to an insurer or contractual provider.

D: Technical controls use systems or technology such as access control, filtering, endpoint security, or encryption. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to shift part of the impact to an insurer or contractual provider.

E: Patch testing validates compatibility, security impact, dependencies, and rollback readiness before broad deployment. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to shift part of the impact to an insurer or contractual provider.

Learning point: Use Risk transfer when the key requirement is to shift part of the impact to an insurer or contractual provider.

Question 17

The primary objective for Litware Manufacturing is to eliminate the risky service instead of operating it with controls. Which selection best satisfies that objective in a manufacturing plant? The organization wants a vendor-neutral approach that can be explained during audit review.

1. Risk acceptance
2. Compensating control
3. Input validation
4. Risk avoidance
5. Secure authentication implementation

Correct answer: D

Why: Risk avoidance removes the activity or asset that creates the risk. It directly fits this scenario because the requirement is to eliminate the risky service instead of operating it with controls.

Option review:

A: Risk acceptance means knowingly retaining a risk because it is within tolerance or remediation cost outweighs benefit. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to eliminate the risky service instead of operating it with controls.

B: A compensating control provides alternative risk reduction when the preferred control cannot be implemented as designed. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to eliminate the risky service instead of operating it with controls.

C: Input validation rejects or normalizes unacceptable input before it reaches sensitive processing logic. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to eliminate the risky service instead of operating it with controls.

D: Risk avoidance removes the activity or asset that creates the risk. It directly fits this scenario because the requirement is to eliminate the risky service instead of operating it with controls.

E: Authentication code should use proven identity libraries, secure credential storage, MFA where appropriate, and safe recovery flows. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to eliminate the risky service instead of operating it with controls.

Learning point: Use Risk avoidance when the key requirement is to eliminate the risky service instead of operating it with controls.

Question 18

At Fourth Coffee, a security administrator needs to lower risk by applying a patch or compensating safeguard. Which option is the BEST fit for a multi-site enterprise? Base the decision on the primary security requirement, not on implementation convenience.

1. Parameterized queries
2. Risk mitigation
3. Penetration testing and adversary emulation
4. Secure authentication implementation
5. Patch implementation

Correct answer: B

Why: Risk mitigation reduces likelihood or impact through remediation or controls. It directly fits this scenario because the requirement is to lower risk by applying a patch or compensating safeguard.

Option review:

A: Parameterized database queries keep user data separate from query syntax and are a primary defense against SQL injection. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to lower risk by applying a patch or compensating safeguard.

B: Risk mitigation reduces likelihood or impact through remediation or controls. It directly fits this scenario because the requirement is to lower risk by applying a patch or compensating safeguard.

C: Authorized offensive testing validates exploitable attack paths and defensive effectiveness under controlled conditions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to lower risk by applying a patch or compensating safeguard.

D: Authentication code should use proven identity libraries, secure credential storage, MFA where appropriate, and safe recovery flows. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to lower risk by applying a patch or compensating safeguard.

E: Implementation applies the approved patch or configuration change to the defined target population. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to lower risk by applying a patch or compensating safeguard.

Learning point: Use Risk mitigation when the key requirement is to lower risk by applying a patch or compensating safeguard.

Question 19

During a security review, a response lead must address two separate needs: set a measurable target for how quickly critical findings must be remediated, and address vulnerability risk through policy, governance, or management decision. Select TWO. The environment follows least privilege and preserves evidence where incident handling is involved.

1. Managerial control
2. Secure SDLC
3. Governance and service-level objectives
4. Penetration testing and adversary emulation
5. Security-control testing

Correct answers: A, C

Why: Managerial controls include governance, policy, risk decisions, oversight, and administrative direction. It directly fits this scenario because the requirement is to address vulnerability risk through policy, governance, or management decision. Policies, governance, and SLOs define responsibilities, expected remediation performance, and measurable targets. It directly fits this scenario because the requirement is to set a measurable target for how quickly critical findings must be remediated.

Option review:

A: Managerial controls include governance, policy, risk decisions, oversight, and administrative direction. It directly fits this scenario because the requirement is to address vulnerability risk through policy, governance, or management decision.

B: A secure SDLC integrates requirements, threat modeling, secure design, code review, testing, dependency management, and release controls throughout development. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to set a measurable target for how quickly critical findings must be remediated; address vulnerability risk through policy, governance, or management decision.

C: Policies, governance, and SLOs define responsibilities, expected remediation performance, and measurable targets. It directly fits this scenario because the requirement is to set a measurable target for how quickly critical findings must be remediated.

D: Authorized offensive testing validates exploitable attack paths and defensive effectiveness under controlled conditions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to set a measurable target for how quickly critical findings must be remediated; address vulnerability risk through policy, governance, or management decision.

E: Control testing verifies whether deployed safeguards actually prevent, detect, or respond as intended. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to set a measurable target for how quickly critical findings must be remediated; address vulnerability risk through policy, governance, or management decision.

Learning point: Use Governance and service-level objectives, Managerial control when the key requirement is to set a measurable target for how quickly critical findings must be remediated; address vulnerability risk through policy, governance, or management decision.

Question 20

Adventure Works is updating its security operations standard for a hybrid-cloud workload. Which option most directly helps the team route an overdue critical finding to the appropriate decision maker? Use the choice that most directly addresses the stated evidence rather than a broader control.

1. Managerial control
2. Secure authentication implementation
3. Risk transfer
4. Prioritization and escalation
5. Risk avoidance

Correct answer: D

Why: Vulnerabilities are escalated based on severity, exploitability, exposure, asset criticality, deadlines, and ownership. It directly fits this scenario because the requirement is to route an overdue critical finding to the appropriate decision maker.

Option review:

A: Managerial controls include governance, policy, risk decisions, oversight, and administrative direction. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to route an overdue critical finding to the appropriate decision maker.

B: Authentication code should use proven identity libraries, secure credential storage, MFA where appropriate, and safe recovery flows. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to route an overdue critical finding to the appropriate decision maker.

C: Risk transfer shifts some financial or operational impact to another party through contracts, insurance, or service arrangements. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to route an overdue critical finding to the appropriate decision maker.

D: Vulnerabilities are escalated based on severity, exploitability, exposure, asset criticality, deadlines, and ownership. It directly fits this scenario because the requirement is to route an overdue critical finding to the appropriate decision maker.

E: Risk avoidance removes the activity or asset that creates the risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to route an overdue critical finding to the appropriate decision maker.

Learning point: Use Prioritization and escalation when the key requirement is to route an overdue critical finding to the appropriate decision maker.

Question 21

For a global corporate network, the team must accomplish both of these goals: find internet-facing or previously unknown assets before attackers do, and apply a technology-enforced safeguard to reduce vulnerability exposure. Which TWO choices together provide the best match? The team wants the most defensible analyst action before expanding the investigation.

1. Attack-surface discovery
2. Post-remediation validation
3. Preventive control
4. Detective control
5. Technical control

Correct answers: A, E

Why: Edge and passive discovery identify exposed or unknown assets so the organization can reduce unmanaged attack surface. It directly fits this scenario because the requirement is to find internet-facing or previously unknown assets before attackers do. Technical controls use systems or technology such as access control, filtering, endpoint security, or encryption. It directly fits this scenario because the requirement is to apply a technology-enforced safeguard to reduce vulnerability exposure.

Option review:

A: Edge and passive discovery identify exposed or unknown assets so the organization can reduce unmanaged attack surface. It directly fits this scenario because the requirement is to find internet-facing or previously unknown assets before attackers do.

B: Validation rescans or otherwise verifies that remediation succeeded and did not leave the exposure in place. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to find internet-facing or previously unknown assets before attackers do; apply a technology-enforced safeguard to reduce vulnerability exposure.

C: Preventive controls aim to stop an unwanted event before it occurs. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to find internet-facing or previously unknown assets before attackers do; apply a technology-enforced safeguard to reduce vulnerability exposure.

D: Detective controls identify events or conditions that have occurred or are occurring. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to find internet-facing or previously unknown assets before attackers do; apply a technology-enforced safeguard to reduce vulnerability exposure.

E: Technical controls use systems or technology such as access control, filtering, endpoint security, or encryption. It directly fits this scenario because the requirement is to apply a technology-enforced safeguard to reduce vulnerability exposure.

Learning point: Use Attack-surface discovery, Technical control when the key requirement is to find internet-facing or previously unknown assets before attackers do; apply a technology-enforced safeguard to reduce vulnerability exposure.

Question 22

At Datum Fabrication, the response plan has three distinct requirements: confirm that a security control works in practice rather than only on paper; identify architectural threats and required mitigations before coding is complete; and recover quickly if a security update breaks a critical application. Which THREE options should be selected? Select based on the scenario’s decisive constraint, not on which technology is newest.

1. Risk transfer
2. Threat modeling
3. Compensating control
4. Security-control testing
5. Rollback planning

Correct answers: B, D, E

Why: Threat modeling systematically identifies assets, trust boundaries, abuse cases, likely threats, and mitigations before or during design. It directly fits this scenario because the requirement is to identify architectural threats and required mitigations before coding is complete. Control testing verifies whether deployed safeguards actually prevent, detect, or respond as intended. It directly fits this scenario because the requirement is to confirm that a security control works in practice rather than only on paper. Rollback planning defines how to restore the previous known-good state if a remediation causes unacceptable problems. It directly fits this scenario because the requirement is to recover quickly if a security update breaks a critical application.

Option review:

A: Risk transfer shifts some financial or operational impact to another party through contracts, insurance, or service arrangements. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to confirm that a security control works in practice rather than only on paper; identify architectural threats and required mitigations before coding is complete; recover quickly if a security update breaks a critical application.

B: Threat modeling systematically identifies assets, trust boundaries, abuse cases, likely threats, and mitigations before or during design. It directly fits this scenario because the requirement is to identify architectural threats and required mitigations before coding is complete.

C: A compensating control provides alternative risk reduction when the preferred control cannot be implemented as designed. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to confirm that a security control works in practice rather than only on paper; identify architectural threats and required mitigations before coding is complete; recover quickly if a security update breaks a critical application.

D: Control testing verifies whether deployed safeguards actually prevent, detect, or respond as intended. It directly fits this scenario because the requirement is to confirm that a security control works in practice rather than only on paper.

E: Rollback planning defines how to restore the previous known-good state if a remediation causes unacceptable problems. It directly fits this scenario because the requirement is to recover quickly if a security update breaks a critical application.

Learning point: Use Security-control testing, Threat modeling, Rollback planning when the key requirement is to confirm that a security control works in practice rather than only on paper; identify architectural threats and required mitigations before coding is complete; recover quickly if a security update breaks a critical application.

Question 23

For an e-commerce platform, a SOC lead must satisfy all three needs: test realistic attack paths under explicit authorization; reduce risk temporarily because the primary remediation cannot yet be deployed; and prove that a patch actually removed the vulnerability. Select THREE. Assume the activity is authorized and must follow normal enterprise change control.

1. Compensating control
2. Documented exception
3. Penetration testing and adversary emulation
4. Post-remediation validation
5. Session management

Correct answers: A, C, D

Why: A compensating control provides alternative risk reduction when the preferred control cannot be implemented as designed. It directly fits this scenario because the requirement is to reduce risk temporarily because the primary remediation cannot yet be deployed. Authorized offensive testing validates exploitable attack paths and defensive effectiveness under controlled conditions. It directly fits this scenario because the requirement is to test realistic attack paths under explicit authorization. Validation rescans or otherwise verifies that remediation succeeded and did not leave the exposure in place. It directly fits this scenario because the requirement is to prove that a patch actually removed the vulnerability.

Option review:

A: A compensating control provides alternative risk reduction when the preferred control cannot be implemented as designed. It directly fits this scenario because the requirement is to reduce risk temporarily because the primary remediation cannot yet be deployed.

B: An exception formally records why a requirement cannot be met, the accepted residual risk, compensating controls, owner, and expiration or review date. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to test realistic attack paths under explicit authorization; reduce risk temporarily because the primary remediation cannot yet be deployed; prove that a patch actually removed the vulnerability.

C: Authorized offensive testing validates exploitable attack paths and defensive effectiveness under controlled conditions. It directly fits this scenario because the requirement is to test realistic attack paths under explicit authorization.

D: Validation rescans or otherwise verifies that remediation succeeded and did not leave the exposure in place. It directly fits this scenario because the requirement is to prove that a patch actually removed the vulnerability.

E: Secure session management uses strong identifiers, expiration, rotation, cookie protections, and logout/invalidation controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to test realistic attack paths under explicit authorization; reduce risk temporarily because the primary remediation cannot yet be deployed; prove that a patch actually removed the vulnerability.

Learning point: Use Penetration testing and adversary emulation, Compensating control, Post-remediation validation when the key requirement is to test realistic attack paths under explicit authorization; reduce risk temporarily because the primary remediation cannot yet be deployed; prove that a patch actually removed the vulnerability.

Question 24

a malware analyst at Proseware Research is comparing several approaches. The deciding requirement is to use a structured external-researcher program to discover weaknesses. Which option should be chosen? Assume no additional product-specific features are available beyond the concepts listed.

1. Detective control
2. Patch implementation
3. Bug bounty program
4. Parameterized queries
5. Patch testing

Correct answer: C

Why: A bug bounty invites external researchers to report vulnerabilities under defined scope, rules, and reward terms. It directly fits this scenario because the requirement is to use a structured external-researcher program to discover weaknesses.

Option review:

A: Detective controls identify events or conditions that have occurred or are occurring. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to use a structured external-researcher program to discover weaknesses.

B: Implementation applies the approved patch or configuration change to the defined target population. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to use a structured external-researcher program to discover weaknesses.

C: A bug bounty invites external researchers to report vulnerabilities under defined scope, rules, and reward terms. It directly fits this scenario because the requirement is to use a structured external-researcher program to discover weaknesses.

D: Parameterized database queries keep user data separate from query syntax and are a primary defense against SQL injection. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to use a structured external-researcher program to discover weaknesses.

E: Patch testing validates compatibility, security impact, dependencies, and rollback readiness before broad deployment. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to use a structured external-researcher program to discover weaknesses.

Learning point: Use Bug bounty program when the key requirement is to use a structured external-researcher program to discover weaknesses.

Question 25

While supporting a managed cloud environment, a SOC analyst is asked to reduce the number of reachable ways an attacker can interact with systems. Which concept or tool is the clearest match? The organization wants a vendor-neutral approach that can be explained during audit review.

1. Session management
2. Managerial control
3. Patch testing
4. Risk avoidance
5. Attack-surface reduction

Correct answer: E

Why: Attack-surface reduction removes unnecessary services, privileges, paths, exposure, or components. It directly fits this scenario because the requirement is to reduce the number of reachable ways an attacker can interact with systems.

Option review:

A: Secure session management uses strong identifiers, expiration, rotation, cookie protections, and logout/invalidation controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce the number of reachable ways an attacker can interact with systems.

B: Managerial controls include governance, policy, risk decisions, oversight, and administrative direction. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce the number of reachable ways an attacker can interact with systems.

C: Patch testing validates compatibility, security impact, dependencies, and rollback readiness before broad deployment. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce the number of reachable ways an attacker can interact with systems.

D: Risk avoidance removes the activity or asset that creates the risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce the number of reachable ways an attacker can interact with systems.

E: Attack-surface reduction removes unnecessary services, privileges, paths, exposure, or components. It directly fits this scenario because the requirement is to reduce the number of reachable ways an attacker can interact with systems.

Learning point: Use Attack-surface reduction when the key requirement is to reduce the number of reachable ways an attacker can interact with systems.

Question 26

Woodgrove Bank is designing a combined control. It must constrain untrusted input to expected type, length, format, or range, and reduce deployment risk before rolling a security update into production. Which TWO options are most appropriate? Base the decision on the primary security requirement, not on implementation convenience.

1. Responsive control
2. Parameterized queries
3. Corrective control
4. Input validation
5. Patch testing

Correct answers: D, E

Why: Input validation rejects or normalizes unacceptable input before it reaches sensitive processing logic. It directly fits this scenario because the requirement is to constrain untrusted input to expected type, length, format, or range. Patch testing validates compatibility, security impact, dependencies, and rollback readiness before broad deployment. It directly fits this scenario because the requirement is to reduce deployment risk before rolling a security update into production.

Option review:

A: Responsive controls trigger actions after detection to contain or manage an event. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to constrain untrusted input to expected type, length, format, or range; reduce deployment risk before rolling a security update into production.

B: Parameterized database queries keep user data separate from query syntax and are a primary defense against SQL injection. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to constrain untrusted input to expected type, length, format, or range; reduce deployment risk before rolling a security update into production.

C: Corrective controls restore systems or remove the underlying condition after a problem occurs. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to constrain untrusted input to expected type, length, format, or range; reduce deployment risk before rolling a security update into production.

D: Input validation rejects or normalizes unacceptable input before it reaches sensitive processing logic. It directly fits this scenario because the requirement is to constrain untrusted input to expected type, length, format, or range.

E: Patch testing validates compatibility, security impact, dependencies, and rollback readiness before broad deployment. It directly fits this scenario because the requirement is to reduce deployment risk before rolling a security update into production.

Learning point: Use Input validation, Patch testing when the key requirement is to constrain untrusted input to expected type, length, format, or range; reduce deployment risk before rolling a security update into production.

Question 27

The primary objective for Humongous Insurance is to prevent user-controlled text from being interpreted as active script in output. Which selection best satisfies that objective in a regulated customer-data environment? The environment follows least privilege and preserves evidence where incident handling is involved.

1. Penetration testing and adversary emulation
2. Threat modeling
3. Parameterized queries
4. Risk transfer
5. Output encoding

Correct answer: E

Why: Context-aware output encoding ensures untrusted data is rendered as data rather than executable syntax. It directly fits this scenario because the requirement is to prevent user-controlled text from being interpreted as active script in output.

Option review:

A: Authorized offensive testing validates exploitable attack paths and defensive effectiveness under controlled conditions. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent user-controlled text from being interpreted as active script in output.

B: Threat modeling systematically identifies assets, trust boundaries, abuse cases, likely threats, and mitigations before or during design. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent user-controlled text from being interpreted as active script in output.

C: Parameterized database queries keep user data separate from query syntax and are a primary defense against SQL injection. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent user-controlled text from being interpreted as active script in output.

D: Risk transfer shifts some financial or operational impact to another party through contracts, insurance, or service arrangements. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent user-controlled text from being interpreted as active script in output.

E: Context-aware output encoding ensures untrusted data is rendered as data rather than executable syntax. It directly fits this scenario because the requirement is to prevent user-controlled text from being interpreted as active script in output.

Learning point: Use Output encoding when the key requirement is to prevent user-controlled text from being interpreted as active script in output.

Question 28

At Contoso Health, a SOC analyst has two simultaneous requirements: prevent stolen or predictable sessions from remaining usable, and recover quickly if a security update breaks a critical application. Which TWO options should be selected? Use the choice that most directly addresses the stated evidence rather than a broader control.

1. Session management
2. Preventive control
3. Risk avoidance
4. Risk mitigation
5. Rollback planning

Correct answers: A, E

Why: Secure session management uses strong identifiers, expiration, rotation, cookie protections, and logout/invalidation controls. It directly fits this scenario because the requirement is to prevent stolen or predictable sessions from remaining usable. Rollback planning defines how to restore the previous known-good state if a remediation causes unacceptable problems. It directly fits this scenario because the requirement is to recover quickly if a security update breaks a critical application.

Option review:

A: Secure session management uses strong identifiers, expiration, rotation, cookie protections, and logout/invalidation controls. It directly fits this scenario because the requirement is to prevent stolen or predictable sessions from remaining usable.

B: Preventive controls aim to stop an unwanted event before it occurs. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent stolen or predictable sessions from remaining usable; recover quickly if a security update breaks a critical application.

C: Risk avoidance removes the activity or asset that creates the risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent stolen or predictable sessions from remaining usable; recover quickly if a security update breaks a critical application.

D: Risk mitigation reduces likelihood or impact through remediation or controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent stolen or predictable sessions from remaining usable; recover quickly if a security update breaks a critical application.

E: Rollback planning defines how to restore the previous known-good state if a remediation causes unacceptable problems. It directly fits this scenario because the requirement is to recover quickly if a security update breaks a critical application.

Learning point: Use Session management, Rollback planning when the key requirement is to prevent stolen or predictable sessions from remaining usable; recover quickly if a security update breaks a critical application.

Question 29

For an airline operations network, the team must accomplish both of these goals: avoid custom weak login logic and insecure credential handling, and prove that a patch actually removed the vulnerability. Which TWO choices together provide the best match? The team wants the most defensible analyst action before expanding the investigation.

1. Risk avoidance
2. Output encoding
3. Secure authentication implementation
4. Compensating control
5. Post-remediation validation

Correct answers: C, E

Why: Authentication code should use proven identity libraries, secure credential storage, MFA where appropriate, and safe recovery flows. It directly fits this scenario because the requirement is to avoid custom weak login logic and insecure credential handling. Validation rescans or otherwise verifies that remediation succeeded and did not leave the exposure in place. It directly fits this scenario because the requirement is to prove that a patch actually removed the vulnerability.

Option review:

A: Risk avoidance removes the activity or asset that creates the risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to avoid custom weak login logic and insecure credential handling; prove that a patch actually removed the vulnerability.

B: Context-aware output encoding ensures untrusted data is rendered as data rather than executable syntax. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to avoid custom weak login logic and insecure credential handling; prove that a patch actually removed the vulnerability.

C: Authentication code should use proven identity libraries, secure credential storage, MFA where appropriate, and safe recovery flows. It directly fits this scenario because the requirement is to avoid custom weak login logic and insecure credential handling.

D: A compensating control provides alternative risk reduction when the preferred control cannot be implemented as designed. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to avoid custom weak login logic and insecure credential handling; prove that a patch actually removed the vulnerability.

E: Validation rescans or otherwise verifies that remediation succeeded and did not leave the exposure in place. It directly fits this scenario because the requirement is to prove that a patch actually removed the vulnerability.

Learning point: Use Secure authentication implementation, Post-remediation validation when the key requirement is to avoid custom weak login logic and insecure credential handling; prove that a patch actually removed the vulnerability.

Question 30

Lucerne Publishing is updating its security operations standard for a remote-work environment. Which option most directly helps the team protect sensitive application data at rest and in transit? Select based on the scenario’s decisive constraint, not on which technology is newest.

1. Application data protection
2. Patch implementation
3. Managerial control
4. Risk mitigation
5. Bug bounty program

Correct answer: A

Why: Applications should minimize, encrypt, authorize, and safely retain sensitive data throughout its lifecycle. It directly fits this scenario because the requirement is to protect sensitive application data at rest and in transit.

Option review:

A: Applications should minimize, encrypt, authorize, and safely retain sensitive data throughout its lifecycle. It directly fits this scenario because the requirement is to protect sensitive application data at rest and in transit.

B: Implementation applies the approved patch or configuration change to the defined target population. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to protect sensitive application data at rest and in transit.

C: Managerial controls include governance, policy, risk decisions, oversight, and administrative direction. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to protect sensitive application data at rest and in transit.

D: Risk mitigation reduces likelihood or impact through remediation or controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to protect sensitive application data at rest and in transit.

E: A bug bounty invites external researchers to report vulnerabilities under defined scope, rules, and reward terms. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to protect sensitive application data at rest and in transit.

Learning point: Use Application data protection when the key requirement is to protect sensitive application data at rest and in transit.

Question 31

A ticket at Fabrikam Finance asks a vulnerability analyst to prevent user input from changing SQL command structure. Which choice addresses the requirement most directly? Assume the activity is authorized and must follow normal enterprise change control.

1. Prioritization and escalation
2. Parameterized queries
3. Risk transfer
4. Secure authentication implementation
5. Session management

Correct answer: B

Why: Parameterized database queries keep user data separate from query syntax and are a primary defense against SQL injection. It directly fits this scenario because the requirement is to prevent user input from changing SQL command structure.

Option review:

A: Vulnerabilities are escalated based on severity, exploitability, exposure, asset criticality, deadlines, and ownership. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent user input from changing SQL command structure.

B: Parameterized database queries keep user data separate from query syntax and are a primary defense against SQL injection. It directly fits this scenario because the requirement is to prevent user input from changing SQL command structure.

C: Risk transfer shifts some financial or operational impact to another party through contracts, insurance, or service arrangements. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent user input from changing SQL command structure.

D: Authentication code should use proven identity libraries, secure credential storage, MFA where appropriate, and safe recovery flows. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent user input from changing SQL command structure.

E: Secure session management uses strong identifiers, expiration, rotation, cookie protections, and logout/invalidation controls. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to prevent user input from changing SQL command structure.

Learning point: Use Parameterized queries when the key requirement is to prevent user input from changing SQL command structure.

Question 32

At City Power Utilities, an OT security analyst has two simultaneous requirements: address vulnerabilities continuously from design through deployment, and decide to retain a low-impact risk with documented approval. Which TWO options should be selected? Assume no additional product-specific features are available beyond the concepts listed.

1. Maintenance window
2. Risk acceptance
3. Operational control
4. Secure SDLC
5. Risk avoidance

Correct answers: B, D

Why: Risk acceptance means knowingly retaining a risk because it is within tolerance or remediation cost outweighs benefit. It directly fits this scenario because the requirement is to decide to retain a low-impact risk with documented approval. A secure SDLC integrates requirements, threat modeling, secure design, code review, testing, dependency management, and release controls throughout development. It directly fits this scenario because the requirement is to address vulnerabilities continuously from design through deployment.

Option review:

A: A maintenance window is an approved period for changes that may affect availability or performance. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to address vulnerabilities continuously from design through deployment; decide to retain a low-impact risk with documented approval.

B: Risk acceptance means knowingly retaining a risk because it is within tolerance or remediation cost outweighs benefit. It directly fits this scenario because the requirement is to decide to retain a low-impact risk with documented approval.

C: Operational controls are implemented through people and processes such as procedures, training, and manual review. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to address vulnerabilities continuously from design through deployment; decide to retain a low-impact risk with documented approval.

D: A secure SDLC integrates requirements, threat modeling, secure design, code review, testing, dependency management, and release controls throughout development. It directly fits this scenario because the requirement is to address vulnerabilities continuously from design through deployment.

E: Risk avoidance removes the activity or asset that creates the risk. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to address vulnerabilities continuously from design through deployment; decide to retain a low-impact risk with documented approval.

Learning point: Use Secure SDLC, Risk acceptance when the key requirement is to address vulnerabilities continuously from design through deployment; decide to retain a low-impact risk with documented approval.

Question 33

A review at A. Datum Logistics finds a gap: the team cannot reliably identify architectural threats and required mitigations before coding is complete. Which option best closes that gap? The organization wants a vendor-neutral approach that can be explained during audit review.

1. Attack-surface discovery
2. Responsive control
3. Threat modeling
4. Parameterized queries
5. Risk acceptance

Correct answer: C

Why: Threat modeling systematically identifies assets, trust boundaries, abuse cases, likely threats, and mitigations before or during design. It directly fits this scenario because the requirement is to identify architectural threats and required mitigations before coding is complete.

Option review:

A: Edge and passive discovery identify exposed or unknown assets so the organization can reduce unmanaged attack surface. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify architectural threats and required mitigations before coding is complete.

B: Responsive controls trigger actions after detection to contain or manage an event. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify architectural threats and required mitigations before coding is complete.

C: Threat modeling systematically identifies assets, trust boundaries, abuse cases, likely threats, and mitigations before or during design. It directly fits this scenario because the requirement is to identify architectural threats and required mitigations before coding is complete.

D: Parameterized database queries keep user data separate from query syntax and are a primary defense against SQL injection. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify architectural threats and required mitigations before coding is complete.

E: Risk acceptance means knowingly retaining a risk because it is within tolerance or remediation cost outweighs benefit. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to identify architectural threats and required mitigations before coding is complete.

Learning point: Use Threat modeling when the key requirement is to identify architectural threats and required mitigations before coding is complete.

Question 34

a security engineer at Northwind Traders is comparing several approaches. The deciding requirement is to reduce risk temporarily because the primary remediation cannot yet be deployed. Which option should be chosen? Base the decision on the primary security requirement, not on implementation convenience.

1. Secure SDLC
2. Compensating control
3. Technical control
4. Input validation
5. Preventive control

Correct answer: B

Why: A compensating control provides alternative risk reduction when the preferred control cannot be implemented as designed. It directly fits this scenario because the requirement is to reduce risk temporarily because the primary remediation cannot yet be deployed.

Option review:

A: A secure SDLC integrates requirements, threat modeling, secure design, code review, testing, dependency management, and release controls throughout development. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce risk temporarily because the primary remediation cannot yet be deployed.

B: A compensating control provides alternative risk reduction when the preferred control cannot be implemented as designed. It directly fits this scenario because the requirement is to reduce risk temporarily because the primary remediation cannot yet be deployed.

C: Technical controls use systems or technology such as access control, filtering, endpoint security, or encryption. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce risk temporarily because the primary remediation cannot yet be deployed.

D: Input validation rejects or normalizes unacceptable input before it reaches sensitive processing logic. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce risk temporarily because the primary remediation cannot yet be deployed.

E: Preventive controls aim to stop an unwanted event before it occurs. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce risk temporarily because the primary remediation cannot yet be deployed.

Learning point: Use Compensating control when the key requirement is to reduce risk temporarily because the primary remediation cannot yet be deployed.

Question 35

While supporting a SaaS-heavy business, a cloud security analyst is asked to address vulnerability risk through policy, governance, or management decision. Which concept or tool is the clearest match? The environment follows least privilege and preserves evidence where incident handling is involved.

1. Detective control
2. Managerial control
3. Attack-surface reduction
4. Application data protection
5. Patch testing

Correct answer: B

Why: Managerial controls include governance, policy, risk decisions, oversight, and administrative direction. It directly fits this scenario because the requirement is to address vulnerability risk through policy, governance, or management decision.

Option review:

A: Detective controls identify events or conditions that have occurred or are occurring. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to address vulnerability risk through policy, governance, or management decision.

B: Managerial controls include governance, policy, risk decisions, oversight, and administrative direction. It directly fits this scenario because the requirement is to address vulnerability risk through policy, governance, or management decision.

C: Attack-surface reduction removes unnecessary services, privileges, paths, exposure, or components. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to address vulnerability risk through policy, governance, or management decision.

D: Applications should minimize, encrypt, authorize, and safely retain sensitive data throughout its lifecycle. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to address vulnerability risk through policy, governance, or management decision.

E: Patch testing validates compatibility, security impact, dependencies, and rollback readiness before broad deployment. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to address vulnerability risk through policy, governance, or management decision.

Learning point: Use Managerial control when the key requirement is to address vulnerability risk through policy, governance, or management decision.

Question 36

At Coho Winery, a systems security analyst has two simultaneous requirements: reduce vulnerability risk through a repeatable human or process activity, and set a measurable target for how quickly critical findings must be remediated. Which TWO options should be selected? Use the choice that most directly addresses the stated evidence rather than a broader control.

1. Prioritization and escalation
2. Operational control
3. Technical control
4. Application data protection
5. Governance and service-level objectives

Correct answers: B, E

Why: Operational controls are implemented through people and processes such as procedures, training, and manual review. It directly fits this scenario because the requirement is to reduce vulnerability risk through a repeatable human or process activity. Policies, governance, and SLOs define responsibilities, expected remediation performance, and measurable targets. It directly fits this scenario because the requirement is to set a measurable target for how quickly critical findings must be remediated.

Option review:

A: Vulnerabilities are escalated based on severity, exploitability, exposure, asset criticality, deadlines, and ownership. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce vulnerability risk through a repeatable human or process activity; set a measurable target for how quickly critical findings must be remediated.

B: Operational controls are implemented through people and processes such as procedures, training, and manual review. It directly fits this scenario because the requirement is to reduce vulnerability risk through a repeatable human or process activity.

C: Technical controls use systems or technology such as access control, filtering, endpoint security, or encryption. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce vulnerability risk through a repeatable human or process activity; set a measurable target for how quickly critical findings must be remediated.

D: Applications should minimize, encrypt, authorize, and safely retain sensitive data throughout its lifecycle. This can be useful in the right situation, but it does not most directly satisfy the scenario requirement to reduce vulnerability risk through a repeatable human or process activity; set a measurable target for how quickly critical findings must be remediated.

E: Policies, governance, and SLOs define responsibilities, expected remediation performance, and measurable targets. It directly fits this scenario because the requirement is to set a measurable target for how quickly critical findings must be remediated.

Learning point: Use Operational control, Governance and service-level objectives when the key requirement is to reduce vulnerability risk through a repeatable human or process activity; set a measurable target for how quickly critical findings must be remediated.