CompTIA Network+ N10-009 Identity Encryption Segmentation Physical Security And Compliance Practice Test

 

Objective 4.1 • 25 original questions

This CompTIA Network+ N10-009 practice test focuses on basic network security concepts. All questions are original ExamSnap scenarios aligned to the current N10-009 blueprint; they are not copied from CompTIA exam content. Use the complete N10-009 collection for broader practice across all five domains. For broader exam preparation, review the CompTIA Network+ N10-009 Exam Dumps page.

Instructions: Select the best answer for each question. Review the explanation after answering; each distractor includes a reason it is not the best choice for that scenario.

Question 1

At Litware Manufacturing, a systems administrator is reviewing a network change. The requirement is to prevent eavesdroppers from reading data crossing an untrusted network. Which option is the best fit? The decision applies to a branch-office rollout.

1. Risk
2. SCADA/ICS/OT segmentation
3. Encryption in transit
4. Least privilege
5. GDPR

Correct answer: C

Why: Protects data while it traverses networks, commonly using TLS, IPsec, or similar protocols. This directly satisfies the requirement: prevent eavesdroppers from reading data crossing an untrusted network.

Option review:

A: Represents the likelihood and impact of a threat exploiting a vulnerability. However, it does not most directly satisfy the requirement in this scenario: prevent eavesdroppers from reading data crossing an untrusted network.

B: Protects industrial-control networks from unnecessary enterprise/user access. However, it does not most directly satisfy the requirement in this scenario: prevent eavesdroppers from reading data crossing an untrusted network.

C: Protects data while it traverses networks, commonly using TLS, IPsec, or similar protocols. This directly satisfies the requirement: prevent eavesdroppers from reading data crossing an untrusted network.

D: Grants only the access needed to perform assigned duties. However, it does not most directly satisfy the requirement in this scenario: prevent eavesdroppers from reading data crossing an untrusted network.

E: EU privacy regulation governs personal-data processing and related obligations. However, it does not most directly satisfy the requirement in this scenario: prevent eavesdroppers from reading data crossing an untrusted network.

Learning point: Use Encryption in transit when the key requirement is to prevent eavesdroppers from reading data crossing an untrusted network.

Question 2

A ticket at Woodgrove Bank says the team must protect sensitive information if storage media is stolen or accessed offline. Which technology or concept most directly addresses this requirement? The decision applies to a campus refresh.

1. Network segmentation
2. Encryption at rest
3. Security camera
4. Encryption in transit
5. Risk

Correct answer: B

Why: Protects stored data on disks, databases, or backups. This directly satisfies the requirement: protect sensitive information if storage media is stolen or accessed offline.

Option review:

A: Separates systems into zones/segments to reduce exposure and limit lateral movement. However, it does not most directly satisfy the requirement in this scenario: protect sensitive information if storage media is stolen or accessed offline.

B: Protects stored data on disks, databases, or backups. This directly satisfies the requirement: protect sensitive information if storage media is stolen or accessed offline.

C: Provides physical monitoring and evidentiary visibility around sensitive facilities. However, it does not most directly satisfy the requirement in this scenario: protect sensitive information if storage media is stolen or accessed offline.

D: Protects data while it traverses networks, commonly using TLS, IPsec, or similar protocols. However, it does not most directly satisfy the requirement in this scenario: protect sensitive information if storage media is stolen or accessed offline.

E: Represents the likelihood and impact of a threat exploiting a vulnerability. However, it does not most directly satisfy the requirement in this scenario: protect sensitive information if storage media is stolen or accessed offline.

Learning point: Use Encryption at rest when the key requirement is to protect sensitive information if storage media is stolen or accessed offline.

Question 3

During a design meeting at Blue Yonder Airlines, the junior network administrator needs to use trusted digital identities for TLS or device authentication. What should be selected? The decision applies to a data-center segment.

1. Encryption in transit
2. Least privilege
3. PKI certificate
4. Risk
5. Exploit

Correct answer: C

Why: Binds a public key to an identity through a trust model and enables scalable certificate validation. This directly satisfies the requirement: use trusted digital identities for TLS or device authentication.

Option review:

A: Protects data while it traverses networks, commonly using TLS, IPsec, or similar protocols. However, it does not most directly satisfy the requirement in this scenario: use trusted digital identities for TLS or device authentication.

B: Grants only the access needed to perform assigned duties. However, it does not most directly satisfy the requirement in this scenario: use trusted digital identities for TLS or device authentication.

C: Binds a public key to an identity through a trust model and enables scalable certificate validation. This directly satisfies the requirement: use trusted digital identities for TLS or device authentication.

D: Represents the likelihood and impact of a threat exploiting a vulnerability. However, it does not most directly satisfy the requirement in this scenario: use trusted digital identities for TLS or device authentication.

E: A technique or code that takes advantage of a vulnerability. However, it does not most directly satisfy the requirement in this scenario: use trusted digital identities for TLS or device authentication.

Learning point: Use PKI certificate when the key requirement is to use trusted digital identities for TLS or device authentication.

Question 4

Contoso Health is updating its network standard. Which option best meets the need to create a certificate for a lab/internal use where public trust is not required? The decision applies to a remote-site migration.

1. Time-based one-time password
2. Self-signed certificate
3. SSO
4. PKI certificate
5. TACACS+

Correct answer: B

Why: Is signed by its own key and is not automatically trusted by external clients. This directly satisfies the requirement: create a certificate for a lab/internal use where public trust is not required.

Option review:

A: Generates short-lived authentication codes derived from a shared secret and time. However, it does not most directly satisfy the requirement in this scenario: create a certificate for a lab/internal use where public trust is not required.

B: Is signed by its own key and is not automatically trusted by external clients. This directly satisfies the requirement: create a certificate for a lab/internal use where public trust is not required.

C: Lets a user authenticate once and access multiple integrated services. However, it does not most directly satisfy the requirement in this scenario: create a certificate for a lab/internal use where public trust is not required.

D: Binds a public key to an identity through a trust model and enables scalable certificate validation. However, it does not most directly satisfy the requirement in this scenario: create a certificate for a lab/internal use where public trust is not required.

E: Centralizes device-administration AAA and separates authentication, authorization, and accounting functions. However, it does not most directly satisfy the requirement in this scenario: create a certificate for a lab/internal use where public trust is not required.

Learning point: Use Self-signed certificate when the key requirement is to create a certificate for a lab/internal use where public trust is not required.

Question 5

A field technician at Litware Manufacturing is validating a proposed solution. The design must require more than one independent factor for account access. Which answer is most appropriate? The decision applies to a operations lab.

1. MFA
2. Geofencing
3. SCADA/ICS/OT segmentation
4. SAML
5. Vulnerability

Correct answer: A

Why: Requires multiple authentication factors, reducing reliance on a single password. This directly satisfies the requirement: require more than one independent factor for account access.

Option review:

A: Requires multiple authentication factors, reducing reliance on a single password. This directly satisfies the requirement: require more than one independent factor for account access.

B: Applies access or policy decisions based on geographic location. However, it does not most directly satisfy the requirement in this scenario: require more than one independent factor for account access.

C: Protects industrial-control networks from unnecessary enterprise/user access. However, it does not most directly satisfy the requirement in this scenario: require more than one independent factor for account access.

D: Federates authentication/authorization assertions between an identity provider and service providers, often for web SSO. However, it does not most directly satisfy the requirement in this scenario: require more than one independent factor for account access.

E: A weakness that could be exploited. However, it does not most directly satisfy the requirement in this scenario: require more than one independent factor for account access.

Learning point: Use MFA when the key requirement is to require more than one independent factor for account access.

Question 6

For a new deployment at Woodgrove Bank, the networking team wants to reduce repeated sign-ins across multiple approved applications. Which choice most directly satisfies the goal? The decision applies to a production maintenance window.

1. Geofencing
2. Self-signed certificate
3. Least privilege
4. SSO
5. Risk

Correct answer: D

Why: Lets a user authenticate once and access multiple integrated services. This directly satisfies the requirement: reduce repeated sign-ins across multiple approved applications.

Option review:

A: Applies access or policy decisions based on geographic location. However, it does not most directly satisfy the requirement in this scenario: reduce repeated sign-ins across multiple approved applications.

B: Is signed by its own key and is not automatically trusted by external clients. However, it does not most directly satisfy the requirement in this scenario: reduce repeated sign-ins across multiple approved applications.

C: Grants only the access needed to perform assigned duties. However, it does not most directly satisfy the requirement in this scenario: reduce repeated sign-ins across multiple approved applications.

D: Lets a user authenticate once and access multiple integrated services. This directly satisfies the requirement: reduce repeated sign-ins across multiple approved applications.

E: Represents the likelihood and impact of a threat exploiting a vulnerability. However, it does not most directly satisfy the requirement in this scenario: reduce repeated sign-ins across multiple approved applications.

Learning point: Use SSO when the key requirement is to reduce repeated sign-ins across multiple approved applications.

Question 7

At Blue Yonder Airlines, a systems administrator is reviewing a network change. The requirement is to centralize user/device authentication for VPN or enterprise network access. Which option is the best fit? The decision applies to a new floor deployment.

1. Threat
2. LDAP
3. Geofencing
4. BYOD controls
5. RADIUS

Correct answer: E

Why: Provides centralized AAA and is widely used for network access and 802.1X authentication. This directly satisfies the requirement: centralize user/device authentication for VPN or enterprise network access.

Option review:

A: A potential cause of an unwanted security incident. However, it does not most directly satisfy the requirement in this scenario: centralize user/device authentication for VPN or enterprise network access.

B: Provides directory queries and can support identity lookups/authentication integrations. However, it does not most directly satisfy the requirement in this scenario: centralize user/device authentication for VPN or enterprise network access.

C: Applies access or policy decisions based on geographic location. However, it does not most directly satisfy the requirement in this scenario: centralize user/device authentication for VPN or enterprise network access.

D: Apply policy and segmentation to personally owned devices used for organizational access. However, it does not most directly satisfy the requirement in this scenario: centralize user/device authentication for VPN or enterprise network access.

E: Provides centralized AAA and is widely used for network access and 802.1X authentication. This directly satisfies the requirement: centralize user/device authentication for VPN or enterprise network access.

Learning point: Use RADIUS when the key requirement is to centralize user/device authentication for VPN or enterprise network access.

Question 8

A ticket at Contoso Health says the team must query a directory service for user and group information. Which technology or concept most directly addresses this requirement? The decision applies to a service-recovery review.

1. Threat
2. Security camera
3. LDAP
4. Honeynet
5. Vulnerability

Correct answer: C

Why: Provides directory queries and can support identity lookups/authentication integrations. This directly satisfies the requirement: query a directory service for user and group information.

Option review:

A: A potential cause of an unwanted security incident. However, it does not most directly satisfy the requirement in this scenario: query a directory service for user and group information.

B: Provides physical monitoring and evidentiary visibility around sensitive facilities. However, it does not most directly satisfy the requirement in this scenario: query a directory service for user and group information.

C: Provides directory queries and can support identity lookups/authentication integrations. This directly satisfies the requirement: query a directory service for user and group information.

D: A network of decoy systems provides a broader deception environment. However, it does not most directly satisfy the requirement in this scenario: query a directory service for user and group information.

E: A weakness that could be exploited. However, it does not most directly satisfy the requirement in this scenario: query a directory service for user and group information.

Learning point: Use LDAP when the key requirement is to query a directory service for user and group information.

Question 9

During a design meeting at Litware Manufacturing, the junior network administrator needs to provide browser-based federated single sign-on between organizations/services. What should be selected? The decision applies to a branch-office rollout.

1. Vulnerability
2. MFA
3. BYOD controls
4. SAML
5. TACACS+

Correct answer: D

Why: Federates authentication/authorization assertions between an identity provider and service providers, often for web SSO. This directly satisfies the requirement: provide browser-based federated single sign-on between organizations/services.

Option review:

A: A weakness that could be exploited. However, it does not most directly satisfy the requirement in this scenario: provide browser-based federated single sign-on between organizations/services.

B: Requires multiple authentication factors, reducing reliance on a single password. However, it does not most directly satisfy the requirement in this scenario: provide browser-based federated single sign-on between organizations/services.

C: Apply policy and segmentation to personally owned devices used for organizational access. However, it does not most directly satisfy the requirement in this scenario: provide browser-based federated single sign-on between organizations/services.

D: Federates authentication/authorization assertions between an identity provider and service providers, often for web SSO. This directly satisfies the requirement: provide browser-based federated single sign-on between organizations/services.

E: Centralizes device-administration AAA and separates authentication, authorization, and accounting functions. However, it does not most directly satisfy the requirement in this scenario: provide browser-based federated single sign-on between organizations/services.

Learning point: Use SAML when the key requirement is to provide browser-based federated single sign-on between organizations/services.

Question 10

Woodgrove Bank is updating its network standard. Which option best meets the need to control and audit administrator access to network devices? The decision applies to a campus refresh.

1. Physical lock
2. TACACS+
3. Security camera
4. GDPR
5. Honeynet

Correct answer: B

Why: Centralizes device-administration AAA and separates authentication, authorization, and accounting functions. This directly satisfies the requirement: control and audit administrator access to network devices.

Option review:

A: Prevents unauthorized direct access to racks, closets, or equipment. However, it does not most directly satisfy the requirement in this scenario: control and audit administrator access to network devices.

B: Centralizes device-administration AAA and separates authentication, authorization, and accounting functions. This directly satisfies the requirement: control and audit administrator access to network devices.

C: Provides physical monitoring and evidentiary visibility around sensitive facilities. However, it does not most directly satisfy the requirement in this scenario: control and audit administrator access to network devices.

D: EU privacy regulation governs personal-data processing and related obligations. However, it does not most directly satisfy the requirement in this scenario: control and audit administrator access to network devices.

E: A network of decoy systems provides a broader deception environment. However, it does not most directly satisfy the requirement in this scenario: control and audit administrator access to network devices.

Learning point: Use TACACS+ when the key requirement is to control and audit administrator access to network devices.

Question 11

A field technician at Blue Yonder Airlines is validating a proposed solution. The design must use rotating authenticator-app codes as an authentication factor. Which answer is most appropriate? The decision applies to a data-center segment.

1. PCI DSS
2. Exploit
3. SSO
4. Time-based one-time password
5. Self-signed certificate

Correct answer: D

Why: Generates short-lived authentication codes derived from a shared secret and time. This directly satisfies the requirement: use rotating authenticator-app codes as an authentication factor.

Option review:

A: Defines payment-card security requirements for organizations handling cardholder data. However, it does not most directly satisfy the requirement in this scenario: use rotating authenticator-app codes as an authentication factor.

B: A technique or code that takes advantage of a vulnerability. However, it does not most directly satisfy the requirement in this scenario: use rotating authenticator-app codes as an authentication factor.

C: Lets a user authenticate once and access multiple integrated services. However, it does not most directly satisfy the requirement in this scenario: use rotating authenticator-app codes as an authentication factor.

D: Generates short-lived authentication codes derived from a shared secret and time. This directly satisfies the requirement: use rotating authenticator-app codes as an authentication factor.

E: Is signed by its own key and is not automatically trusted by external clients. However, it does not most directly satisfy the requirement in this scenario: use rotating authenticator-app codes as an authentication factor.

Learning point: Use Time-based one-time password when the key requirement is to use rotating authenticator-app codes as an authentication factor.

Question 12

For a new deployment at Contoso Health, the networking team wants to minimize permissions so users and systems have only necessary access. Which choice most directly satisfies the goal? The decision applies to a remote-site migration.

1. Honeypot
2. Least privilege
3. PKI certificate
4. PCI DSS
5. Encryption in transit

Correct answer: B

Why: Grants only the access needed to perform assigned duties. This directly satisfies the requirement: minimize permissions so users and systems have only necessary access.

Option review:

A: A decoy system attracts attackers and records their activity. However, it does not most directly satisfy the requirement in this scenario: minimize permissions so users and systems have only necessary access.

B: Grants only the access needed to perform assigned duties. This directly satisfies the requirement: minimize permissions so users and systems have only necessary access.

C: Binds a public key to an identity through a trust model and enables scalable certificate validation. However, it does not most directly satisfy the requirement in this scenario: minimize permissions so users and systems have only necessary access.

D: Defines payment-card security requirements for organizations handling cardholder data. However, it does not most directly satisfy the requirement in this scenario: minimize permissions so users and systems have only necessary access.

E: Protects data while it traverses networks, commonly using TLS, IPsec, or similar protocols. However, it does not most directly satisfy the requirement in this scenario: minimize permissions so users and systems have only necessary access.

Learning point: Use Least privilege when the key requirement is to minimize permissions so users and systems have only necessary access.

Question 13

At Litware Manufacturing, a systems administrator is reviewing a network change. The requirement is to manage authorization consistently by job function. Which option is the best fit? The decision applies to a operations lab.

1. CIA triad
2. BYOD controls
3. RBAC
4. SCADA/ICS/OT segmentation
5. Risk

Correct answer: C

Why: Assigns permissions based on job roles rather than individual ad hoc grants. This directly satisfies the requirement: manage authorization consistently by job function.

Option review:

A: Confidentiality, integrity, and availability are core security objectives. However, it does not most directly satisfy the requirement in this scenario: manage authorization consistently by job function.

B: Apply policy and segmentation to personally owned devices used for organizational access. However, it does not most directly satisfy the requirement in this scenario: manage authorization consistently by job function.

C: Assigns permissions based on job roles rather than individual ad hoc grants. This directly satisfies the requirement: manage authorization consistently by job function.

D: Protects industrial-control networks from unnecessary enterprise/user access. However, it does not most directly satisfy the requirement in this scenario: manage authorization consistently by job function.

E: Represents the likelihood and impact of a threat exploiting a vulnerability. However, it does not most directly satisfy the requirement in this scenario: manage authorization consistently by job function.

Learning point: Use RBAC when the key requirement is to manage authorization consistently by job function.

Question 14

A ticket at Woodgrove Bank says the team must restrict service access to approved geographic regions. Which technology or concept most directly addresses this requirement? The decision applies to a production maintenance window.

1. TACACS+
2. Network segmentation
3. RADIUS
4. Geofencing
5. CIA triad

Correct answer: D

Why: Applies access or policy decisions based on geographic location. This directly satisfies the requirement: restrict service access to approved geographic regions.

Option review:

A: Centralizes device-administration AAA and separates authentication, authorization, and accounting functions. However, it does not most directly satisfy the requirement in this scenario: restrict service access to approved geographic regions.

B: Separates systems into zones/segments to reduce exposure and limit lateral movement. However, it does not most directly satisfy the requirement in this scenario: restrict service access to approved geographic regions.

C: Provides centralized AAA and is widely used for network access and 802.1X authentication. However, it does not most directly satisfy the requirement in this scenario: restrict service access to approved geographic regions.

D: Applies access or policy decisions based on geographic location. This directly satisfies the requirement: restrict service access to approved geographic regions.

E: Confidentiality, integrity, and availability are core security objectives. However, it does not most directly satisfy the requirement in this scenario: restrict service access to approved geographic regions.

Learning point: Use Geofencing when the key requirement is to restrict service access to approved geographic regions.

Question 15

During a design meeting at Blue Yonder Airlines, the junior network administrator needs to monitor physical access to network rooms. What should be selected? The decision applies to a new floor deployment.

1. Vulnerability
2. RADIUS
3. Security camera
4. SCADA/ICS/OT segmentation
5. IoT/IIoT segmentation

Correct answer: C

Why: Provides physical monitoring and evidentiary visibility around sensitive facilities. This directly satisfies the requirement: monitor physical access to network rooms.

Option review:

A: A weakness that could be exploited. However, it does not most directly satisfy the requirement in this scenario: monitor physical access to network rooms.

B: Provides centralized AAA and is widely used for network access and 802.1X authentication. However, it does not most directly satisfy the requirement in this scenario: monitor physical access to network rooms.

C: Provides physical monitoring and evidentiary visibility around sensitive facilities. This directly satisfies the requirement: monitor physical access to network rooms.

D: Protects industrial-control networks from unnecessary enterprise/user access. However, it does not most directly satisfy the requirement in this scenario: monitor physical access to network rooms.

E: Separates embedded/industrial devices that may have limited security capabilities from general networks. However, it does not most directly satisfy the requirement in this scenario: monitor physical access to network rooms.

Learning point: Use Security camera when the key requirement is to monitor physical access to network rooms.

Question 16

Contoso Health is updating its network standard. Which option best meets the need to physically restrict access to network hardware? The decision applies to a service-recovery review.

1. SCADA/ICS/OT segmentation
2. SSO
3. Physical lock
4. RADIUS
5. Threat

Correct answer: C

Why: Prevents unauthorized direct access to racks, closets, or equipment. This directly satisfies the requirement: physically restrict access to network hardware.

Option review:

A: Protects industrial-control networks from unnecessary enterprise/user access. However, it does not most directly satisfy the requirement in this scenario: physically restrict access to network hardware.

B: Lets a user authenticate once and access multiple integrated services. However, it does not most directly satisfy the requirement in this scenario: physically restrict access to network hardware.

C: Prevents unauthorized direct access to racks, closets, or equipment. This directly satisfies the requirement: physically restrict access to network hardware.

D: Provides centralized AAA and is widely used for network access and 802.1X authentication. However, it does not most directly satisfy the requirement in this scenario: physically restrict access to network hardware.

E: A potential cause of an unwanted security incident. However, it does not most directly satisfy the requirement in this scenario: physically restrict access to network hardware.

Learning point: Use Physical lock when the key requirement is to physically restrict access to network hardware.

Question 17

A field technician at Litware Manufacturing is validating a proposed solution. The design must observe attacker behavior against a deliberately exposed decoy host. Which answer is most appropriate? The decision applies to a branch-office rollout.

1. MFA
2. Guest network
3. LDAP
4. Honeypot
5. Security camera

Correct answer: D

Why: A decoy system attracts attackers and records their activity. This directly satisfies the requirement: observe attacker behavior against a deliberately exposed decoy host.

Option review:

A: Requires multiple authentication factors, reducing reliance on a single password. However, it does not most directly satisfy the requirement in this scenario: observe attacker behavior against a deliberately exposed decoy host.

B: Provides visitors internet/network access without exposing internal resources. However, it does not most directly satisfy the requirement in this scenario: observe attacker behavior against a deliberately exposed decoy host.

C: Provides directory queries and can support identity lookups/authentication integrations. However, it does not most directly satisfy the requirement in this scenario: observe attacker behavior against a deliberately exposed decoy host.

D: A decoy system attracts attackers and records their activity. This directly satisfies the requirement: observe attacker behavior against a deliberately exposed decoy host.

E: Provides physical monitoring and evidentiary visibility around sensitive facilities. However, it does not most directly satisfy the requirement in this scenario: observe attacker behavior against a deliberately exposed decoy host.

Learning point: Use Honeypot when the key requirement is to observe attacker behavior against a deliberately exposed decoy host.

Question 18

For a new deployment at Woodgrove Bank, the networking team wants to study attacker movement across multiple decoy systems. Which choice most directly satisfies the goal? The decision applies to a campus refresh.

1. Encryption in transit
2. Least privilege
3. LDAP
4. Honeynet
5. Geofencing

Correct answer: D

Why: A network of decoy systems provides a broader deception environment. This directly satisfies the requirement: study attacker movement across multiple decoy systems.

Option review:

A: Protects data while it traverses networks, commonly using TLS, IPsec, or similar protocols. However, it does not most directly satisfy the requirement in this scenario: study attacker movement across multiple decoy systems.

B: Grants only the access needed to perform assigned duties. However, it does not most directly satisfy the requirement in this scenario: study attacker movement across multiple decoy systems.

C: Provides directory queries and can support identity lookups/authentication integrations. However, it does not most directly satisfy the requirement in this scenario: study attacker movement across multiple decoy systems.

D: A network of decoy systems provides a broader deception environment. This directly satisfies the requirement: study attacker movement across multiple decoy systems.

E: Applies access or policy decisions based on geographic location. However, it does not most directly satisfy the requirement in this scenario: study attacker movement across multiple decoy systems.

Learning point: Use Honeynet when the key requirement is to study attacker movement across multiple decoy systems.

Question 19

At Blue Yonder Airlines, a systems administrator is reviewing a network change. The requirement is to evaluate potential business loss from a security scenario. Which option is the best fit? The decision applies to a data-center segment.

1. Risk
2. GDPR
3. BYOD controls
4. Security camera
5. PKI certificate

Correct answer: A

Why: Represents the likelihood and impact of a threat exploiting a vulnerability. This directly satisfies the requirement: evaluate potential business loss from a security scenario.

Option review:

A: Represents the likelihood and impact of a threat exploiting a vulnerability. This directly satisfies the requirement: evaluate potential business loss from a security scenario.

B: EU privacy regulation governs personal-data processing and related obligations. However, it does not most directly satisfy the requirement in this scenario: evaluate potential business loss from a security scenario.

C: Apply policy and segmentation to personally owned devices used for organizational access. However, it does not most directly satisfy the requirement in this scenario: evaluate potential business loss from a security scenario.

D: Provides physical monitoring and evidentiary visibility around sensitive facilities. However, it does not most directly satisfy the requirement in this scenario: evaluate potential business loss from a security scenario.

E: Binds a public key to an identity through a trust model and enables scalable certificate validation. However, it does not most directly satisfy the requirement in this scenario: evaluate potential business loss from a security scenario.

Learning point: Use Risk when the key requirement is to evaluate potential business loss from a security scenario.

Question 20

A ticket at Contoso Health says the team must identify a security weakness before an attacker uses it. Which technology or concept most directly addresses this requirement? The decision applies to a remote-site migration.

1. PKI certificate
2. TACACS+
3. RADIUS
4. Vulnerability
5. Threat

Correct answer: D

Why: A weakness that could be exploited. This directly satisfies the requirement: identify a security weakness before an attacker uses it.

Option review:

A: Binds a public key to an identity through a trust model and enables scalable certificate validation. However, it does not most directly satisfy the requirement in this scenario: identify a security weakness before an attacker uses it.

B: Centralizes device-administration AAA and separates authentication, authorization, and accounting functions. However, it does not most directly satisfy the requirement in this scenario: identify a security weakness before an attacker uses it.

C: Provides centralized AAA and is widely used for network access and 802.1X authentication. However, it does not most directly satisfy the requirement in this scenario: identify a security weakness before an attacker uses it.

D: A weakness that could be exploited. This directly satisfies the requirement: identify a security weakness before an attacker uses it.

E: A potential cause of an unwanted security incident. However, it does not most directly satisfy the requirement in this scenario: identify a security weakness before an attacker uses it.

Learning point: Use Vulnerability when the key requirement is to identify a security weakness before an attacker uses it.

Question 21

During a design meeting at Litware Manufacturing, the junior network administrator needs to describe the means used to take advantage of a security weakness. What should be selected? The decision applies to a operations lab.

1. Exploit
2. Least privilege
3. TACACS+
4. RADIUS
5. IoT/IIoT segmentation

Correct answer: A

Why: A technique or code that takes advantage of a vulnerability. This directly satisfies the requirement: describe the means used to take advantage of a security weakness.

Option review:

A: A technique or code that takes advantage of a vulnerability. This directly satisfies the requirement: describe the means used to take advantage of a security weakness.

B: Grants only the access needed to perform assigned duties. However, it does not most directly satisfy the requirement in this scenario: describe the means used to take advantage of a security weakness.

C: Centralizes device-administration AAA and separates authentication, authorization, and accounting functions. However, it does not most directly satisfy the requirement in this scenario: describe the means used to take advantage of a security weakness.

D: Provides centralized AAA and is widely used for network access and 802.1X authentication. However, it does not most directly satisfy the requirement in this scenario: describe the means used to take advantage of a security weakness.

E: Separates embedded/industrial devices that may have limited security capabilities from general networks. However, it does not most directly satisfy the requirement in this scenario: describe the means used to take advantage of a security weakness.

Learning point: Use Exploit when the key requirement is to describe the means used to take advantage of a security weakness.

Question 22

Woodgrove Bank is updating its network standard. Which option best meets the need to identify an actor/event capable of causing harm? The decision applies to a production maintenance window.

1. Guest network
2. Threat
3. Honeypot
4. TACACS+
5. BYOD controls

Correct answer: B

Why: A potential cause of an unwanted security incident. This directly satisfies the requirement: identify an actor/event capable of causing harm.

Option review:

A: Provides visitors internet/network access without exposing internal resources. However, it does not most directly satisfy the requirement in this scenario: identify an actor/event capable of causing harm.

B: A potential cause of an unwanted security incident. This directly satisfies the requirement: identify an actor/event capable of causing harm.

C: A decoy system attracts attackers and records their activity. However, it does not most directly satisfy the requirement in this scenario: identify an actor/event capable of causing harm.

D: Centralizes device-administration AAA and separates authentication, authorization, and accounting functions. However, it does not most directly satisfy the requirement in this scenario: identify an actor/event capable of causing harm.

E: Apply policy and segmentation to personally owned devices used for organizational access. However, it does not most directly satisfy the requirement in this scenario: identify an actor/event capable of causing harm.

Learning point: Use Threat when the key requirement is to identify an actor/event capable of causing harm.

Question 23

A field technician at Blue Yonder Airlines is validating a proposed solution. The design must classify security goals around secrecy, correctness, and service accessibility. Which answer is most appropriate? The decision applies to a new floor deployment.

1. Network segmentation
2. Encryption in transit
3. SSO
4. CIA triad
5. Risk

Correct answer: D

Why: Confidentiality, integrity, and availability are core security objectives. This directly satisfies the requirement: classify security goals around secrecy, correctness, and service accessibility.

Option review:

A: Separates systems into zones/segments to reduce exposure and limit lateral movement. However, it does not most directly satisfy the requirement in this scenario: classify security goals around secrecy, correctness, and service accessibility.

B: Protects data while it traverses networks, commonly using TLS, IPsec, or similar protocols. However, it does not most directly satisfy the requirement in this scenario: classify security goals around secrecy, correctness, and service accessibility.

C: Lets a user authenticate once and access multiple integrated services. However, it does not most directly satisfy the requirement in this scenario: classify security goals around secrecy, correctness, and service accessibility.

D: Confidentiality, integrity, and availability are core security objectives. This directly satisfies the requirement: classify security goals around secrecy, correctness, and service accessibility.

E: Represents the likelihood and impact of a threat exploiting a vulnerability. However, it does not most directly satisfy the requirement in this scenario: classify security goals around secrecy, correctness, and service accessibility.

Learning point: Use CIA triad when the key requirement is to classify security goals around secrecy, correctness, and service accessibility.

Question 24

For a new deployment at Contoso Health, the networking team wants to apply the compliance framework specifically associated with payment-card information. Which choice most directly satisfies the goal? The decision applies to a service-recovery review.

1. Encryption at rest
2. SAML
3. PKI certificate
4. PCI DSS
5. Self-signed certificate

Correct answer: D

Why: Defines payment-card security requirements for organizations handling cardholder data. This directly satisfies the requirement: apply the compliance framework specifically associated with payment-card information.

Option review:

A: Protects stored data on disks, databases, or backups. However, it does not most directly satisfy the requirement in this scenario: apply the compliance framework specifically associated with payment-card information.

B: Federates authentication/authorization assertions between an identity provider and service providers, often for web SSO. However, it does not most directly satisfy the requirement in this scenario: apply the compliance framework specifically associated with payment-card information.

C: Binds a public key to an identity through a trust model and enables scalable certificate validation. However, it does not most directly satisfy the requirement in this scenario: apply the compliance framework specifically associated with payment-card information.

D: Defines payment-card security requirements for organizations handling cardholder data. This directly satisfies the requirement: apply the compliance framework specifically associated with payment-card information.

E: Is signed by its own key and is not automatically trusted by external clients. However, it does not most directly satisfy the requirement in this scenario: apply the compliance framework specifically associated with payment-card information.

Learning point: Use PCI DSS when the key requirement is to apply the compliance framework specifically associated with payment-card information.

Question 25

At Litware Manufacturing, a systems administrator is reviewing a network change. The requirement is to address privacy obligations for covered EU personal data. Which option is the best fit? The decision applies to a branch-office rollout.

1. Least privilege
2. SAML
3. GDPR
4. SCADA/ICS/OT segmentation
5. TACACS+

Correct answer: C

Why: EU privacy regulation governs personal-data processing and related obligations. This directly satisfies the requirement: address privacy obligations for covered EU personal data.

Option review:

A: Grants only the access needed to perform assigned duties. However, it does not most directly satisfy the requirement in this scenario: address privacy obligations for covered EU personal data.

B: Federates authentication/authorization assertions between an identity provider and service providers, often for web SSO. However, it does not most directly satisfy the requirement in this scenario: address privacy obligations for covered EU personal data.

C: EU privacy regulation governs personal-data processing and related obligations. This directly satisfies the requirement: address privacy obligations for covered EU personal data.

D: Protects industrial-control networks from unnecessary enterprise/user access. However, it does not most directly satisfy the requirement in this scenario: address privacy obligations for covered EU personal data.

E: Centralizes device-administration AAA and separates authentication, authorization, and accounting functions. However, it does not most directly satisfy the requirement in this scenario: address privacy obligations for covered EU personal data.

Learning point: Use GDPR when the key requirement is to address privacy obligations for covered EU personal data.