Free CompTIA Security+ SY0-701 Practice Test with Explanations

Business Email Compromise (BEC) is a social engineering attack where an adversary impersonates a trusted senior colleague, like an executive, to trick an employee into performing an unauthorized action. The scenario of an email appearing to be from an executive requesting the purchase of gift cards is a classic example of a BEC scam. The attacker leverages the authority of the spoofed identity to create a sense of urgency and bypass normal verification procedures, aiming for direct financial gain.

A serverless framework is a cloud-native development model that allows developers to build and run applications without managing servers. The cloud provider handles the infrastructure, and the user is billed based on the precise compute time consumed (pay-per-use), not on pre-purchased capacity. This model significantly reduces costs for applications with variable or infrequent traffic, as there are no charges when the application is idle. This directly meets the requirements for a low-cost, cloud-based hosting solution. 

Risk management strategies define how an organization responds to identified risks. Purchasing cyber insurance is a classic example of risk transfer (also known as risk sharing). This strategy involves shifting the financial impact of a potential loss to a third party, in this case, the insurance company. The organization pays a premium, and in exchange, the insurer agrees to cover the costs associated with a cyber incident, such as data recovery, legal fees, and fines. The company does not eliminate or reduce the risk itself, but it transfers the financial consequences. 

An Acceptable Use Policy (AUP) is a set of rules that defines the constraints and practices a user must agree to for access to a corporate network or the internet. Its primary purpose is to inform employees about what constitutes proper and improper use of company assets, thereby preventing security incidents, misuse, and legal liabilities before they occur. By establishing clear guidelines and expectations for behavior, the AUP functions as an administrative control designed to prevent violations.

A Pass-the-hash (PtH) attack is a technique where an attacker captures a password hash from a compromised system (often from memory, e.g., the LSASS process) and uses it to authenticate to other systems on the network. The key characteristic of this attack, as described in the scenario, is that the attacker does not need to crack the hash to discover the original plaintext password. They simply pass the hash itself to the authentication protocol (e.g., NTLM), which accepts it as a valid credential, allowing for lateral movement across the network.

The scenario describes an unauthorized device providing internet access, which allows employees to circumvent the company's security policies, specifically content filtering. This device is a rogue access point (AP). A rogue AP is an unauthorized wireless access point connected to a secured network without the administrator's knowledge or permission. It creates a significant security vulnerability by creating a backdoor into the network that bypasses established security controls like firewalls and content filters, as seen in this situation.

The most direct and certain outcome of failing an internal PCI DSS (Payment Card Industry Data Security Standard) compliance assessment is the generation of audit findings. An internal assessment's purpose is to identify gaps and areas of non-compliance before an official external audit. The results are documented in a report that lists these specific failures as "findings." These findings then form the basis of a remediation plan to correct the issues. Fines, sanctions, and reputation damage are typically consequences of failing an external audit or experiencing a data breach, not a proactive internal review.

A hacktivist is a threat actor who is primarily motivated by a political, social, or ideological agenda. Their attacks are a form of protest or activism intended to draw attention to a cause they believe in. This motivation is rooted in personal beliefs about right and wrong, making them the most likely actor among the choices to be driven by such convictions. Their goal is typically disruption, defacement, or data exposure to support their cause, rather than financial gain or espionage.

A Security Information and Event Management (SIEM) system is the correct tool for this purpose. Its core function is to collect, or aggregate, log data from a wide array of sources across an enterprise network. It then normalizes this data, correlates events to identify patterns, and uses rule-based or behavioral analysis to detect anomalies and security incidents. This capability allows security teams to generate alerts for potentially malicious activity that would be missed by analyzing logs from individual systems in isolation.

A RADIUS (Remote Authentication Dial-In User Service) server provides centralized Authentication, Authorization, and Accounting (AAA) management. The question asks what security concept is accomplished, and "AA" stands for Authentication and Authorization, which are two of the three core functions of RADIUS. When a user attempts to connect to a network service (like a VPN or Wi-Fi), the network access server forwards the credentials to the RADIUS server, which authenticates the user and authorizes their level of access based on configured policies.