Security Operations
Free CompTIA Security+ (SY0-701) practice — 6 questions on Security Operations, with explanations. No sign-up. Full 12-question mixed test →
A company uses a third-party marketing platform to send emails on behalf of its domain, corp-example.com. SPF passes because the platform's sending IP is included in the SPF record, and DKIM passes because the platform signs with its own valid key. However, DMARC still fails and legitimate marketing emails are being rejected. The company's DMARC record includes 'adkim=s; aspf=s' (strict alignment for both). Which change would resolve the alignment failure while keeping DMARC enforcement effective?
Strict alignment (s) requires the DKIM d= domain (or SPF envelope-from) to exactly match the visible From: header domain. Relaxed alignment (r) permits any subdomain of the same organizational domain to align. Since the marketing platform signs with its own domain, either switching to relaxed alignment or having them sign using a corp-example.com subdomain fixes the mismatch without disabling DMARC enforcement.
A vulnerability management team identifies two critical findings, both with a CVSS v3.1 base score of 9.8. Vulnerability A has a vector string containing 'S:C' (Scope Changed) and Vulnerability B has 'S:U' (Scope Unchanged). Patching resources are limited to one system this week. Which factor justifies prioritizing Vulnerability A first?
The Scope metric in CVSS indicates whether a vulnerability in one security authority (e.g., a VM, container, or sandboxed process) can affect resources managed by a different security authority. S:C means successful exploitation has a blast radius beyond the vulnerable component itself, which increases real-world impact and justifies prioritization even at an identical base score.
During an active incident, a threat hunter suspects data was exfiltrated over HTTPS to an external IP address. NetFlow records confirm a large outbound data transfer occurred to that IP, but the hunter needs to determine exactly what data was sent in order to assess the scope of the breach. Which data source should the hunter request next?
NetFlow provides metadata (source/destination, ports, byte counts, timing) but not payload content. To determine the actual data exfiltrated, the hunter needs full packet capture and, since the traffic is encrypted via HTTPS, either captured session keys, a TLS-inspecting proxy log, or endpoint DLP logs to reconstruct the actual content sent.
A single-page web application (SPA) needs to call a separate backend REST API on behalf of a logged-in user, without the SPA ever handling or storing the user's actual password. The API must be able to independently verify that the request is authorized and issued for a specific, limited scope of access. Which mechanism BEST satisfies this requirement?
OAuth 2.0's Authorization Code flow with PKCE is designed specifically for public clients like SPAs. It allows the SPA to obtain a short-lived, scope-limited access token after user authentication, without ever exposing or storing the user's password, and the API can validate the token and its scopes independently.
During incident response on a compromised production server, the responder must collect evidence following the order of volatility. Which of the following should be collected FIRST, before any other listed source?
The order of volatility dictates collecting the most transient evidence first. RAM contents (running processes, network connections, encryption keys, injected malware) are lost immediately on reboot or power-off, making them the highest priority to capture before any other listed source.
An organization's MFA provider experiences a multi-hour outage, locking all administrators out of the privileged access management (PAM) vault during a critical outage requiring emergency configuration changes. Which control should have been in place to allow secure access during this event?
A break-glass account is a documented emergency-access control: credentials are sealed (e.g., in a safe or secure escrow), used only when normal privileged access paths fail, and every use triggers mandatory logging, review, and credential rotation afterward. This maintains security oversight while ensuring availability during outages.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
$109.99 $34.99 with code FREETEST33 — valid through September 2.
Get my $34.99 deal →