CompTIA Security+

• Unit 01

  Security+ (SY0-701)

  Access: Premium
  4,331 questions · 36 topics

A few questions from this module, with the answer and a full explanation. The complete bank is available when you start practising.

1. A firewall ACL is designed to allow only HTTPS (TCP/443) from 10.0.0.0/8 to a web server at 172.16.1.10, and block everything else. An attacker in the 10.0.0.0/8 range successfully connects to the web server on TCP/8443, a non-standard HTTPS port used by a legacy application. The ACL has only three rules: (1) permit tcp 10.0.0.0/8 172.16.1.10 eq 443, (2) implicit deny. Which rule change prevents this access while preserving the existing HTTPS policy?

   • A
     Add 'permit tcp 10.0.0.0/8 172.16.1.10 eq 8443' as rule 2 to explicitly allow the non-standard port as well
   • B
     The implicit deny already blocks TCP/8443 — the attacker's success means the web server itself is accepting connections on port 8443 without a firewall rule; the correct fix is to ensure the web server's host-based firewall blocks 8443, or add an explicit deny rule for 8443 to the ACL before troubleshooting further
     Correct answer
   • C
     Change rule 1 to permit tcp any any eq 443 to ensure all HTTPS traffic is permitted regardless of source
   • D
     Add 'deny tcp any any eq 8443' as rule 1 so port 8443 is blocked before the permit rule is evaluated
   Explanation

   The existing ACL already has an implicit deny that would block TCP/8443 — if the attacker successfully connected on 8443, the traffic is either not traversing this firewall, or the packet was permitted by a different ACL or NAT rule not shown. The technically accurate diagnosis is that the ACL rule set is correct for its stated scope, but the control gap lies elsewhere: either the traffic path bypasses this firewall, or the server's host-based firewall is not configured. The option of adding an explicit deny for 8443 before the permit is sound as a belt-and-suspenders measure, but the root cause analysis must address why the implicit deny is not working. The key takeaway is that when a well-designed ACL appears to fail, the investigation must verify the actual traffic path before concluding the ACL itself is the problem.

2. During an asset discovery exercise, a security team identifies 3,200 traditional endpoints (laptops and desktops) and an additional 1,100 network-connected devices including IP cameras, HVAC controllers, and medical imaging equipment. The team's EDR solution cannot be installed on the non-traditional devices. Which approach best addresses the security risk posed by these unmanaged endpoints?

   • A
     Apply the same EDR policy to unmanageable devices and accept any compatibility errors
   • B
     Segment unmanageable devices onto isolated VLANs with strict firewall rules, monitor their traffic with network-based detection tools, and maintain a compensating control register
     Correct answer
   • C
     Exclude the unmanageable devices from the asset inventory because they cannot run endpoint agents
   • D
     Rely on perimeter firewall rules alone to protect all unmanageable devices from external threats
   Explanation

   When endpoint agents cannot be deployed on a device, the correct response is to apply compensating controls rather than ignore the risk or remove the devices. Network segmentation (VLANs) limits what these devices can communicate with, reducing the blast radius if they are compromised. Network-based detection tools (such as a network IDS or flow analysis) provide visibility into their traffic even without host-level agents. A compensating control register documents the risk acceptance and mitigations in place. The key takeaway is that unmanageable endpoints must still be accounted for, segmented, and monitored using network-layer controls when host-level controls are not possible.

3. An organisation's password policy requires 8 characters minimum, three complexity classes, and mandatory change every 60 days. A security consultant argues this policy is counterproductive. Which combination of evidence BEST supports the consultant's position?

   • A
     Complexity requirements always reduce security because they make passwords harder for users to remember
   • B
     Forced changes every 60 days are required by NIST, so the policy is compliant and the consultant is incorrect
   • C
     Short passwords with complexity requirements tend to produce predictable patterns; frequent forced changes lead to incremental modifications (e.g. Password1 → Password2); both behaviours reduce actual security
     Correct answer
   • D
     The policy is effective because it forces users to change compromised passwords regularly
   Explanation

   NIST SP 800-63B explicitly recommends against arbitrary complexity rules and periodic expiry without evidence of compromise. Research shows that complexity requirements with short minimum lengths drive users toward predictable base words with substitutions (e.g. 'P@ssw0rd'), which are well-known to attackers using rule-based cracking. Forced periodic changes cause users to make minimal incremental modifications (Password1 → Password2). The recommended approach is long passphrases, no required periodic changes unless compromise is suspected, and checking against known breached password lists. Key takeaway: complexity + short length + forced expiry = predictable patterns; current best practice favours length + breach checking.