CompTIA Security+ SY0-701 Exam Questions in PDF

Explanation:

Option B is correct because transferring risk via cyber insurance shifts financial impact of a threat from the organization to an insurer, aligning with risk transfer strategy. A (Accept) would mean acknowledging the risk without action; not applicable since insurance is a transfer mechanism. C (Mitigate) involves reducing likelihood or impact through controls, not shifting costs. D (Avoid) means not engaging in the activity that creates risk; insurance does not eliminate the risk itself. Therefore, insurance serves as a risk transfer remedy rather than acceptance, mitigation, or avoidance.

Explanation:

Option C is correct because a risk register documents risks, assigns responsible parties, and defines risk thresholds and treatment actions.
A) Incorrect — Risk tolerance describes the organization’s overall appetite for risk, not a ledger of risks or owners.
B) Incorrect — Risk transfer is a treatment option (e.g., insurance) rather than a documentation artifact.
D) Incorrect — Risk analysis assesses likelihood and impact but does not establish ownership or thresholds in a formal register.

Explanation:

Explanation:

Option D is correct because Shadow IT refers to employees using unsanctioned tools or solutions, such as bypassing the VPN, to access services, often without IT oversight. Incorrect — A) Espionage implies covert information gathering by attackers, not internal R&D bypassing VPN. Incorrect — B) Data exfiltration involves unauthorized data transfer, not the act of using unauthorized tools itself. Incorrect — C) Nation-state attack denotes a political or strategic attacker; not applicable to internal department bypass of VPN.

Explanation:

Option A is correct because insiders often use removable media or devices to exfiltrate data, leveraging physical access and trusted insider status to copy information off-network.
B is incorrect because default network device credentials are a common hardening issue for attackers externally or due to poor onboarding, not a typical insider-driven exfiltration vector.
C is incorrect because spear phishing targets external adversaries to gain initial access, not primarily an insider exfiltration method.
D is incorrect because typosquatting impersonates brands to deceive external users; it does not reflect a standard insider data exfiltration technique.

Explanation:

Option B is correct because a Service Level Agreement (SLA) defines performance metrics and response times for vendor services, including incident response and uptime commitments. A) SOW (Statement of Work) outlines scope and deliverables, not response time. C) MOA (Memorandum of Agreement) is a high-level collaboration document, not time frames. D) MOU (Memorandum of Understanding) is a non-binding agreement outlining intent, not specific response windows. Correct — SLA explicitly specifies the required response time and performance levels in a formal contractual metric.

Explanation:

Option B is correct because next-generation SIEMs integrate automated response actions (SOAR-like capabilities) to orchestrate containment, remediation, and workflow across tools. A) Virus signatures are legacy antivirus content, not central to NG SIEMs. C) Security agent deployment is a deployment consideration, not a NG SIEM feature. D) Vulnerability scanning is typically a separate function from SIEMs; NG SIEMs focus on detection, correlation, and automated response rather than initial vulnerability assessment.

Explanation:

Option B is correct because deterrent controls aim to discourage criminal activity by increasing the likelihood of being observed (CCTV) and signaling monitoring through signs. Option F is correct because detective controls identify and detect security incidents (CCTV footage).
A) Incorrect — Preventive controls aim to prevent incidents from occurring (e.g., access control, locks), not just deter or detect.
C) Incorrect — Corrective controls respond after a breach to restore state, not to deter or detect.
D) Incorrect — Directive controls guide behavior and governance, not detection or deterrence.
E) Incorrect — Compensating controls provide an alternative security measure when a primary control is not feasible, not specifically deterrence/detection.
F) (already cited)