The 30-day Security+ plan: weighted by what the exam scores

A retailer reviews stock-room badge logs once a month and has found several after-hours entries weeks after they happened. Management now wants a control that stops unauthorized entry at the moment it is attempted. Which control type should be ADDED?

• APreventive control
  Correct. A preventive control, such as a locked door tied to role-based badge rights, blocks the entry when it is attempted.
• BDetective control
  The retailer already has a detective control in the monthly log review. Another one would still find entries only after they happen.
• CCorrective control
  Corrective controls restore or repair after an incident. They would not stop the after-hours entry itself.
• DDeterrent control
  A deterrent, such as a warning sign, may discourage some people, but it does not physically or logically stop a determined person.

An organization already uses app-based push MFA, yet it keeps losing accounts to phishing kits that relay the real sign-in page and capture the session. Which control would MOST effectively stop this technique?

• ALonger and more complex password rules
  The kit captures whatever password the user types, so complexity rules make no difference.
• BQuarterly phishing awareness videos
  Training helps but a convincing proxy of the real page still fools users; it is not the most effective technical fix.
• CFIDO2 security keys or passkeys bound to origin
  Correct. The authenticator checks the site origin cryptographically, so a relay on a different domain never receives a valid assertion.
• DSMS one-time codes as a second factor
  SMS codes can be typed into the proxy page and relayed just like push approvals, so they do not stop the relay.

A development team deploys a web application to a PaaS offering. A scan finds a vulnerable open source library bundled inside the application package. Who is responsible for fixing it?

• AThe provider, because it manages the language runtime
  The provider patches the runtime it supplies, not third-party libraries the customer bundles with its own code.
• BThe provider, because it patches the operating system
  OS patching is the provider's job in PaaS, but the flaw is in the application package, not the OS.
• CNobody, because PaaS isolates tenants from such flaws
  Tenant isolation does not fix vulnerable code. An exploitable library is still exposed through the application.
• DThe customer, because the app and its libraries are theirs
  Correct. The library ships inside the customer's application package, so updating it is the customer's responsibility.

A water utility needs to protect a set of programmable logic controllers. The vendor states the controllers cannot run endpoint agents and firmware can only be updated during a scheduled annual outage. Which approach BEST reduces risk right now?

• AInstall a lightweight EDR agent on each controller using the vendor SDK
  The vendor already stated the controllers cannot run agents, so this is not an option here.
• BPush the newest firmware during production hours to close the gap sooner
  Updating during production risks an outage of a critical process, which ICS operators must avoid.
• CLet the controllers pull updates directly from the vendor over the internet
  Giving controllers internet access expands exposure and bypasses change control.
• DSegment the controllers behind a firewall that allows only needed protocols
  Correct. Segmentation limits who can reach the controllers without touching the fragile devices themselves.

At 2 a.m. an engineer applies an emergency firewall change to block an active attack, without waiting for the weekly change advisory board meeting. According to sound change management practice, what should happen NEXT?

• ADocument the change and submit it for retroactive CAB review
  Correct. Emergency changes are allowed to bypass normal scheduling, but they must still be documented and reviewed after the fact.
• BRoll the change back until the CAB can meet and approve it
  Rolling back would reopen the active attack; emergency processes exist to avoid exactly that.
• CTreat the change as final because emergencies are exempt from review
  No change is exempt from review; skipping it leaves undocumented changes that break baselines and audits.
• DOpen a disciplinary case for bypassing the approval process
  The engineer followed a legitimate emergency path, so discipline is not appropriate when it is documented.