1. Home
2. All questions
3. Secure design

CompTIA Security+ study material: Secure design

105 questions of the 611 in the CompTIA Security+ quiz. Each opens with its answer, the reasoning and where that is written down.

Challenge yourself on this topic → Study as cards

The questions

1. 17. A data centre's physical security controls are implemented once and relied on by every system hosted there. What are these called, and who is accountable for them?
2. 75. Which measure reduces breach impact before any technical control is applied?
3. 81. A team applies a NIST control baseline exactly as published with no changes. What have they misunderstood?
4. 82. Several similar healthcare systems each need the same tailored control set. Which construct avoids each of them tailoring the baseline separately?
5. 89. What does keeping infrastructure configuration under version control give a change management process?
6. 102. At which stage of the asset lifecycle does data most often escape the organisation's control?
7. 148. Which two controls should be applied to a user file upload feature? Choose two.
8. 151. What role does a Content Security Policy play in defending against cross-site scripting?
9. 159. Which two findings fall under security misconfiguration? Choose two.
10. 171. What does hardening a system primarily achieve?
11. 178. A flaw is found that no amount of correct implementation would have prevented. Which category does it fall into, and what practice addresses it?
12. 181. How does NIST define media sanitisation?
13. 182. A drive will be reissued to another employee in the same department. Which sanitisation category is normally sufficient?
14. 183. What standard must a Purge operation meet that Clear does not?
15. 184. An organisation chooses Destroy for a batch of drives. What does this imply?
16. 185. A self-encrypting drive must be sanitised in minutes rather than hours. Which technique achieves this?
17. 186. Why is a multi-pass overwrite an unreliable way to sanitise a solid-state drive?
18. 187. A team cuts each decommissioned drive in half and records it as Destroyed. What should be verified?
19. 188. When should sanitisation requirements first be considered for a new system?
20. 189. Why is sanitisation not only an end-of-life activity?
21. 190. What does data classification allow an organisation to do?
22. 191. Which protection applies to data in use, as distinct from data at rest or in transit?
23. 192. A payments team replaces card numbers throughout its systems with surrogate values that have no mathematical relationship to the original. What is this?
24. 193. A support screen shows only the last four digits of an account number, while the full value remains in the database. Which control is in use, and what does it not protect against?
25. 194. Which technique removes the link to an individual irreversibly?
26. 195. A data loss prevention deployment generates constant false positives and misses real exfiltration. What most likely needs fixing first?
27. 196. How are controls organised in the NIST control catalogue?
28. 197. What is a control enhancement?
29. 198. A security guard at a reception desk is classified by category as which type of control?
30. 199. A prominent sign warning that the site is under video surveillance is best described as which control function?
31. 200. A required control cannot be implemented on a legacy platform, so an alternative providing comparable protection is deployed and documented. What is this?
32. 201. Why is a policy document on its own a weak control?
33. 202. Which property ensures a sender cannot credibly deny having sent a message?
34. 203. A system records which administrator changed a firewall rule and when. Which of the three AAA functions does this serve?
35. 204. Why does an alert from a honeypot carry unusually high confidence?
36. 205. A fake set of credentials is planted in a document share. It is later used to attempt a login. What has this proved?
37. 206. Which four questions structure a threat modelling exercise?
38. 207. Why is threat modelling most valuable during design rather than after implementation?
39. 208. What makes a data flow diagram useful for threat modelling?
40. 209. A threat model was produced two years ago and the architecture has since changed substantially. What is its current value?
41. 210. In the STRIDE prompt list, which threat category does a digital signature most directly address?
42. 211. An architecture layers a firewall, an intrusion prevention system and endpoint protection, all from one vendor sharing one signature feed. What weakens the defence in depth?
43. 212. An electronically controlled fire door loses power. Which design choice should govern its behaviour, and why?
44. 213. Why do secure defaults matter more than good documentation of how to harden a product?
45. 214. A rarely used feature carries repeated vulnerabilities. Which approach reduces risk most durably?
46. 215. An organisation's hardening standard was written for an operating system version no longer deployed. What has happened to it?
47. 216. Which control requires that a system provide only the capabilities it needs, with unnecessary ports, protocols and services disabled?
48. 217. An API key was accidentally committed to a Git repository and the commit was reverted an hour later. What must still be done?
49. 218. Which two reasons argue against holding a production secret in an environment variable? Choose two.
50. 219. What distinguishes a hardware security module from software key storage?
51. 220. Which component anchors full-disk encryption and boot integrity to one specific machine?
52. 221. How does secure boot differ from measured boot?
53. 222. An email gateway opens attachments in an isolated environment before delivery. Which control is this?
54. 223. Which control stops previously unseen malware from executing without needing a signature for it?
55. 224. What is the structural weakness of a deny-listing approach to software control?
56. 225. What does code signing let an organisation verify, and what does it enable operationally?
57. 226. A signed vendor update is later found to contain malicious code. What does this show about signature verification?
58. 227. Which testing approach reads source code without executing it?
59. 228. A parser crashes on malformed input in production despite passing code review. Which technique was most likely to have found this earlier?
60. 229. Why are development, test and production environments kept separate?
61. 230. A team copies a production database into a test environment to reproduce a bug. What must happen first?
62. 231. What security benefit does defining infrastructure as code provide?
63. 232. Under an immutable infrastructure model, how is a compromised host handled?
64. 233. A monitoring team asks for an alert on repeated failed logins in an internal application, but the application emits no such event. What does this illustrate?
65. 234. Which two attributes should an application security log entry carry to support correlation? Choose two.
66. 235. Why must passwords and session tokens never be written to application logs?
67. 236. An attacker submits input containing newline characters that appear in the log as separate, forged entries. What is the defence?
68. 237. A two-node cluster is described as highly available, but both nodes attach to one storage array. What is the flaw?
69. 238. An organisation runs every web server on the same operating system and vendor stack. Which resilience principle is missing?
70. 239. A data centre has an uninterruptible power supply but no generator. Which outage is it unable to survive?
71. 240. Why do cooling and fire suppression belong in a contingency plan alongside data backups?
72. 241. In the deter, delay and detect model of physical security, which layer does a reinforced door belong to?
73. 242. A site relies on cameras as its primary control against theft from a storeroom. What gap does this leave?
74. 243. An air-gapped network has no connectivity to any other network. Where does its risk concentrate?
75. 244. What does privacy by design mean in practice?
76. 245. A relying party needs to know only whether a user is over eighteen. Which approach best satisfies privacy expectations?
77. 246. What does configuration management provide that makes unauthorised change detectable?
78. 247. A team encrypts every secret in its vault at rest. What problem does this leave unsolved?
79. 248. Why does NIST suggest storing a verifier's secret key in a hardware-protected area such as a TPM or trusted execution environment?
80. 249. Which factors should drive the choice between Clear, Purge and Destroy?
81. 250. An organisation uses a third-party disposal vendor. What evidence should it retain?
82. 251. A developer replaces sensitive identifiers with a reversible transformation and calls the data protected. What is the correct assessment?
83. 252. Why does a control catalogue matter more than a list of security intentions?
84. 286. Which two cookie attributes protect a session identifier, and what does each achieve? Choose two.
85. 304. What property of a secrets manager most reduces the value of a leaked credential?
86. 319. Why are hard-coded credentials in a container image particularly dangerous?
87. 351. An authorisation layer is deployed with a deny-by-default posture. What happens when a new endpoint is added and no rule is written for it?
88. 354. Which physical control defeats tailgating through a badge-controlled door?
89. 371. NIST's Access Control family treats access enforcement, account management, least privilege and separation of duties as separate controls. Why does that matter?
90. 417. A new storage medium has no vendor-supported sanitisation command. What follows for the organisation?
91. 451. How does malware most commonly reach an air-gapped network?
92. 527. Which control alerts when a file that should never change is modified?
93. 543. An organisation wants to rotate its encryption key without re-encrypting terabytes of stored data. Which technique achieves this?
94. 552. A laptop with full-disk encryption is stolen while running and unlocked. What protection remains?
95. 553. How does steganography differ from encryption?
96. 555. What is the difference between using an approved algorithm and using a FIPS 140 validated module?
97. 559. An attacker obtains valid query access to a database whose files are encrypted at rest. What still protects individual sensitive fields?
98. 586. Why does OWASP treat storing unnecessary sensitive data as a vulnerability in itself?
99. 588. An application loads a plugin from an unverified source at runtime. Which OWASP category does this fall under?
100. 595. How does reducing the attack surface differ from hardening what remains?
101. 598. Which two events should an application always log? Choose two.
102. 601. Which step of the secure baseline process do most programmes skip, and what is the result?
103. 603. Which two ATT&CK mitigations limit what an adversary can run or elevate to? Choose two.
104. 604. Why are badge readers and visitor logs treated as part of access management rather than facilities work?
105. 605. Why should a secret be scoped to the smallest set of workloads that need it?