CompTIA Security+ Performance-Based Questions

Delete the Telnet rule: Telnet sends passwords in clear text and nothing needs it. Change the SSH rule’s source from the internal network to the jump host, so one hardened machine is the only way in. Everything else, including the web server reaching file shares inside, is blocked by the implicit deny at the end of the list, so no deny rules are needed.

One password tried against many accounts is password spraying, which stays under each account’s lockout limit. A quote mark followed by OR '1'='1 is SQL injection: it tries to rewrite the database query. A script saved in a comment that runs in other visitors’ browsers is stored cross-site scripting. An access point copying a trusted network name is an evil twin. A request for money that appears to come from an executive is business email compromise. A brute-force attack tries many passwords against one account, and an on-path attack intercepts traffic between two parties.

Preparation happens before any incident: the plan, the tools and the training. Detection notices that something is wrong, and analysis confirms what it is and how far it reaches. Containment stops the spread before eradication removes the cause, because cleaning a machine that is still infecting others achieves nothing. Recovery returns systems to service, and lessons learned improves the plan for next time.

A preventive control stops the incident from happening: a blocking rule, encryption. A deterrent control discourages the attempt without physically stopping it, which is what warnings do. A detective control notices and records an incident. A corrective control limits or repairs the damage afterwards, as a restore or a fire extinguisher does.

The firewall belongs where the internet meets the company’s networks, so every packet in or out crosses it. The load balancer sits in front of the two web servers and shares requests between them. The intrusion detection sensor hangs off the internal switch, where a mirror port sends it a copy of the traffic: it alerts but can’t block, and a failure of the sensor doesn’t take the network down. A VPN concentrator ends remote users’ tunnels, and an access point adds Wi-Fi; the scenario asks for neither.

Transferring a risk moves its financial impact to someone else, usually an insurer. Avoiding a risk means stopping the activity that creates it. Mitigating a risk adds controls that make it less likely or less damaging. Accepting a risk means deciding, on the record, to live with it because treating it would cost more than it is worth. Ignoring a risk is not a recognized response.