A company has yearly engagements with a service provider. The general terms and conditions are the same for all engagements. The company wants to simplify the process and revisit the general terms every three years. Which of the following documents would provide the best way to set the general terms?
A. MSA
B. NDA
C. MOU
D. SLA
Show Answer
Correct Answer: A
Explanation: A Master Service Agreement (MSA) establishes the overarching legal terms and conditions that govern an ongoing business relationship across multiple future engagements or statements of work. This allows individual yearly engagements to reference the MSA without renegotiating the general terms each time, and the MSA can be reviewed and renewed on a multi-year cycle. An NDA only covers confidentiality, an MOU is generally a non-binding statement of intent, and an SLA defines service performance levels rather than the overall contractual framework.
Question 62
A user needs to complete training at https://comptiatraining.com. After manually entering the URL, the user sees that the accessed website is noticeably different from the standard company website. Which of the following is the most likely explanation for the difference?
A. Cross-site scripting
B. Pretexting
C. Typosquatting
D. Vishing
Show Answer
Correct Answer: C
Explanation: The most likely explanation is typosquatting. An attacker registers a domain name that closely resembles a legitimate site, relying on users to manually enter or misread the URL. A noticeably different website after entering the address is consistent with visiting a lookalike domain. Cross-site scripting is a web application vulnerability, pretexting is a social engineering technique, and vishing is voice phishing.
Question 63
While a school district is performing state testing, a security analyst notices all internet services are unavailable. The analyst discovers that ARP poisoning is occurring on the network and then terminates access for the host. Which of the following is most likely responsible for this malicious activity?
A. Unskilled attacker
B. Shadow IT
C. Insider threat
D. Nation-state
Show Answer
Correct Answer: C
Explanation: ARP poisoning requires access to the local Layer 2 network. In the scenario, the attack occurs during state testing and the malicious host is on the network, making an insider with legitimate or physical network access the most likely source. Shadow IT is unauthorized technology rather than a threat actor, and a nation-state is disproportionate for this scenario. While an unskilled attacker could run ARP spoofing tools, the scenario most strongly points to an insider threat.
Question 64
Which of the following could potentially be introduced at the time of side loading?
A. User impersonation
B. Rootkit
C. On-path attack
D. Buffer overflow
Show Answer
Correct Answer: B
Explanation: Side loading installs software from outside trusted distribution channels, increasing the risk of introducing malicious code. A rootkit is malware that can be bundled with a side-loaded application to gain stealthy privileged access. User impersonation and on-path attacks are distinct attack techniques, and a buffer overflow is a coding vulnerability rather than something typically introduced by the act of side loading.
Question 65
A contractor is required to visually inspect the motherboards of all new servers that are purchased to determine whether the servers were tampered with. Which of the following risks is the contractor attempting to mitigate?
A. Embedded rootkit
B. Supply chain
C. Firmware failure
D. RFID keylogger
Show Answer
Correct Answer: B
Explanation: Visually inspecting new server motherboards for signs of unauthorized modifications is intended to detect hardware tampering introduced during manufacturing, assembly, or shipping. This mitigates supply chain risk. An embedded rootkit is typically a software/firmware persistence mechanism not reliably identified by simple visual inspection, firmware failure is an operational issue rather than tampering, and an RFID keylogger is unrelated to motherboard inspection.
Question 66
Which of the following is the most important element when defining effective security governance?
A. Discovering and documenting external considerations
B. Developing procedures for employee onboarding and offboarding
C. Assigning roles and responsibilities for owners, controllers, and custodians
D. Defining and monitoring change management procedures
Show Answer
Correct Answer: C
Explanation: Effective security governance is fundamentally about establishing accountability and decision-making. Clearly assigning roles and responsibilities (such as data owners, controllers, and custodians) is the key governance element because it defines who is responsible for protecting assets, enforcing policy, and making security-related decisions. The other options describe important governance inputs or operational processes, but they are not as foundational as establishing clear accountability.
Question 67
An engineer needs to ensure that a script has not been modified before it is launched. Which of the following best provides this functionality?
A. Masking
B. Obfuscation
C. Hashing
D. Encryption
Show Answer
Correct Answer: C
Explanation: Hashing provides integrity verification by producing a fixed-size digest of the script. Recomputing the hash before execution and comparing it to a trusted original hash reveals whether the script has been modified. Masking hides data, obfuscation makes code harder to understand, and encryption protects confidentiality rather than directly verifying integrity.
Question 68
An organization designs an inbound firewall with a fail-open configuration while implementing a website. Which of the following would the organization consider to be the highest priority?
A. Confidentiality
B. Non-repudiation
C. Availability
D. Integrity
Show Answer
Correct Answer: C
Explanation: A fail-open firewall continues allowing traffic if the firewall fails, prioritizing continued access to the website over strict traffic filtering. This design choice favors availability, even though it may reduce confidentiality and integrity protections during the failure. Non-repudiation is not the primary concern in this scenario.
Question 69
For an upcoming product launch, a company hires a marketing agency whose owner is a close relative of the Chief Executive Officer. Which of the following did the company violate?
A. Independent assessments
B. Supply chain analysis
C. Right-to-audit clause
D. Conflict of interest policy
Show Answer
Correct Answer: D
Explanation: Hiring a vendor owned by a close relative of the CEO creates a potential personal interest that could improperly influence, or appear to influence, procurement decisions. This is a classic conflict of interest and would violate the organization's conflict of interest policy. The other options concern independent evaluations, supply chain review, or contractual audit rights, none of which directly address nepotism or related-party relationships.
Question 70
Which of the following is a use of CVSS?
A. To determine the cost associated with patching systems
B. To identify unused ports and services that should be closed
C. To analyze code for defects that could be exploited
D. To prioritize the remediation of vulnerabilities
Show Answer
Correct Answer: D
Explanation: CVSS (Common Vulnerability Scoring System) is used to assess and score the severity of known vulnerabilities so organizations can prioritize remediation efforts. It does not estimate patching costs, identify unused ports/services, or perform code analysis.
$19
Get all 608 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.