Security+ SY0-801 Practice Questions: General Security Concepts

Correct answer: B. Compensating

B is correct because it provides an alternative safeguard that offsets a weakness the primary system cannot fix on its own. A discourages an attacker from trying, such as a warning banner, but does not add an authentication safeguard. C restores a system or limits damage after an incident has occurred, rather than offsetting a known gap in advance. D instructs people what to do through policy or procedure, rather than technically enforcing MFA.

Correct answer: B. Defense in depth

B is correct because layering different controls means an attacker who defeats one still faces the others. A records what users do for auditing, but does not describe layering several controls. C prevents someone from denying they performed an action, which is unrelated to layering controls. D limits each account to the minimum access it needs, rather than stacking several protective layers.

Correct answer: B. Availability

B is correct because the attack prevents authorized customers from reaching the service when they need it. A concerns proving who performed an action and is not part of the CIA triad. C concerns preventing unauthorized disclosure of data, and no data was exposed by the flood. D concerns preventing unauthorized changes to data, and no records were altered.

Correct answer: C. Accounting

C is correct because it tracks what users did and which resources they consumed, which supports auditing and billing. A is a CIA triad goal about keeping services reachable and is not part of AAA. B decides which resources an authenticated user may access, rather than logging usage. D verifies a user's identity at login, rather than recording session activity afterward.

Correct answer: D. Physical

D is correct because they are tangible barriers that protect a facility and the people inside it. A covers administrative oversight such as policies and risk assessments. B is implemented through hardware or software systems such as firewalls and encryption. C covers day-to-day procedures carried out by people, such as awareness training.

Correct answer: A. Detective

A is correct because it identifies and reports suspicious activity rather than stopping it. B substitutes for a primary control that cannot be implemented. C restores systems or limits damage after an incident has been confirmed. D blocks an action before it can occur, which the IDS does not do here.

Correct answer: C. Non-repudiation

C is correct because a valid digital signature proves the signer took the action, so they cannot credibly deny it. A keeps systems and data reachable for authorized users, and does not prove who took an action. B layers multiple controls to protect assets and does not tie an action to a person. D limits users to the minimum access needed and does not prove who approved something.

Correct answer: B. Integrity

B is correct because comparing the hash shows whether the file was modified after the vendor published it. A would require encrypting the file, and a published hash does not hide its contents. C decides what an authenticated user may access, not whether a file was modified. D concerns keeping the download reachable, not confirming the file is unchanged.

Correct answer: A. Confidentiality

A is correct because encryption kept the customer data from being disclosed to an unauthorized person. B keeps data reachable for authorized users, and encryption did nothing to keep the stolen laptop available. C protects data from unauthorized modification, while the concern here is disclosure. D tracks user activity for auditing and is part of AAA, not the CIA triad.

Correct answer: C. Authentication

C is correct because the smart card and PIN prove the employee's claimed identity before access is granted. A records what the user does during the session rather than confirming identity. B happens after identity is confirmed and decides which resources the user may reach. D reviews recorded activity after the fact and does not verify identity at login.