Free Security+ SY0-701 Mock Exams

An IDS (Intrusion Detection System) differs from an IPS (Intrusion Prevention System) in that an IDS:

• ○ Is deployed inline and can block malicious traffic automatically
• ✓ Only monitors and alerts without taking action to block traffic
• ○ Uses signature updates quarterly, while IPS uses real-time updates
• ○ Can only detect known malware, while IPS uses behavior analysis

During a security audit, an analyst finds that a web application is using RSA to encrypt multi-megabyte files before transmission. What is the PRIMARY performance issue with this approach?

• ○ RSA cannot encrypt large files due to key size limitations
• ✓ Asymmetric encryption is computationally expensive for bulk data
• ○ RSA requires more network bandwidth than symmetric encryption
• ○ The encrypted files cannot be decrypted by the recipient

A security analyst receives an alert about suspicious outbound traffic from an internal workstation. The analyst needs to quickly determine which specific process initiated the connection to a known malicious IP address. Which endpoint security capability would provide the most detailed process-level visibility?

• ○ Host-based intrusion detection system (HIDS)
• ○ Mobile device management (MDM)
• ✓ Endpoint detection and response (EDR)
• ○ Application allowlisting

An e-commerce company determines that its order processing system must be restored within 2 hours after an outage, and no more than 15 minutes of transaction data can be lost. Which TWO metrics do these requirements define?

• ✓ RTO and RPO
• ○ MTD and RTO
• ○ RPO and MTBF
• ○ MTTR and MTD

A malicious insider plants code in a production application that will wipe customer records on a specific future date. This is called a:

• ○ Trojan horse
• ○ Rootkit
• ✓ Logic bomb
• ○ Time bomb virus