Security+ CDS Class Exam Content

Question 1

Concerning Security Control Functions

What are Preventative Controls?

First of Five

Answer 1

• These controls aim to stop security incidents before they happen. They are the first line of defense, designed to block or deter potential threats.
• Examples: Firewalls, Antivirus & Antimalware, Access Controls (such as Authorization & Authentication), Encryption, etc.

Question 2

Concerning Security Control Functions

What are Detective Controls?

Second of Five

Answer 2

• Detective controls are designed to identify and alert administrators to security events or breaches that have occurred or are in progress.
• They help uncover potential threats that have bypassed preventive controls.
• Examples: Intrustion Detection Systems (IDS), Security Information and Event Management (SIEM), Security Audits and Assessments, Log Monitoring.

Question 3

Concerning Security Control Functions

What are Corrective Controls?

Third of Five

Answer 3

• These controls focus on mitigating the impact of a security incident after it has occurred. They aim to restore normal operations, limit damage, and prevent the issue from recurring.
• Examples: Backup & Recovery Systems, Incident Response Plans, Patch Management (software), and System Hardening.

Question 4

Concerning Security Control Functions

What are Deterrent Controls?

Fourth of Five

Answer 4

• Deterrent controls aim to discourage potential attackers by making it clear that there are consequences for unauthorized activities.
• Examples: Warning Signs and Banners, Security Access, Security Awareness Training, Security Cameras, Guards, etc.

Question 5

Concerning Security Control Functions

What are Compensating Controls?

Fifth of Five

Answer 5

• These controls are implemented when it’s not feasible or practical to use a primary control. They offer an alternative way to mitigate a risk or fulfill a security requirement.
• Examples: Multi-factor Authentication (MFA), VPNs, and Third Party Security Assessments.

Question 6

Capitalize on the Purpose of Security Controls

Understanding the 5 different Security Control Types is important because…

Answer 6

A thorough understanding of them is key to building a comprehensive security strategy. By combining preventive, detective, corrective, deterrent, and compensating controls, you create a layered defense that protects your systems and data from a wide range of threats.

Question 7

1. What is Shadow IT?
2. Why is it a potential risk?

Answer 7

• Shadow IT is the use of information technology systems, software, or hardware within an organization without explicit IT department approval or knowledge.
• The presence of Shadow IT within an Organizations Network introduces unnecessary Security Risks such as the potential for Data Breaches, Malware via unvetted downloads or applications, Compliance Violations, and increasing the potential Attack Surface of a network as an extra and unknown point of entry/vulnerability within the network.

Question 8

What is Typosquatting?

Answer 8

A type of attack in which a threat actor registers a domain name that is very similar to the real one (the targetted website to attact unsuspecting traffic) hoping that users will not notice the difference.

Always Check Domains from Links - Use Virus Total to check Hashes & Sources