CompTIA Security+ Domain 1: General Security Concepts

A digital signature hashes the data for integrity and signs that hash with the private key, so only the holder could have produced it, giving non-repudiation.

• BThis confuses signing with encrypting the payload; the package body remains readable, so signing the hash does not hide or protect the data's confidentiality.
• CAvailability concerns uptime and access to resources, which a signature does nothing to guarantee; this misapplies a CIA pillar unrelated to the signing operation.
• DSigning uses an asymmetric private/public key pair, not a shared secret; no symmetric session key is negotiated or exchanged by this process at all.

The Policy Enforcement Point operates in the data plane, sitting inline to permit, block, or terminate sessions based on the decision passed from the control plane.

• AThe Policy Decision Point evaluates trust and renders the verdict but does not sit inline acting on traffic; it decides rather than enforces the session itself.
• BThe Policy Engine, part of the decision point, computes whether to grant access; it lives in the control plane and never directly handles the data-plane traffic flow.
• DThe Policy Administrator relays the decision and establishes or tears down the connection path but is a control-plane coordinator, not the inline traffic gatekeeper.

Accounting tracks and logs user actions, session duration, and resource consumption after access, providing exactly the audit trail the analyst needs for the investigation.

• AAuthentication only verifies the identity at login by validating credentials; it confirms who connected but does not log ongoing session activity, timing, or volume.
• BAuthorization determines which resources a verified user may reach and what actions are permitted, but it does not produce the historical usage record being requested.
• CFederation lets one organization trust another's identities for single sign-on; it is not an AAA pillar and does not capture per-session resource consumption logs.

Hashing is one-way so plaintext cannot be recovered, and a per-user salt defeats rainbow tables while still letting the system verify a login by re-hashing input.

• ASymmetric encryption is reversible, so anyone holding the key, including administrators, can decrypt the stored values back to plaintext, defeating the irreversibility requirement.
• CBase64 is an encoding scheme with no secret key, trivially reversed by anyone; it provides representation, not protection, so plaintext is effectively still exposed.
• DAsymmetric encryption is still reversible by whoever holds the private key, and it provides confidentiality rather than the one-way irreversibility this storage scenario demands.

A honeytoken is bogus data, such as a fake credential or record, placed inside real systems so any interaction with it reliably signals unauthorized access or insider snooping.

• BA honeypot is a whole decoy host or service standing apart to lure attackers, not a single fake record embedded directly inside a genuine production database table.
• CA honeynet is an entire network of interconnected decoy systems built to study attacker behavior, which is far broader than one planted data record triggering an alert.
• DA sandbox executes untrusted code in a contained environment to observe its behavior, but it does not involve planting bait data inside live systems to catch intruders.

A backout plan documents the steps to undo a change and restore the last known-good state when implementation fails, which is exactly what the team performed here.

• AA maintenance window is the approved time slot reserved for performing the change, not the recovery procedure invoked to roll back once the deployment causes an outage.
• CVersion control stores and tracks successive configuration revisions, supporting a rollback, but it is a record-keeping tool rather than the named change-management recovery step itself.
• DStakeholder approval is the authorization granted before work begins; it precedes deployment and has nothing to do with reverting the system after the change breaks connectivity.

A hardware security module is a dedicated, tamper-resistant appliance that generates, stores, and manages keys centrally while offloading cryptographic processing for many servers at scale.

• AA TPM is a passive chip soldered to one device's motherboard, anchoring keys for that single machine, so it cannot centrally serve thousands of certificates across many servers.
• BA secure enclave is an isolated region within one processor protecting that device's secrets, not a shared network appliance built to manage keys for an entire fleet.
• DKey escrow is a policy of depositing key copies with a trusted party for recovery, which is a governance arrangement rather than a hardware appliance performing crypto operations.

The Online Certificate Status Protocol lets a client query a responder for the revocation status of one specific certificate in real time, avoiding any full list download.

• AA certificate revocation list is the bulky, periodically published file of all revoked certificates the scenario explicitly wants to avoid, since it must be downloaded and parsed entirely.
• BA certificate signing request is what an applicant sends to obtain a certificate from a CA; it plays no role in checking whether an existing certificate has been revoked.
• CCertificate pinning hardcodes an expected key or certificate to resist impostors, but it does not query revocation status and offers no real-time check against the issuing authority.

An access control vestibule uses two interlocking doors that admit one person at a time, opening the inner door only after the outer one closes, which directly defeats tailgating and piggybacking.

• BA bollard is a sturdy fixed post that blocks vehicles from ramming a structure, so it addresses vehicle-borne threats at the perimeter rather than stopping a person from following someone inside.
• CVideo surveillance records activity and may deter or help investigate intrusions afterward, but a passive camera cannot physically prevent a second person from walking in behind an authorized badge holder.
• DA proximity badge reader authenticates one person's credential at the door, yet on its own it cannot stop an unauthorized follower from entering during the brief moment the door remains open.

Impact analysis evaluates, before approval, which systems and services a proposed change could affect and the risk if it fails, supplying exactly the information the advisory board requires here.

• AA backout plan documents how to reverse a change and restore the prior known-good state after a failure, but it is executed during rollback rather than assessing potential effects beforehand.
• CA maintenance window is the scheduled timeframe reserved to perform a change with minimal disruption, so it concerns when the work happens rather than analyzing what the change might break.
• DStakeholder approval is the formal authorization to proceed, which relies on the analysis but is the decision itself rather than the structured assessment of downstream effects and associated risk.

The Subject Alternative Name extension lets a single certificate list multiple distinct fully qualified domain names, so one certificate can validly cover acme.com, acme.net, and acme.org all together.

• AA wildcard certificate secures only multiple subdomains beneath one base domain, such as *.acme.com, so it cannot cover names belonging to entirely different domains like acme.net or acme.org.
• BA self-signed certificate is signed by its own key with no trusted authority, which concerns who vouched for the certificate rather than how one certificate can list several different domain names.
• DA certificate chain links a leaf certificate to intermediates up to a trusted root for path validation, which establishes trust rather than covering several different host names on one certificate.

Ephemeral Diffie-Hellman generates a fresh, short-lived key for each session that is never stored, providing perfect forward secrecy so a later private-key theft cannot decrypt previously recorded sessions.

• AKey escrow deposits copies of keys with a trusted party so they can be recovered later, which actually increases the exposure of stored keys instead of shielding past sessions from a future theft.
• BStatic RSA key exchange encrypts the session secret with the server's long-term public key, so stealing the matching private key later lets an attacker decrypt every previously captured session.
• COCSP stapling has the server cache and attach a signed revocation status to speed certificate validation, which proves a certificate is currently valid rather than protecting recorded traffic from future key compromise.

Operational controls are implemented and executed primarily by people performing day-to-day activities, which exactly describes awareness training and tabletop exercises staff carry out.

• AManagerial controls are administrative directives like policies and risk assessments; training execution by people is performed work, so this category does not fit best.
• BTechnical controls are enforced by hardware or software such as firewalls and encryption, not by humans completing training exercises, so this label is wrong here.
• DPhysical controls protect tangible assets through fences, locks, or guards; awareness training is a human activity, not a barrier safeguarding physical space, so it does not apply.

A compensating control substitutes for a required safeguard the system cannot meet, exactly matching VLAN isolation plus monitoring used in place of the mandated multifactor authentication.

• ADirective controls instruct or mandate behavior through policy and guidance; isolating a system to offset a missing safeguard is a substitute measure, not an instruction to people.
• CDetective controls only identify events after they occur; while monitoring detects, the overall design substitutes for missing MFA, making compensating the more complete classification here.
• DCorrective controls remediate after an incident to restore systems; this design proactively offsets an unmet requirement rather than fixing damage following a breach event.

Key stretching functions like PBKDF2 apply many iterations to make each hash deliberately slow, raising the cost of offline brute-force guessing beyond salting alone.

• AA single fast SHA-256 pass is computationally cheap and easily parallelized on GPUs, so it does not deliberately slow guessing the way an iterative function does.
• BAES is a reversible cipher meant for confidentiality of data, not for one-way password storage, and it does nothing to increase brute-force cost per guess.
• CBase64 is reversible encoding for transport, providing no cryptographic protection and no added computation cost, so attackers simply decode it instantly with no slowdown.

A Trusted Platform Module is an on-board chip that seals and stores keys bound to that one device, ideal for protecting full-disk encryption keys locally.

• BA hardware security module is a network or removable appliance for high-volume key management across systems, not a chip bound to a single laptop's board.
• CA key management service centrally manages keys in software, often in the cloud, and does not provide the per-device on-board hardware sealing the scenario requires.
• DA certificate authority issues and signs digital certificates for identity trust; it has no role in sealing a disk encryption key inside an individual device.