CompTIA Security+ Preparation · lesson 42 of 45 · 25 min
Domain 3 & 4 Review — Security Architecture & Operations
This practice set covers Security+ Domains 3 (Security Architecture) and 4 (Security Operations). Focus on cloud security, IAM, incident response, and forensics concepts.
Domain 3 & 4 — 15 Practice Questions
In the shared responsibility model, which is always the customer’s responsibility?
- Physical data center security
- Hypervisor patching
- Data and user access management
- Network infrastructure
Answer: Data and user access management
Customers always own their data and access controls regardless of cloud service model.
Which cloud tool continuously monitors for misconfigurations?
- CASB
- CSPM
- SIEM
- WAF
Answer: CSPM
CSPM continuously audits cloud configurations for security issues.
ZTNA grants broad network access like a traditional VPN.
- True
- False
Answer: False
ZTNA grants per-app access only — not broad network access.
Which NIST IR phase involves removing malware and patching the exploited vulnerability?
- Containment
- Eradication
- Recovery
- Detection
Answer: Eradication
Eradication removes the root cause of the incident.
The most volatile data type — lost when power is removed — is CPU _____ and cache.
Answer: registers
CPU registers and cache are the most volatile — lost immediately on power loss.
A write blocker prevents:
- Malware execution
- Writes to evidence media during acquisition
- Network connections
- Log deletion
- Answer: Writes to evidence media during acquisition
Write blockers preserve forensic integrity by preventing any writes to evidence.
ALE = SLE × _____.
- EF
- AV
- ARO
- CVE
Answer: ARO
Annual Loss Expectancy = Single Loss Expectancy × Annual Rate of Occurrence.
Which regulation requires 72-hour breach notification to supervisory authorities?
- HIPAA
- PCI-DSS
- GDPR
- SOX
Answer: GDPR
GDPR requires notification within 72 hours of becoming aware of a personal data breach.
Separation of duties requires that no single person controls an entire critical process.
- True
- False
Answer: True
Separation of duties prevents fraud by requiring multiple people for critical processes.
Which firewall type can inspect Layer 7 content and decrypt TLS traffic?
- Packet filter
- Stateful
- NGFW
- Circuit-level
Answer: NGFW
Next-Generation Firewalls operate at Layer 7 and can perform TLS inspection.
Hiding data within an image file is called:
- Encryption
- Steganography
- Hashing
- Obfuscation
- Answer: Steganography
Steganography conceals data within other files.
Which IAM concept provides enhanced controls for administrator accounts?
- SSO
- PAM
- RBAC
- MFA
Answer: PAM
PAM (Privileged Access Management) provides vaulting, session recording, and just-in-time access for admin accounts.
The GDPR right allowing individuals to request deletion of their personal data is called the right to be _____.
Answer: forgotten
The right to be forgotten (right to erasure) allows individuals to request deletion of their personal data.
A tabletop exercise involves executing actual IR procedures on live systems.
- True
- False
Answer: False
Tabletop exercises are discussion-based simulations — no live systems are touched.
Which cloud deployment model uses dedicated infrastructure for a single organization?
- Public
- Community
- Private
- Multi-cloud
Answer: Private
Private cloud provides dedicated infrastructure for one organization.
Previous lesson: Business impact analysis (BIA): RTO, RPO, MTBF, MTTR, critical assets
Back to CompTIA Security+ Preparation
Next lesson: Third-party risk management and vendor assessment