RANGER CompTIA Security+ (SY0-701) · chapter 10 of 27
Month 3: Read the signs, lock it down
In this chapter Objectives 2.4, 2.5
Objective 2.4
Indicators of malicious activity
Account clues
Account lockout: many accounts (or a key one) suddenly locked from failed logins points to brute force or spraying, or an attacker locking users out on purpose. Concurrent session usage: one account logged in from two places at once when the user can only be in one. Impossible travel: logins from places too far apart for the time between them (Detroit, then Lagos 30 minutes later).
Exam tip Impossible travel is about distance vs. time; concurrent session usage is about two active sessions at once. One log can show both.
System and content clues
Resource consumption: unusual CPU, memory, disk or bandwidth use, such as a server pegged at 100% at night (crypto-mining, exfiltration). Resource inaccessibility: services, files or accounts suddenly can't be reached (ransomware encryption, DoS, changed passwords). Blocked content: security tools blocking attempts to reach known bad sites, or malware blocking access to security updates and security sites.
Exam tip Blocked content works both ways: a filter blocking a C2 domain, or malware stopping antivirus updates. Both are signs of infection.
Log and publication clues
Out-of-cycle logging: log entries at unexpected times, such as patching or admin activity at 3 a.m. on a Sunday when nothing is scheduled. Missing logs: gaps in logs or cleared logs, because attackers delete evidence. Published/documented: the attack or your data shows up publicly, such as your customer data for sale on a forum, or an attacker or researcher documenting the breach online.
Security log FS02 10:05:58 4624 logon svc_backup 10:06:01 1102 audit log cleared <- ! (no events 10:06 - 10:39)
Exam tip Windows event 1102 means the security log was cleared. A cleared log is itself evidence.
Check yourself 1Kibble & Co.'s shop customer list shows up for sale on a criminal forum, though no internal alert ever fired. Which indicator is this?
- Out-of-cycle logging
- Published/documented
- Missing logs
- Resource inaccessibility
Show the answer
Answer: B. Published/documented
Finding your data or the attack described publicly is the published/documented indicator. Missing logs would be gaps in your own records, and nothing here mentions logs.
Objective 2.5
Mitigation techniques
Segmentation, access control, allow lists, isolation
Segmentation splits the network into zones (VLANs, subnets, firewalls between them) so an attacker in one can't reach all. Access control limits who and what reaches a resource: access control lists (ACLs) on routers, firewalls and files, and permissions (read, write, execute) on data. An application allow list lets only approved programs run; everything else is blocked. Isolation cuts a system off: quarantining an infected PC, or sandboxing an app.
Exam tip Allow list = only known good runs (strongest). Deny list = known bad blocked (misses new malware).
Patching, encryption, monitoring, least privilege
Patching fixes known vulnerabilities; make it fast, tested and tracked, including firmware and third-party apps. Encryption protects data at rest and in transit so stolen data is unreadable. Monitoring (SIEM, EDR, log review) finds what other controls miss. Least privilege gives users and services only the rights they need, for only as long as needed.
Exam tip If the question says "limit the damage a compromised account can do", think least privilege.
Configuration enforcement and decommissioning
Configuration enforcement makes systems match an approved secure baseline and keeps them that way, for example Group Policy, MDM, or network access control that checks posture before a device connects. Decommissioning retires systems safely: remove them from the network and inventory, revoke their accounts and certificates, and wipe or destroy their storage so no data leaks.
Exam tip A forgotten old server still on the network is attack surface. Decommissioning includes the data, not just the power switch.
Objective 2.5
Hardening techniques
Make each host harder to break
Hardening reduces a system's attack surface. CompTIA lists: encryption (full-disk, files), installation of endpoint protection (antivirus/EDR), a host-based firewall that filters traffic on the device itself, a host-based intrusion prevention system (HIPS) that detects and blocks malicious activity on the host, disabling ports/protocols you don't need (Telnet, SMBv1), default password changes on every device, and removal of unnecessary software (bloatware, old tools).
- Encryption
- Endpoint protection
- Host-based firewall
- HIPS
- Disable unused ports/protocols
- Change default passwords
- Remove unnecessary software
Exam tip Host-based firewall filters traffic; HIPS watches behavior and blocks attacks. A laptop on hotel Wi-Fi needs the host firewall.
Check yourself 2The warehouse handheld scanners should run only the inventory app and nothing else, even if a user downloads something. Which mitigation fits BEST?
- Application allow list
- Segmentation
- Host-based firewall
- Decommissioning
Show the answer
Answer: A. Application allow list
An application allow list lets only approved programs run, so anything else is blocked. A host-based firewall filters network traffic but doesn't stop a program from running.
Practice questions
Answer in your head, then open the answer. Ranger's Cyber Patrol has 60 questions like these for Security+, with mock exams.
Question 1The shop's 'add product image from URL' feature fetches whatever URL a seller enters. Web logs show the requests in the exhibit, all from one seller account. Which attack is this?
- Server-side request forgery (SSRF)
- Directory traversal
- Cross-site request forgery (CSRF)
- DNS cache poisoning
Show the answer
Answer: A. Server-side request forgery (SSRF)
The seller is making the server itself request internal addresses, including the cloud metadata service, that the seller could never reach directly. That is server-side request forgery; CSRF instead abuses a victim's browser.
Question 2A signed purchase contract and an altered copy with different terms have the same MD5 value but different SHA-256 values. The e-signature tool signs only the MD5 digest of each document. What does this MOST likely show?
- A pass-the-hash attack using the signer's credentials
- A collision; the original signature also fits the altered copy
- A birthday attack that recovered the signer's private signing key
- A downgrade of the signing tool's TLS session
Show the answer
Answer: B. A collision; the original signature also fits the altered copy
Two different files share one MD5 value, so someone produced an MD5 collision. Because the tool signs only that digest, the original signature validates the altered contract too; MD5 must not be used for signatures.
Question 3The exhibit shows web app logs for one customer, who was at home on one laptop and did not sign in again after 08:59. Which conclusion is BEST supported?
- The laptop switched from Wi-Fi to a cellular hotspot
- The customer's password was guessed by brute force
- The customer's session token was stolen and replayed
- A password spraying attack hit the customer's account
Show the answer
Answer: C. The customer's session token was stolen and replayed
The same session ID is used at the same time from a second IP with a different browser and OS, with no new login or MFA, and then changes the payout method. Someone captured the session cookie and is replaying it; no password was needed.
Question 4The web shop slows to a crawl. Metrics from the incident are in the exhibit. Which attack is MOST likely under way?
- A brute-force attack against customer logins
- Reflected/amplified DDoS from open resolvers
- SQL injection through the search field
- Application-layer DDoS via costly searches
Show the answer
Answer: D. Application-layer DDoS via costly searches
Thousands of residential IPs send random searches that skip the cache and overload the database, while bandwidth is barely above normal. That is a distributed application-layer flood; an amplified attack would saturate bandwidth with large replies.
Question 5IP cameras on VLAN 40 must be reachable only by the video recorder (NVR) at 10.10.20.5, which pulls their streams on TCP 554. The current inter-VLAN rules are in the exhibit. Which change BEST enforces segmentation without breaking video?
- Replace rules 1-2 with: allow 10.10.20.5 to VLAN40 on TCP 554
- Replace rule 1 with: allow VLAN40 to 10.10.20.5 on any TCP port
- Keep rules 1-2 and turn on a host firewall in each camera
- Move rule 3 to the top so it is evaluated first
Show the answer
Answer: A. Replace rules 1-2 with: allow 10.10.20.5 to VLAN40 on TCP 554
Only the recorder needs to reach the cameras, and only on RTSP (TCP 554), so one narrow allow above the default deny segments the VLAN. Moving the deny to the top would block everything, video included.
CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.