CompTIA Security+ (SY0-701) practice questions

A hospital's electronic health record system goes offline for four hours during a ransomware incident, blocking clinicians from reading patient charts. Which pillar of the CIA triad is most directly impacted by this outage?

• AAvailability, because authorised users were unable to access the data when needed.check_circle Correct
• BConfidentiality, because clinicians could not see records they are authorised to view.
• CIntegrity, because the records could not be trusted to be accurate during the outage.
• DNon-repudiation, because the source of the records could not be verified during the outage.

Why A is correct: Availability is the assurance that authorised users can reach systems and data when required. A four-hour outage that blocks clinical access is the textbook impact on availability.

Why B is wrong: Confidentiality concerns unauthorised disclosure, not denial of access to authorised users. The incident may also affect confidentiality if data was exfiltrated, but the four-hour read outage described is fundamentally an availability problem, so this is the wrong best fit.

Why C is wrong: Integrity concerns unauthorised modification or corruption of data. The scenario describes inability to reach the records, not altered content, so integrity is a tempting but incorrect choice.

Why D is wrong: Non-repudiation prevents a party from denying an action they performed and is usually achieved through digital signatures and logging. It is not the pillar harmed by a system being offline, so this option is incorrect.

A logistics company is retiring forty laptops that previously held delivery manifests and payroll files. The IT manager wants the drives processed so that the data cannot be recovered even by a forensic lab, but the chassis themselves will be donated to a local charity in working order. Which disposal action best meets both requirements?

• ARun a quick format from the operating system installer on each laptop before handing the units over to the charity.
• BPerform a vendor-certified cryptographic erase or multi-pass overwrite of each drive, then verify and document the sanitisation before donation.check_circle Correct
• CPhysically shred each drive in an approved media destruction bin and pass the laptops on with the empty drive bays.
• DDelete the user profiles, empty the recycle bin, and rely on full disk encryption being enabled at the time of donation.

Why A is wrong: A quick format only rewrites filesystem metadata and leaves the underlying sectors intact, so commodity recovery tools can restore the manifests and payroll files. It is tempting because it appears to wipe the disk, but it does not satisfy the forensic non-recoverability requirement.

Why B is correct: A certified cryptographic erase or NIST-aligned multi-pass overwrite destroys the readable contents of the drive while leaving the hardware usable, and the verified certificate of sanitisation supports an auditable chain of custody. This satisfies both the non-recoverability and the working-order requirements.

Why C is wrong: Shredding does destroy the data beyond forensic recovery, but it also removes the storage that makes the laptops functional, so the charity would receive incomplete units. The requirement is to keep the chassis in working order, which this approach breaks.

Why D is wrong: Deleting profiles and emptying the recycle bin leaves the underlying data blocks recoverable, and an unrevoked encryption key on a donated machine still permits decryption by the recipient. Candidates may pick this because encryption sounds protective, but without key destruction it does not sanitise the drive.

A marketing team frustrated by slow IT procurement signs up for a third-party analytics SaaS using a corporate credit card and uploads customer contact lists to it. The security team only learns about the service after a data protection audit. Which risk category does this situation most directly illustrate?

• AShadow IT, where business units adopt unsanctioned technology that bypasses security and governance review.check_circle Correct
• BAn advanced persistent threat campaign carried out by a sophisticated external nation-state intrusion set.
• CA malicious insider deliberately exfiltrating sensitive records to harm the employer's reputation and revenue.
• DHacktivism in which ideologically driven outsiders pressure the organisation by leaking confidential customer details online.

Why A is correct: Marketing procured and used a SaaS outside the formal IT process, which is the textbook definition of shadow IT and the source of unmanaged data exposure.

Why B is wrong: APT campaigns involve covert external attackers exploiting systems, not authorised employees openly buying a SaaS subscription with corporate funds for daily marketing tasks.

Why C is wrong: Tempting because data left the perimeter, but the marketing team's intent was operational efficiency rather than sabotage, which distinguishes shadow IT from a malicious insider.

Why D is wrong: No external ideologically motivated party is involved and no public leak has occurred, so the scenario does not match hacktivist behaviour or motivation.