View Full Microsoft AZ-104 Exam Dumps and Practice Test Dumps.

 

Question 281

Which security control is primarily used to detect unauthorized changes to critical system files?

1. Network segmentation
2. File integrity monitoring
3. Data masking
4. Load balancing

Correct Answer: 2

Explanation

File integrity monitoring (FIM) detects unauthorized or unexpected changes to important files, directories, and system configurations. It establishes a baseline of approved file states and monitors for modifications, deletions, or additions. When a suspicious change occurs, the system can generate an alert for security personnel to investigate. FIM is especially useful for detecting malware activity, insider threats, and unauthorized configuration changes. It supports the integrity principle by helping organizations ensure that important data and system files have not been altered without proper authorization.

Question 282

Which type of attack attempts to overwhelm a system by sending a large volume of traffic from multiple compromised devices?

1. Phishing
2. DDoS
3. SQL injection
4. Credential stuffing

Correct Answer: 2

Explanation

A distributed denial-of-service (DDoS) attack attempts to make a service unavailable by overwhelming it with traffic or requests from many compromised systems. Attackers commonly use a botnet consisting of infected computers, servers, or IoT devices to generate the traffic. Because the traffic originates from numerous sources, blocking a single attacking IP address is usually ineffective. Organizations can reduce DDoS impact through traffic filtering, rate limiting, load balancing, content delivery networks, and specialized DDoS protection services that identify and absorb malicious traffic.

Question 283

Which authentication factor is represented by a fingerprint scan?

1. Something you know
2. Something you have
3. Something you are
4. Somewhere you are

Correct Answer: 3

Explanation

A fingerprint scan is an example of the authentication factor known as “something you are.” This factor uses biometric characteristics associated with an individual, such as fingerprints, facial features, iris patterns, or voice characteristics. Authentication systems compare the presented biometric information against a previously registered template. Unlike passwords, biometric characteristics are not normally something a user memorizes. Organizations often combine biometrics with another authentication factor, such as a password or security token, to create stronger multifactor authentication and reduce the risk associated with compromised credentials.

Question 284

Which security principle ensures that users receive only the permissions necessary to perform their assigned tasks?

1. Least privilege
2. Separation of duties
3. Job rotation
4. Non-repudiation

Correct Answer: 1

Explanation

The principle of least privilege requires users, applications, and systems to receive only the permissions necessary to complete their legitimate tasks. Limiting permissions reduces the potential damage caused by compromised accounts, malware, or accidental actions. For example, a standard employee should not receive administrative privileges if those permissions are unnecessary for the employee’s job. Least privilege should be reviewed regularly because responsibilities can change over time. Removing unnecessary permissions helps reduce the attack surface and limits unauthorized access to sensitive resources.

Question 285

Which attack involves an attacker placing themselves between two communicating parties to intercept or modify information?

1. Man-in-the-middle
2. Password spraying
3. Brute force
4. DDoS

Correct Answer: 1

Explanation

A man-in-the-middle (MITM) attack occurs when an attacker positions themselves between two communicating parties and intercepts their communication. Depending on the attack, the attacker may simply monitor information or actively modify messages before forwarding them to the intended recipient. MITM attacks can occur on insecure wireless networks, compromised network infrastructure, or through fraudulent certificates and other techniques. Encryption, certificate validation, secure protocols such as HTTPS, and properly configured wireless security can help prevent attackers from successfully intercepting sensitive communications.

Question 286

Which technology is commonly used to securely connect a remote employee to an organization’s internal network over the internet?

1. VPN
2. Hub
3. Repeater
4. Proxy ARP

Correct Answer: 1

Explanation

A virtual private network (VPN) creates a protected connection between a remote user and an organization’s network over an untrusted network such as the internet. VPN technologies commonly use encryption and authentication to protect data while it travels between endpoints. Remote-access VPNs allow employees to securely access internal resources without exposing those resources directly to the public internet. Organizations may also use site-to-site VPNs to connect entire networks. Strong authentication, secure protocols, proper configuration, and regular monitoring are important for maintaining VPN security.

Question 287

Which security control is designed to prevent unauthorized software from executing on a system?

1. Application allowlisting
2. Data retention
3. Network address translation
4. Load balancing

Correct Answer: 1

Explanation

Application allowlisting permits only explicitly approved applications or software to execute on a system. Anything that is not included in the approved list can be blocked automatically. This approach can significantly reduce the risk of malware and unauthorized software execution, particularly on systems that perform sensitive or critical functions. Allowlisting is generally more restrictive than application blocklisting because blocklisting requires security teams to identify known malicious applications. Proper management is important because legitimate software must be approved and updated as organizational requirements change.

Question 288

Which type of malware is designed to encrypt files and demand payment from the victim?

1. Spyware
2. Ransomware
3. Rootkit
4. Adware

Correct Answer: 2

Explanation

Ransomware is malware that typically encrypts files or otherwise prevents users from accessing their data and then demands payment from the victim. Modern ransomware attacks may also involve data theft, followed by threats to publish the stolen information. Organizations can reduce ransomware risk through regular offline or immutable backups, endpoint protection, patch management, application controls, network segmentation, and employee security awareness. Backups are particularly important because they can allow an organization to restore critical information without relying entirely on the attacker’s demands.

Question 289

Which security assessment identifies vulnerabilities by actively attempting to exploit systems?

1. Vulnerability scanning
2. Penetration testing
3. Log review
4. Configuration auditing

Correct Answer: 2

Explanation

Penetration testing involves authorized security professionals attempting to exploit vulnerabilities in systems, applications, networks, or other assets. Unlike a basic vulnerability scan, a penetration test can demonstrate whether a vulnerability is actually exploitable and what level of access or impact could result. Penetration testers may use techniques similar to those used by real attackers while operating within an approved scope. Organizations use penetration testing to validate security controls, identify weaknesses, assess potential business impact, and prioritize remediation efforts.

Question 290

Which type of phishing attack is specifically delivered through text messages?

1. Vishing
2. Smishing
3. Pharming
4. Whaling

Correct Answer: 2

Explanation

Smishing is a form of phishing conducted through SMS or other text messaging platforms. Attackers may send messages pretending to be banks, delivery companies, employers, government agencies, or other trusted organizations. The message often contains a malicious link or requests sensitive information such as passwords, payment details, or verification codes. Users should avoid clicking unexpected links in text messages and should verify requests through official communication channels. Security awareness training and mobile device security controls can help reduce the success rate of smishing attacks.

Question 291

Which security control provides a record of user activities so that actions can be traced back to individual accounts?

1. Accounting
2. Encryption
3. Obfuscation
4. Redundancy

Correct Answer: 1

Explanation

Accounting, also called auditing or accountability, records activities performed by users and systems so those actions can be reviewed later. Logs may include login attempts, file access, configuration changes, administrative commands, and other important events. Accounting supports security investigations by helping determine who performed a particular action and when it occurred. It also supports compliance requirements and incident response. For effective accountability, organizations should protect logs from unauthorized modification, synchronize system clocks, establish appropriate retention periods, and regularly review important security events.

Question 292

Which type of attack attempts many passwords against one account before moving to another account?

1. Password spraying
2. Credential stuffing
3. Brute-force attack
4. Pass-the-hash

Correct Answer: 3

Explanation

A traditional brute-force attack attempts many possible passwords against a single account until the correct password is discovered. Attackers may use automated tools to systematically test combinations of letters, numbers, symbols, and known password patterns. Strong password policies, account lockout controls, multifactor authentication, rate limiting, and monitoring of repeated failed login attempts can reduce the effectiveness of brute-force attacks. Password spraying differs because it generally uses a small number of commonly used passwords across many accounts to avoid triggering account-specific lockout mechanisms.

Question 293

Which security device is specifically designed to inspect and filter HTTP and HTTPS traffic to protect web applications?

1. WAF
2. Router
3. Wireless controller
4. VPN concentrator

Correct Answer: 1

Explanation

A web application firewall (WAF) is designed to protect web applications by inspecting HTTP and HTTPS traffic and identifying potentially malicious requests. A WAF can help defend against attacks such as SQL injection, cross-site scripting, malicious requests, and certain application-layer exploits. It operates at the application layer and can apply rules based on request characteristics. Although a WAF provides valuable protection, it should not replace secure software development, vulnerability management, authentication controls, or regular application security testing.

Question 294

Which type of encryption uses a public key and a private key?

1. Symmetric encryption
2. Asymmetric encryption
3. Hashing
4. Tokenization

Correct Answer: 2

Explanation

Asymmetric encryption uses a mathematically related public key and private key. The public key can generally be shared with others, while the private key must be protected by its owner. Asymmetric cryptography is commonly used for secure key exchange, digital signatures, and establishing secure communications. In contrast, symmetric encryption uses the same secret key for encryption and decryption. Asymmetric algorithms are generally slower than symmetric algorithms, so many secure communication systems use asymmetric cryptography to establish a session key and symmetric encryption for the actual data transfer.

Question 295

Which backup type copies only the data that has changed since the most recent full or incremental backup?

1. Full backup
2. Differential backup
3. Incremental backup
4. Snapshot

Correct Answer: 3

Explanation

An incremental backup copies data that has changed since the most recent backup of any type. For example, after a full backup, Monday’s incremental backup stores Monday’s changes, while Tuesday’s incremental backup stores only changes made since Monday’s incremental backup. Incremental backups generally require less storage space and take less time than full backups. However, restoring data may require the original full backup and each subsequent incremental backup in sequence. Organizations should select backup methods based on recovery objectives, storage capacity, and restoration requirements.

Question 296

Which concept requires two or more people to complete a sensitive security-related task?

1. Separation of duties
2. Single sign-on
3. Least privilege
4. Federation

Correct Answer: 1

Explanation

Separation of duties divides sensitive responsibilities among multiple individuals so that one person cannot independently complete an entire high-risk process. This reduces the possibility of fraud, abuse, or unauthorized activity by requiring collaboration or approval. For example, one employee might create a financial transaction while another employee approves it. Separation of duties is particularly valuable for administrative operations, financial processes, security changes, and other activities involving significant risk. It also supports accountability because actions are distributed among multiple authorized individuals.

Question 297

Which security solution collects and correlates logs from multiple systems to identify suspicious activity?

1. SIEM
2. HSM
3. NAC
4. DLP

Correct Answer: 1

Explanation

A security information and event management (SIEM) system collects security-related logs and events from multiple sources and analyzes them together. Sources may include firewalls, servers, endpoints, applications, identity systems, and network devices. By correlating events, a SIEM can identify patterns that may indicate attacks or other suspicious behavior. Security teams can use SIEM alerts for monitoring, investigation, incident response, and compliance reporting. Effective SIEM deployment requires proper log collection, useful detection rules, appropriate retention, and regular tuning to reduce false positives.

Question 298

Which security control can automatically isolate a compromised endpoint from the network after detecting malicious activity?

1. EDR
2. DNS
3. DHCP
4. NAT

Correct Answer: 1

Explanation

Endpoint detection and response (EDR) solutions monitor endpoint activity and can detect suspicious processes, files, connections, and behaviors. Many EDR platforms provide response capabilities such as isolating a compromised endpoint from the network while allowing security personnel to continue investigating it. This can help contain malware and prevent an attacker from moving laterally to additional systems. EDR also provides security teams with detailed endpoint telemetry that can support incident investigation, threat hunting, and determining how an attack entered and progressed through an environment.

Question 299

Which attack exploits a vulnerability by inserting malicious database commands into an application’s input field?

1. SQL injection
2. Cross-site scripting
3. Directory traversal
4. Buffer overflow

Correct Answer: 1

Explanation

SQL injection occurs when an attacker inserts malicious SQL statements into an application’s input that is later processed by a database. If the application does not properly validate and parameterize input, the attacker may manipulate database queries and potentially access, modify, or delete sensitive information. Developers can reduce SQL injection risk through parameterized queries, prepared statements, input validation, least-privilege database accounts, and secure coding practices. Regular application security testing can also help identify SQL injection vulnerabilities before attackers discover and exploit them.

Question 300

Which security objective ensures that authorized users can access systems and information when they need them?

1. Confidentiality
2. Integrity
3. Availability
4. Non-repudiation

Correct Answer: 3

Explanation

Availability ensures that authorized users can access systems, applications, and information when required. Security incidents such as DDoS attacks, hardware failures, ransomware, power outages, and natural disasters can negatively affect availability. Organizations improve availability through redundancy, backups, failover systems, load balancing, disaster recovery plans, preventive maintenance, and resilient infrastructure. Availability is one of the three core principles of the CIA triad, along with confidentiality and integrity. Effective security planning must protect information from unauthorized disclosure while also ensuring that legitimate users can access it when needed.