View Full Microsoft AZ-104 Exam Dumps and Practice Test Dumps.

 

Question 301

Which security tool continuously monitors systems and networks for changes to configurations, files, and security settings?

1. Configuration monitoring
2. Data masking
3. Load balancing
4. Tokenization

Correct Answer: 1

Explanation

Configuration monitoring continuously checks systems and network devices to identify unauthorized or unexpected changes. It can monitor settings such as firewall rules, operating system configurations, user permissions, installed software, and security policies. Security teams can compare current configurations against approved baselines and investigate deviations. This helps organizations detect configuration drift, unauthorized modifications, and potential security incidents. Configuration monitoring is especially useful in large environments where manually checking every device would be difficult. Automated monitoring can also generate alerts when important security settings are changed.

Question 302

Which type of attack captures valid network communication and retransmits it later to gain unauthorized access?

1. Replay attack
2. DDoS attack
3. Phishing attack
4. SQL injection

Correct Answer: 1

Explanation

A replay attack occurs when an attacker captures legitimate communication, such as an authentication message, and retransmits it later to trick a system into accepting the captured information as valid. The attacker does not necessarily need to understand or decrypt the original communication. Security mechanisms such as timestamps, session identifiers, nonces, sequence numbers, and challenge-response authentication can help prevent replay attacks. These controls make previously captured communications invalid when reused. Replay protection is particularly important for authentication protocols and systems that exchange sensitive information.

Question 303

Which wireless security control allows only approved devices based on their hardware addresses to connect to a network?

1. MAC filtering
2. WPA3 encryption
3. Network segmentation
4. Captive portal

Correct Answer: 1

Explanation

MAC filtering allows a wireless administrator to create a list of approved Media Access Control (MAC) addresses and restrict network access to those devices. It can provide an additional layer of access control by preventing unlisted devices from connecting normally. However, MAC addresses can be spoofed, so MAC filtering should not be considered a strong security mechanism by itself. Organizations should use strong wireless encryption and authentication, such as WPA2 or WPA3, along with other controls. MAC filtering is best viewed as a supplementary security measure.

Question 304

Which type of malware encrypts a victim’s files and typically demands payment for restoring access?

1. Worm
2. Ransomware
3. Trojan
4. Spyware

Correct Answer: 2

Explanation

Ransomware is malicious software that commonly encrypts files or systems and demands payment in exchange for restoring access. Some ransomware operations also steal sensitive information before encrypting systems and threaten to publish the stolen data. Organizations can reduce ransomware risk by maintaining reliable backups, applying security patches, using endpoint protection, restricting administrative privileges, segmenting networks, and training employees to recognize phishing attempts. Regularly testing backups is also important because an organization needs confidence that critical data can actually be restored after an attack.

Question 305

Which security concept ensures that another system or component can take over when the primary component fails?

1. Redundancy
2. Obfuscation
3. Tokenization
4. Federation

Correct Answer: 1

Explanation

Redundancy involves providing additional systems, components, or resources that can take over when a primary resource becomes unavailable. Examples include redundant servers, network connections, power supplies, storage devices, and internet links. Redundancy improves availability and helps organizations continue operations during hardware failures, network problems, or other disruptions. It can also be combined with failover technologies that automatically switch services to an available backup component. Redundancy is an important part of resilient infrastructure and supports business continuity and disaster recovery objectives.

Question 306

Which social engineering attack targets a specific individual with a highly customized fraudulent message?

1. Spam
2. Spear phishing
3. Smishing
4. Pharming

Correct Answer: 2

Explanation

Spear phishing is a targeted form of phishing in which attackers customize fraudulent messages for specific individuals or organizations. Attackers may research the victim’s job role, coworkers, company information, or recent activities to make the message appear legitimate. The goal may be to steal credentials, deliver malware, obtain sensitive information, or convince the victim to transfer money. Because spear-phishing messages can appear highly convincing, organizations should use security awareness training, multifactor authentication, email filtering, and verification procedures for unusual requests.

Question 307

Which security solution is designed to manage, control, and monitor privileged administrator accounts?

1. PAM
2. DLP
3. IDS
4. NAC

Correct Answer: 1

Explanation

Privileged access management (PAM) is designed to secure accounts that have elevated permissions, such as domain administrators, database administrators, and system administrators. PAM solutions can store privileged credentials securely, control when accounts can be used, record administrative sessions, rotate passwords, and enforce approval processes. Protecting privileged accounts is especially important because attackers who compromise them may gain extensive access across an environment. PAM supports least privilege and accountability by limiting unnecessary administrative access and creating records of privileged activities.

Question 308

Which security control prevents unauthorized USB storage devices from being used on company computers?

1. Device control
2. Load balancing
3. DNS filtering
4. Network address translation

Correct Answer: 1

Explanation

Device control allows organizations to manage which hardware devices can connect to and interact with endpoints. Administrators can use device control to block or restrict USB flash drives, external storage devices, smartphones, and other removable media. This can help prevent data theft, unauthorized data transfer, and malware infections introduced through removable devices. Organizations may allow approved devices while blocking unknown hardware. Device control is particularly useful when protecting sensitive information on employee workstations, although it should be combined with other controls such as endpoint protection and data loss prevention.

Question 309

Which security mechanism converts data into a fixed-length value that is difficult to reverse?

1. Hashing
2. Encryption
3. Compression
4. Encoding

Correct Answer: 1

Explanation

Hashing converts input data into a fixed-length value called a hash or digest. A properly designed cryptographic hash function is intended to be one-way, meaning the original data should not be practically recoverable from the hash. Hashing is commonly used to verify file integrity and protect stored passwords when combined with appropriate password-hashing algorithms and salts. Unlike encryption, hashing does not use a decryption key to recover the original information. Even a small change in the original data should produce a significantly different hash value.

Question 310

Which security control restricts access to websites based on categories, URLs, or other web-related rules?

1. Web content filter
2. Network load balancer
3. File integrity monitor
4. Hardware security module

Correct Answer: 1

Explanation

A web content filter controls which websites or web resources users can access based on predefined policies. Organizations may block categories such as malware, gambling, adult content, suspicious domains, or known phishing websites. Filters can also restrict specific URLs, domain names, or types of web content. Besides improving productivity, web filtering can reduce exposure to malicious websites and drive-by downloads. Administrators should regularly update filtering databases and policies because new malicious domains are created frequently. Web filtering works best alongside endpoint security and user awareness training.

Question 311

Which web attack attempts to access files outside the intended directory by manipulating file paths?

1. Directory traversal
2. SQL injection
3. Password spraying
4. ARP poisoning

Correct Answer: 1

Explanation

A directory traversal attack attempts to access files or directories outside the location intended by a web application. Attackers manipulate file paths or parameters to move through the server’s directory structure and access sensitive files. If successful, the attack may expose configuration files, credentials, source code, or other information. Developers can reduce this risk by validating and sanitizing input, using secure file-handling functions, restricting application permissions, and preventing users from directly controlling file paths. Regular application security testing can also identify directory traversal vulnerabilities.

Question 312

Which authentication technology allows a user to access multiple applications after authenticating once?

1. SSO
2. MFA
3. RADIUS
4. TACACS+

Correct Answer: 1

Explanation

Single sign-on (SSO) allows users to authenticate once and then access multiple authorized applications without repeatedly entering separate credentials. SSO can improve user convenience while reducing the number of passwords users must remember. It can also make account management easier because administrators can centrally manage authentication and access policies. However, protecting the central identity provider is extremely important because compromise of an SSO account could provide access to many connected services. Organizations should therefore combine SSO with strong authentication and appropriate access controls.

Question 313

Which network security device controls traffic based on predefined rules such as source IP, destination IP, port, and protocol?

1. Firewall
2. Hub
3. Repeater
4. Patch panel

Correct Answer: 1

Explanation

A firewall monitors and controls network traffic according to configured security rules. Rules can consider information such as source and destination IP addresses, ports, protocols, applications, and connection states. Firewalls can be deployed between internal networks and the internet, between network segments, or directly on individual systems. Their primary purpose is to allow legitimate traffic while blocking unauthorized or suspicious connections. Effective firewall security depends on carefully designed rules, regular reviews, logging, and removing obsolete or overly permissive rules.

Question 314

Which attack allows an attacker to intercept communications between two systems without either system realizing it?

1. Man-in-the-middle
2. Ransomware
3. Brute force
4. Privilege escalation

Correct Answer: 1

Explanation

A man-in-the-middle attack occurs when an attacker secretly intercepts communication between two parties. The attacker may monitor sensitive information, steal credentials, or modify messages before forwarding them to the intended destination. Public or poorly secured wireless networks can create opportunities for this type of attack. Strong encryption, certificate validation, secure wireless configurations, and properly implemented authentication can help protect communications. Users should also avoid entering sensitive information on suspicious networks and should verify that secure connections are properly established before transmitting confidential data.

Question 315

Which security objective ensures that information remains accurate and is not improperly modified?

1. Confidentiality
2. Integrity
3. Availability
4. Authentication

Correct Answer: 2

Explanation

Integrity ensures that information remains accurate, complete, and protected from unauthorized modification. Security controls supporting integrity include hashing, digital signatures, file integrity monitoring, access controls, and change-management procedures. If an attacker modifies a financial record, system configuration, or important document without authorization, the integrity of that information has been compromised. Organizations should restrict who can modify sensitive data and maintain appropriate logs to track changes. Integrity is one of the three principles of the CIA triad, alongside confidentiality and availability.

Question 316

Which type of security control is intended to discourage attackers by making them believe an attack will have consequences?

1. Deterrent
2. Corrective
3. Compensating
4. Recovery

Correct Answer: 1

Explanation

A deterrent security control is designed to discourage individuals from attempting unauthorized or malicious activities. Examples include warning banners, visible security cameras, security guards, and clearly stated disciplinary policies. These controls may not physically prevent an attack, but they can influence an attacker’s decision by increasing the perceived risk of being detected or punished. Deterrent controls are often used together with preventive and detective controls. For example, a warning sign may deter unauthorized access while cameras detect activity and access controls prevent unauthorized entry.

Question 317

Which process is used to identify the underlying reason that caused a security incident or system failure?

1. Root cause analysis
2. Risk transfer
3. Data classification
4. Asset disposal

Correct Answer: 1

Explanation

Root cause analysis is a structured process used to determine the underlying reason an incident, failure, or security problem occurred. Instead of focusing only on the immediate symptom, analysts investigate contributing factors and identify what allowed the problem to happen. For example, if malware infected a system, the root cause might involve an unpatched application, excessive privileges, or a successful phishing message. Identifying the root cause allows an organization to implement corrective measures that reduce the likelihood of the same problem happening again.

Question 318

Which authentication factor is represented by a hardware security token?

1. Something you know
2. Something you have
3. Something you are
4. Somewhere you are

Correct Answer: 2

Explanation

A hardware security token is an example of the “something you have” authentication factor because the user must physically possess the device to authenticate. Tokens may generate one-time passwords or use cryptographic mechanisms to prove possession. This factor is different from “something you know,” such as a password, and “something you are,” such as a fingerprint. Using a hardware token together with another authentication factor creates multifactor authentication. Hardware-based authentication can significantly reduce the risk associated with stolen or guessed passwords.

Question 319

Which security measure is most important for restoring organizational data after a destructive ransomware attack?

1. Backups
2. Network scanning
3. Port forwarding
4. MAC filtering

Correct Answer: 1

Explanation

Reliable backups are essential for recovering organizational data after destructive attacks such as ransomware. A properly designed backup strategy should include multiple copies of important information, appropriate storage locations, and regular testing to verify that data can actually be restored. Offline or immutable backups can provide additional protection against attackers who attempt to encrypt or delete backup files. Organizations should also establish recovery procedures and define recovery objectives. Backups reduce dependence on attackers and can help an organization restore operations while minimizing data loss and downtime.

Question 320

Which disaster recovery metric defines the maximum amount of data loss an organization can tolerate, measured in time?

1. RTO
2. RPO
3. MTTR
4. MTBF

Correct Answer: 2

Explanation

The recovery point objective (RPO) defines the maximum amount of data an organization can afford to lose after an incident, expressed as a period of time. For example, an RPO of one hour means the organization should be prepared to lose no more than approximately one hour of data. RPO helps determine how frequently backups or data replication should occur. A lower RPO generally requires more frequent backups or continuous replication. RPO is different from RTO, which defines how quickly a service or system should be restored.