View Full Microsoft AZ-104 Exam Dumps and Practice Test Dumps.

 

Question 341

Which security principle ensures that sensitive information is accessible only to authorized individuals?

1. Availability
2. Integrity
3. Confidentiality
4. Non-repudiation

Correct Answer: 3

Explanation

Confidentiality is the security principle that ensures sensitive information is accessible only to authorized individuals, systems, or processes. Organizations protect confidentiality through access controls, encryption, authentication, data classification, and security policies. For example, confidential employee records should only be available to authorized personnel. A confidentiality breach can occur when attackers steal credentials, intercept communications, or gain unauthorized access to databases. Confidentiality is one of the three components of the CIA triad, along with integrity and availability, and is essential for protecting private and sensitive information.

Question 342

Which type of attack attempts to use previously stolen usernames and passwords on multiple online services?

1. Credential stuffing
2. Password spraying
3. Brute force
4. Phishing

Correct Answer: 1

Explanation

Credential stuffing occurs when attackers use previously stolen username and password combinations to attempt logins on multiple websites and services. This attack takes advantage of password reuse, because users sometimes use the same credentials across different accounts. Attackers can automate large numbers of login attempts using lists obtained from previous data breaches. Organizations can reduce credential stuffing risks through multifactor authentication, breached-password detection, rate limiting, bot detection, and encouraging users to use unique passwords. Password managers can also help users create and maintain different passwords for different services.

Question 343

Which security technology can detect suspicious network traffic and alert administrators without automatically blocking it?

1. IDS
2. IPS
3. Firewall
4. Proxy

Correct Answer: 1

Explanation

An intrusion detection system (IDS) monitors network or system activity for suspicious patterns and generates alerts when potentially malicious behavior is detected. Unlike an intrusion prevention system, an IDS normally does not automatically block the detected traffic. Security teams can investigate alerts and determine whether an incident has occurred. IDS solutions can use signatures, anomaly detection, or behavioral analysis to identify threats. They are valuable for security monitoring and incident detection, especially when deployed at strategic network locations where suspicious traffic can be observed.

Question 344

Which security technology can automatically block malicious network traffic after detecting an intrusion?

1. IDS
2. IPS
3. SIEM
4. Honeypot

Correct Answer: 2

Explanation

An intrusion prevention system (IPS) monitors network traffic for malicious or suspicious activity and can automatically take action to block or prevent the detected threat. An IPS may use signatures, behavioral analysis, or anomaly detection to identify attacks. Unlike an IDS, which primarily generates alerts, an IPS is designed to actively respond to detected threats. It can help stop exploits, malicious connections, and other attacks before they reach protected systems. Proper configuration is important because overly aggressive rules can block legitimate traffic and create false positives.

Question 345

Which authentication method requires users to provide two or more different types of authentication factors?

1. Single sign-on
2. Multifactor authentication
3. Federation
4. Password synchronization

Correct Answer: 2

Explanation

Multifactor authentication (MFA) requires users to provide two or more authentication factors from different categories, such as something they know, something they have, or something they are. For example, a password combined with a hardware security token provides two different factors. MFA significantly reduces the risk of account compromise because stealing one authentication factor is generally not enough to gain access. Organizations commonly use MFA to protect email, cloud services, administrative accounts, remote access, and other systems containing sensitive information.

Question 346

Which attack tricks a user into visiting a fraudulent website by manipulating domain name resolution?

1. DNS poisoning
2. Shoulder surfing
3. Tailgating
4. Password spraying

Correct Answer: 1

Explanation

DNS poisoning occurs when an attacker corrupts DNS information so that users are directed to an incorrect or malicious destination. A victim may enter the correct website address but receive the IP address of an attacker-controlled server instead. The fraudulent website may attempt to steal credentials, payment information, or other sensitive data. DNS security mechanisms, secure DNS services, monitoring, and proper validation can reduce this risk. Users should also verify secure connections and avoid entering sensitive information on unexpected or suspicious websites.

Question 347

Which security control is used to prevent sensitive information from leaving an organization’s environment without authorization?

1. DLP
2. NAT
3. DHCP
4. VLAN

Correct Answer: 1

Explanation

Data loss prevention (DLP) solutions monitor, detect, and help prevent unauthorized transmission or disclosure of sensitive information. DLP policies can identify data such as financial records, personal information, intellectual property, or confidential documents. Depending on the configuration, a DLP system may block email attachments, prevent copying data to removable devices, or restrict uploads to unauthorized websites. DLP can operate at endpoints, networks, email systems, and cloud platforms. It helps organizations reduce accidental data leakage as well as intentional attempts to steal sensitive information.

Question 348

Which security concept uses decoy systems or resources to attract attackers and observe their behavior?

1. Honeypot
2. Proxy server
3. Load balancer
4. Jump box

Correct Answer: 1

Explanation

A honeypot is a deliberately deployed decoy system designed to attract attackers and provide security teams with information about malicious activity. It may imitate a real server, application, database, or network resource while containing no legitimate business data. Any unexpected interaction with a honeypot can be considered suspicious and investigated. Honeypots can help organizations study attacker techniques, identify intrusion attempts, and improve defensive controls. Because legitimate users generally have no reason to access the decoy, activity involving it can provide useful security indicators with relatively low noise.

Question 349

Which security principle prevents a user from denying that they performed a particular action?

1. Availability
2. Non-repudiation
3. Redundancy
4. Obfuscation

Correct Answer: 2

Explanation

Non-repudiation provides evidence that a specific individual or system performed a particular action and makes it difficult for that party to deny the action later. Digital signatures are commonly used to support non-repudiation because they can demonstrate that a message or document was associated with a specific private key. Audit logs and trusted timestamps can also contribute to accountability. Non-repudiation is important for financial transactions, legal documents, sensitive communications, and other situations where organizations need reliable evidence of who performed an action.

Question 350

Which security control requires visitors to be escorted while inside a restricted facility?

1. Visitor management
2. Network segmentation
3. Application allowlisting
4. Data masking

Correct Answer: 1

Explanation

Visitor management controls help organizations track and control individuals who are not regular employees or authorized personnel. Visitors may be required to sign in, provide identification, receive temporary badges, and remain accompanied by an authorized employee while inside restricted areas. These procedures reduce the risk of unauthorized physical access to sensitive facilities and equipment. Visitor records can also support investigations if a security incident occurs. Physical security controls such as cameras, access cards, guards, and locked doors can work together with visitor management to protect facilities.

Question 351

Which type of attack exploits a vulnerability in a web application by injecting malicious scripts into pages viewed by other users?

1. Cross-site scripting
2. SQL injection
3. Directory traversal
4. Buffer overflow

Correct Answer: 1

Explanation

Cross-site scripting (XSS) is a web application attack in which an attacker injects malicious script content into a webpage that is then executed by a victim’s browser. Depending on the vulnerability, an attacker may attempt to steal session information, modify webpage content, or perform actions using the victim’s browser session. Developers can reduce XSS risks through input validation, output encoding, secure application frameworks, and appropriate content security policies. Regular application security testing can also identify vulnerable input fields and unsafe handling of user-generated content.

Question 352

Which access control model assigns permissions according to a user’s job responsibilities?

1. Role-based access control
2. Discretionary access control
3. Mandatory access control
4. Rule-based routing

Correct Answer: 1

Explanation

Role-based access control (RBAC) assigns permissions according to predefined job roles rather than individually configuring every user’s access. For example, employees in an accounting role may receive access to financial applications, while members of an IT administrator role may receive system-management permissions. RBAC simplifies administration and helps organizations enforce least privilege consistently. When an employee changes departments, administrators can modify the assigned role instead of manually changing many individual permissions. Proper role design and regular access reviews are important to prevent excessive privileges.

Question 353

Which type of security control is designed to restore systems to normal operation after a security incident?

1. Corrective control
2. Deterrent control
3. Preventive control
4. Directive control

Correct Answer: 1

Explanation

Corrective controls are designed to restore systems or processes after a security incident, failure, or other unwanted event has occurred. Examples include restoring data from backups, reinstalling compromised software, repairing damaged systems, and applying patches after vulnerabilities are discovered. Corrective controls generally operate after an incident rather than preventing it from happening in the first place. They are an important part of incident response and recovery planning. Organizations should test corrective procedures regularly to ensure they can restore critical systems effectively when required.

Question 354

Which type of control is implemented as an alternative when the preferred security control cannot be used?

1. Compensating control
2. Preventive control
3. Detective control
4. Deterrent control

Correct Answer: 1

Explanation

A compensating control is an alternative security measure used when the preferred control cannot be implemented or is not practical. For example, if an older system cannot support modern multifactor authentication, an organization might implement stronger network restrictions, additional monitoring, or other controls to reduce the risk. Compensating controls should provide an appropriate level of protection for the specific risk. They are commonly used when technical limitations, compatibility requirements, operational constraints, or legacy systems prevent organizations from implementing the original security requirement.

Question 355

Which security technique replaces sensitive information with a non-sensitive substitute value?

1. Tokenization
2. Hashing
3. Steganography
4. Compression

Correct Answer: 1

Explanation

Tokenization replaces sensitive information with a randomly generated or otherwise non-sensitive value called a token. The token can be used in systems that do not need access to the original sensitive information. The actual data is stored separately in a protected system or token vault. Tokenization is commonly used to reduce exposure of payment card information and other sensitive data. Because the token itself does not normally contain the original information, it can reduce the amount of sensitive data stored throughout an organization’s systems.

Question 356

Which physical security control uses two doors that cannot normally be opened at the same time to prevent unauthorized entry?

1. Mantrap
2. Bollard
3. Fence
4. Turnstile

Correct Answer: 1

Explanation

A mantrap is a physical security area containing two or more doors that are controlled so that only one door can normally be opened at a time. This arrangement helps prevent unauthorized individuals from following an authorized person into a restricted area. Mantraps are commonly used in high-security facilities such as data centers, laboratories, and secure government locations. They may also incorporate badge readers, biometric authentication, cameras, or security guards. Mantraps provide stronger physical access control than ordinary doors because they create an additional verification point.

Question 357

Which security concept ensures that an organization’s security controls continue to function effectively over time?

1. Continuous monitoring
2. Data destruction
3. Network translation
4. Password synchronization

Correct Answer: 1

Explanation

Continuous monitoring involves regularly observing systems, networks, configurations, vulnerabilities, and security events to identify changes or emerging threats. It helps organizations determine whether security controls are still operating as expected and whether new vulnerabilities or suspicious activities have appeared. Continuous monitoring can include SIEM alerts, endpoint telemetry, vulnerability scanning, configuration checks, and network monitoring. Rather than relying only on occasional assessments, organizations can use ongoing monitoring to identify problems more quickly and respond before they become major security incidents.

Question 358

Which incident response phase focuses on limiting the spread and impact of an active security incident?

1. Containment
2. Eradication
3. Recovery
4. Lessons learned

Correct Answer: 1

Explanation

Containment is the incident response phase focused on limiting the spread and impact of an active security incident. Security teams may isolate compromised systems, disable affected accounts, block malicious network traffic, or disconnect infected devices from the network. Containment can be short-term or long-term depending on the situation. Its primary purpose is to prevent the incident from causing additional damage while investigators determine the root cause and prepare for eradication. Effective containment reduces the attacker’s ability to move laterally and limits further compromise.

Question 359

Which security assessment method identifies weaknesses by examining systems without actively exploiting them?

1. Vulnerability scanning
2. Penetration testing
3. Social engineering
4. Red-team exercise

Correct Answer: 1

Explanation

Vulnerability scanning uses automated tools to examine systems, applications, networks, and devices for known security weaknesses. Scanners may identify missing patches, insecure configurations, outdated software, exposed services, and other vulnerabilities. Unlike penetration testing, vulnerability scanning generally does not attempt to fully exploit identified weaknesses. Organizations can perform vulnerability scans regularly to maintain visibility into their security posture and prioritize remediation. Scan results should be reviewed by qualified security personnel because automated tools can produce false positives and may not understand the business impact of every finding.

Question 360

Which backup strategy keeps multiple historical versions of data so that an organization can recover from accidental deletion or corruption?

1. Versioned backups
2. Load balancing
3. Network segmentation
4. Port security

Correct Answer: 1

Explanation

Versioned backups maintain multiple historical copies or versions of files and data rather than keeping only the latest backup. This allows an organization to restore an earlier version when current data has been accidentally deleted, corrupted, overwritten, or encrypted by malware. Versioning can be especially useful against ransomware and accidental file changes because the most recent copy may already contain damaged or encrypted data. Organizations should establish appropriate retention periods, protect backups from unauthorized modification, and regularly test restoration procedures to ensure historical versions remain usable.