View Full Microsoft AZ-104 Exam Dumps and Practice Test Dumps.

 

Question 361

Which security control is used to verify that a user’s identity is valid before granting access to a system?

1. Authentication
2. Authorization
3. Accounting
4. Auditing

Correct Answer: 1

Explanation

Authentication is the process of verifying the identity of a user, device, or system before access is granted. Common authentication methods include passwords, security tokens, smart cards, certificates, and biometric characteristics. Strong authentication helps ensure that only legitimate users can access protected resources. Multifactor authentication strengthens this process by requiring multiple authentication factors. Authentication is different from authorization because authentication confirms who the user is, while authorization determines what that authenticated user is allowed to access or perform within the system.

Question 362

Which type of attack attempts to gain access by trying a small number of commonly used passwords against many accounts?

1. Brute-force attack
2. Password spraying
3. Credential stuffing
4. Pass-the-hash

Correct Answer: 2

Explanation

Password spraying is an attack in which an attacker tries a small number of commonly used passwords against many different user accounts. Instead of repeatedly attacking one account, the attacker distributes login attempts across multiple accounts to avoid triggering account lockout policies. Commonly attempted passwords may include seasonal passwords, simple patterns, or passwords based on an organization’s name. Multifactor authentication, strong password policies, monitoring failed login attempts, and detecting unusual authentication patterns can help organizations identify and prevent password spraying attacks.

Question 363

Which technology provides secure communication by encrypting data transmitted between a web browser and a web server?

1. FTP
2. Telnet
3. HTTPS
4. HTTP

Correct Answer: 3

Explanation

HTTPS uses HTTP over a secure TLS connection to protect communication between a client and a web server. It provides encryption that helps prevent attackers from easily reading information transmitted across the network. HTTPS also supports server authentication through digital certificates and helps protect the integrity of transmitted data. It is commonly used for websites that handle passwords, payment information, personal information, and other sensitive data. Organizations should properly configure TLS and keep certificates valid to maintain secure web communications.

Question 364

Which type of attack attempts to overwhelm a service by sending a large number of requests from a single source?

1. DDoS
2. Phishing
3. Replay
4. DoS

Correct Answer: 4

Explanation

A denial-of-service (DoS) attack attempts to make a system or service unavailable by overwhelming it with excessive traffic, requests, or resource consumption. A traditional DoS attack may originate from a single system, while a distributed denial-of-service attack uses multiple systems. The attacker may target network bandwidth, server processing power, memory, or application resources. Organizations can reduce DoS risks through traffic filtering, rate limiting, redundant infrastructure, load balancing, and specialized protection services. Monitoring can also help identify unusual traffic patterns early.

Question 365

Which security control provides a centralized location for administrators to securely access multiple servers?

1. Honeypot
2. Jump server
3. Proxy server
4. Load balancer

Correct Answer: 2

Explanation

A jump server, also known as a jump box, provides a controlled and centralized access point for administrators who need to manage systems in a protected network. Instead of allowing administrators to connect directly to many sensitive servers, organizations can require administrative access through the jump server. This reduces the number of systems exposed to direct administrative connections and makes monitoring easier. Access to the jump server should be strongly authenticated and logged. Organizations can also apply strict security controls and limit which systems can be accessed through it.

Question 366

Which security technique hides information inside another file, such as an image or audio file?

1. Tokenization
2. Hashing
3. Steganography
4. Encryption

Correct Answer: 3

Explanation

Steganography is a technique used to conceal information inside another type of file, such as an image, audio recording, or video. Unlike encryption, which makes information unreadable without the correct key, steganography attempts to hide the existence of the information itself. Attackers may use steganography to conceal malicious code or stolen information. Security teams can use specialized analysis tools to identify suspicious files and unusual data patterns. File integrity monitoring, endpoint security, and content inspection can also help detect suspicious use of concealed information.

Question 367

Which security control verifies that a device meets organizational security requirements before allowing it to connect to the network?

1. DLP
2. SIEM
3. WAF
4. NAC

Correct Answer: 4

Explanation

Network access control (NAC) evaluates devices before or while they connect to an organization’s network and can enforce security requirements. NAC may check whether a device has current patches, approved security software, appropriate configurations, or valid authentication credentials. Noncompliant devices can be denied access or placed into a restricted network segment. NAC helps prevent insecure or unauthorized devices from gaining normal network access. It is especially useful in environments with many employee devices, guest systems, and managed endpoints that must meet organizational security policies.

Question 368

Which type of malware can replicate itself across networks without requiring a user to manually execute it on every system?

1. Worm
2. Trojan
3. Spyware
4. Adware

Correct Answer: 1

Explanation

A worm is a type of malware that can self-replicate and spread from one system to another, often by exploiting network vulnerabilities or weaknesses in services. Unlike many traditional viruses, worms do not necessarily require a user to execute an infected file to spread. Rapidly spreading worms can consume network resources and compromise large numbers of systems. Organizations can reduce worm activity through timely patching, network segmentation, firewalls, endpoint protection, and disabling unnecessary services. Monitoring network traffic can also help identify unusual propagation patterns.

Question 369

Which type of malware disguises itself as legitimate software to trick a user into installing it?

1. Worm
2. Rootkit
3. Trojan
4. Ransomware

Correct Answer: 3

Explanation

A Trojan is malware that disguises itself as legitimate or useful software to convince users to install or execute it. Unlike a worm, a Trojan generally relies on the victim to initiate its execution. Once installed, it may provide unauthorized access, steal information, download additional malware, or perform other malicious activities. Users should download software only from trusted sources and verify unexpected applications before installation. Endpoint protection, application allowlisting, security awareness training, and least privilege can also reduce the impact of Trojan malware.

Question 370

Which security control helps prevent unauthorized devices from connecting to switch ports?

1. DNS filtering
2. Port security
3. Data masking
4. Load balancing

Correct Answer: 2

Explanation

Port security is a network switch feature that can restrict which devices are allowed to connect through specific physical switch ports. Administrators can configure allowed MAC addresses or limit the number of devices that can use a port. If an unauthorized device attempts to connect, the switch can block the connection or take another configured security action. Port security helps reduce unauthorized physical network access and can prevent some forms of device spoofing. It is most effective when combined with other network access and authentication controls.

Question 371

Which security concept ensures that two people cannot independently complete all stages of a sensitive transaction?

1. Separation of duties
2. Single sign-on
3. Federation
4. Job enlargement

Correct Answer: 1

Explanation

Separation of duties divides important responsibilities among multiple people so that one individual cannot independently complete an entire sensitive process. For example, one employee might create a financial payment while another employee approves it. This reduces opportunities for fraud, unauthorized changes, and abuse of privileges. Separation of duties is especially important for financial systems, administrative functions, security changes, and other high-risk activities. Organizations should carefully design roles so that responsibilities are divided appropriately without creating unnecessary operational delays.

Question 372

Which security technology is designed to detect malicious activity on an individual endpoint and provide investigation and response capabilities?

1. WAF
2. NAC
3. DNS
4. EDR

Correct Answer: 4

Explanation

Endpoint detection and response (EDR) solutions monitor endpoint activity such as processes, files, network connections, and system changes to identify suspicious behavior. EDR platforms provide security teams with detailed information that can be used to investigate potential incidents and determine how an attack occurred. Many EDR solutions also support response actions, such as isolating compromised endpoints, terminating malicious processes, or quarantining suspicious files. EDR improves visibility into endpoint activity and can help organizations detect threats that traditional antivirus software may miss.

Question 373

Which attack attempts to obtain sensitive information by observing a person entering a password or PIN?

1. Tailgating
2. Pretexting
3. Shoulder surfing
4. Dumpster diving

Correct Answer: 3

Explanation

Shoulder surfing occurs when an attacker observes someone entering sensitive information, such as a password, PIN, or security code. The attacker may physically watch the victim or use cameras and other observation methods. This attack is particularly relevant in public areas such as airports, offices, banks, and crowded locations. Users can reduce the risk by shielding keyboards and screens, avoiding entering sensitive information where others can easily observe it, and using privacy filters when appropriate. Multifactor authentication can also limit the value of stolen passwords.

Question 374

Which type of social engineering involves following an authorized person through a secured entrance without authorization?

1. Phishing
2. Tailgating
3. Vishing
4. Pretexting

Correct Answer: 2

Explanation

Tailgating occurs when an unauthorized individual follows an authorized person into a restricted physical area without using their own credentials. Attackers may take advantage of courtesy, distraction, or busy entrances to bypass access controls. Organizations can reduce tailgating through security awareness training, access badges, mantraps, security guards, cameras, and policies requiring employees to challenge unknown individuals. Employees should avoid holding secured doors open for people they do not recognize or allowing others to enter using their credentials.

Question 375

Which type of social engineering attack uses voice communication to deceive a victim?

1. Smishing
2. Phishing
3. Pharming
4. Vishing

Correct Answer: 4

Explanation

Vishing, or voice phishing, uses telephone calls or other voice communication to manipulate victims into revealing sensitive information or performing an unauthorized action. Attackers may impersonate bank representatives, technical support staff, government employees, or company executives. They often create urgency or fear to pressure victims into responding quickly. Organizations can reduce vishing risks through security awareness training, verification procedures, and policies that prohibit sharing passwords or authentication codes over unexpected calls. Employees should independently verify suspicious requests using trusted contact information.

Question 376

Which type of vulnerability occurs when an application allows data to exceed the memory space allocated for it?

1. Buffer overflow
2. SQL injection
3. Directory traversal
4. Cross-site scripting

Correct Answer: 1

Explanation

A buffer overflow occurs when a program writes more data into a memory buffer than the allocated space can safely contain. Excess data may overwrite adjacent memory areas, potentially causing crashes or enabling an attacker to execute malicious code. Buffer overflows are commonly associated with software written in languages that provide limited automatic memory protection. Developers can reduce these risks through secure coding practices, memory-safe languages, bounds checking, input validation, compiler protections, and regular vulnerability testing. Keeping software patched also helps address known buffer overflow vulnerabilities.

Question 377

Which security control is designed to identify vulnerabilities in systems before attackers exploit them?

1. Data destruction
2. Load balancing
3. Vulnerability scanning
4. Network translation

Correct Answer: 3

Explanation

Vulnerability scanning uses automated tools to examine systems and identify known weaknesses such as missing security patches, outdated software, insecure configurations, and exposed services. Regular scanning gives organizations visibility into their security posture and helps security teams prioritize remediation. Scans can be performed against internal networks, external-facing systems, applications, and cloud resources. However, scanning results should be reviewed because tools can produce false positives or fail to identify complex vulnerabilities. Vulnerability scanning is an important part of proactive security management.

Question 378

Which security mechanism protects data by converting readable information into an unreadable format using a cryptographic key?

1. Hashing
2. Encryption
3. Tokenization
4. Encoding

Correct Answer: 2

Explanation

Encryption converts readable plaintext into ciphertext using a cryptographic algorithm and key. The encrypted information can then be decrypted by an authorized party with the appropriate key. Encryption protects data from unauthorized disclosure when it is stored or transmitted. Examples include full-disk encryption, database encryption, encrypted backups, and TLS for network communications. Strong encryption depends not only on the algorithm but also on proper key management. If encryption keys are stolen, lost, or poorly protected, the security of the encrypted information can be seriously affected.

Question 379

Which disaster recovery metric defines how quickly a system must be restored after an outage?

1. RPO
2. MTBF
3. SLA
4. RTO

Correct Answer: 4

Explanation

The recovery time objective (RTO) defines the maximum acceptable amount of time that a system or service can remain unavailable after an incident. For example, an organization with an RTO of two hours should aim to restore the affected service within approximately two hours. RTO helps determine disaster recovery requirements, including backup methods, redundancy, failover systems, and recovery procedures. RTO differs from RPO because RPO focuses on acceptable data loss, while RTO focuses on the acceptable duration of service downtime.

Question 380

Which security process examines an incident after it has been resolved to identify improvements for future incidents?

1. Containment
2. Eradication
3. Lessons learned
4. Identification

Correct Answer: 3

Explanation

The lessons-learned phase occurs after an incident has been handled and focuses on identifying what worked well, what failed, and what should be improved. Security teams may review the timeline, detection methods, response actions, communication procedures, and technical controls used during the incident. The organization can then update policies, security configurations, training, monitoring rules, and incident response plans. Conducting lessons learned helps prevent similar incidents from having the same impact in the future and supports continuous improvement of the overall security program.