View Full Microsoft AZ-104 Exam Dumps and Practice Test Dumps.

 

Question 381

Which security control is designed to prevent unauthorized users from accessing a restricted physical area?

1. Badge reader
2. Load balancer
3. Proxy server
4. SIEM

Correct Answer: 1

Explanation

A badge reader is a physical access control that verifies an individual’s authorized credential before allowing entry into a restricted area. Employees may use access cards, smart cards, or other identification badges to authenticate themselves at secured doors. Organizations can configure badge readers to allow access only during approved hours or to specific areas based on job responsibilities. Badge systems also create access records that can support security investigations. They are often combined with cameras, security guards, locks, and biometric systems to provide layered physical protection.

Question 382

Which security principle ensures that systems and data remain accessible to authorized users when required?

1. Confidentiality
2. Integrity
3. Availability
4. Authentication

Correct Answer: 3

Explanation

Availability ensures that authorized users can access systems, applications, and information when they need them. Various events can affect availability, including hardware failures, cyberattacks, power outages, natural disasters, and software problems. Organizations can improve availability through redundancy, backups, failover systems, load balancing, disaster recovery plans, and resilient infrastructure. Availability is one of the three components of the CIA triad. A system can maintain confidentiality and integrity while still failing to meet security requirements if legitimate users cannot access the information or services they need.

Question 383

Which type of attack attempts to manipulate users into revealing confidential information by pretending to be a trusted person or organization?

1. Social engineering
2. Network segmentation
3. Port scanning
4. Data masking

Correct Answer: 1

Explanation

Social engineering involves manipulating people into performing actions or revealing information that benefits an attacker. Rather than relying entirely on technical vulnerabilities, attackers exploit human psychology such as trust, fear, urgency, curiosity, or authority. Common social engineering techniques include phishing, pretexting, baiting, vishing, smishing, and tailgating. Security awareness training is one of the most important defenses because users need to recognize suspicious requests and verify unusual instructions. Strong technical controls such as multifactor authentication can also reduce the consequences of successful social engineering.

Question 384

Which security technology provides encrypted remote access to an organization’s internal resources over an untrusted network?

1. Hub
2. Repeater
3. Bridge
4. VPN

Correct Answer: 4

Explanation

A virtual private network (VPN) creates an encrypted connection between a remote user and an organization’s network across an untrusted network such as the public internet. VPNs help protect sensitive information from interception while it travels between the user’s device and the organization’s infrastructure. Remote-access VPNs are commonly used by employees working outside the office, while site-to-site VPNs can securely connect different organizational networks. Strong authentication, secure VPN protocols, updated software, and appropriate access controls are important for maintaining secure remote connectivity.

Question 385

Which type of security control is intended to stop an unwanted event before it occurs?

1. Preventive control
2. Detective control
3. Corrective control
4. Recovery control

Correct Answer: 1

Explanation

Preventive controls are designed to stop or reduce the likelihood of a security incident before it occurs. Examples include firewalls, access controls, authentication mechanisms, security policies, encryption, and application allowlisting. These controls create barriers that make unauthorized activity more difficult. Preventive controls are an important part of defense in depth, but no single control can prevent every possible attack. Organizations should combine preventive controls with detective and corrective measures so that incidents can still be identified and handled if prevention fails.

Question 386

Which security control identifies suspicious activity and generates an alert for investigation?

1. Preventive control
2. Detective control
3. Deterrent control
4. Compensating control

Correct Answer: 2

Explanation

Detective controls are designed to identify security events or suspicious activity after or while an event is occurring. Examples include intrusion detection systems, security cameras, log monitoring, SIEM alerts, and file integrity monitoring. These controls provide visibility into potential threats and allow security teams to investigate unusual activity. Detective controls do not necessarily stop an attack by themselves. Instead, they help organizations recognize incidents quickly so that appropriate containment and response actions can be taken before the impact becomes more severe.

Question 387

Which type of access control is based on centrally defined security labels and classifications?

1. Discretionary access control
2. Mandatory access control
3. Role-based access control
4. Rule-based access control

Correct Answer: 2

Explanation

Mandatory access control (MAC) uses centrally defined security classifications and labels to determine access to resources. Users generally cannot change these permissions themselves because access decisions are controlled by the security policy. MAC is commonly associated with environments requiring strict control over sensitive information, such as military or government systems. A user may have access only when their clearance level and the resource classification meet the required rules. This model provides strong centralized control but can be more complex to administer.

Question 388

Which access control model allows resource owners to determine who can access their resources?

1. Mandatory access control
2. Role-based access control
3. Discretionary access control
4. Attribute-based access control

Correct Answer: 3

Explanation

Discretionary access control (DAC) allows the owner of a resource to determine who can access it and what permissions they receive. For example, the owner of a shared file may grant another user read or write permissions. DAC provides flexibility because resource owners can manage access without requiring a central administrator for every decision. However, this flexibility can also create security risks if users grant excessive permissions. Organizations should combine DAC with appropriate policies and regular access reviews to prevent unnecessary exposure of sensitive information.

Question 389

Which access control model assigns permissions based on attributes such as department, location, device type, or time?

1. Discretionary access control
2. Mandatory access control
3. Attribute-based access control
4. Rule-based routing

Correct Answer: 3

Explanation

Attribute-based access control (ABAC) makes access decisions using characteristics or attributes associated with users, resources, devices, and environmental conditions. For example, a policy might allow an employee to access a sensitive application only when the employee belongs to the finance department, uses a managed device, and connects during approved hours. ABAC can provide highly flexible and detailed access decisions. However, designing and maintaining complex attribute-based policies requires careful planning. Organizations must ensure that attributes are accurate, current, and properly protected.

Question 390

Which attack exploits weaknesses in an application’s handling of user-supplied file paths?

1. SQL injection
2. Directory traversal
3. Password spraying
4. DDoS

Correct Answer: 2

Explanation

Directory traversal occurs when an attacker manipulates file path information to access files or directories outside the application’s intended location. If successful, an attacker may retrieve sensitive configuration files, credentials, source code, or other information stored on the server. Secure applications should validate user input and avoid allowing users to directly control sensitive file paths. Developers can also use secure file APIs, restrict application permissions, and apply proper operating system access controls. Regular security testing can help identify directory traversal vulnerabilities before attackers exploit them.

Question 391

Which security mechanism is commonly used to verify the integrity and authenticity of a digitally signed message?

1. Password
2. MAC address
3. Token
4. Digital signature

Correct Answer: 4

Explanation

A digital signature provides a way to verify the authenticity and integrity of digital information. The sender uses a private key to create the signature, and the recipient can use the corresponding public key to verify it. If the content changes after signing, the verification process can detect the modification. Digital signatures also provide evidence that the message or document was associated with the holder of the private key. They are commonly used in secure email, software distribution, certificates, and electronic documents requiring trust and accountability.

Question 392

Which security method protects stored data if a laptop is lost or stolen?

1. Network segmentation
2. Full-disk encryption
3. Port security
4. DNS filtering

Correct Answer: 2

Explanation

Full-disk encryption protects data stored on a device by encrypting the contents of the storage drive. If a laptop is lost or stolen, an unauthorized person who removes the drive or attempts to access its contents may be unable to read the encrypted information without the appropriate authentication or encryption key. Full-disk encryption is especially important for mobile devices that may contain sensitive business or personal information. Organizations should combine encryption with strong authentication, secure key management, device management, and remote-wipe capabilities.

Question 393

Which security control helps protect against unauthorized changes to operating system and application files?

1. Load balancing
2. NAT
3. File integrity monitoring
4. Network address translation

Correct Answer: 3

Explanation

File integrity monitoring (FIM) establishes a trusted baseline for important files and detects changes that may indicate unauthorized activity. It can monitor system files, application files, configuration files, and other critical resources. If a file is modified, deleted, or replaced unexpectedly, the system can generate an alert for investigation. FIM can help identify malware infections, unauthorized administrative changes, and other integrity issues. It is particularly valuable on servers and systems where unexpected modifications could indicate compromise or create serious operational problems.

Question 394

Which security technique separates sensitive systems from less trusted systems by using isolated network zones?

1. Network segmentation
2. Password synchronization
3. Data compression
4. Tokenization

Correct Answer: 1

Explanation

Network segmentation divides an organization’s infrastructure into separate network zones and controls communication between those zones. Sensitive systems such as databases, payment systems, and administrative servers can be isolated from ordinary user devices and public-facing services. If an attacker compromises a less trusted system, segmentation can limit the attacker’s ability to reach sensitive resources. Firewalls, VLANs, access control lists, and other technologies can enforce segmentation policies. Effective segmentation reduces the potential impact of a breach and supports stronger access control.

Question 395

Which type of malware secretly records a user’s activities and may collect passwords or personal information?

1. Worm
2. Spyware
3. Rootkit
4. Ransomware

Correct Answer: 2

Explanation

Spyware is malware designed to monitor a user’s activities and collect information without proper authorization. Depending on the type, spyware may capture browsing activity, credentials, keystrokes, personal information, or other sensitive data. Attackers can use stolen information for identity theft, financial fraud, espionage, or further compromise. Organizations can reduce spyware risks through endpoint protection, application allowlisting, secure software practices, patch management, and user awareness training. Users should also avoid installing unknown applications or clicking suspicious links that could deliver spyware.

Question 396

Which security control allows an organization to identify who accessed a system and what actions they performed?

1. Encryption
2. Tokenization
3. Network segmentation
4. Audit logs

Correct Answer: 4

Explanation

Audit logs record security-relevant activities performed by users, applications, and systems. They can contain information such as login attempts, account changes, file access, administrative commands, and configuration modifications. Security teams use audit logs to investigate incidents, establish accountability, identify suspicious behavior, and meet compliance requirements. Logs should be protected against unauthorized modification and retained according to organizational policies. Centralized logging and SIEM solutions can make it easier to correlate events from multiple systems and identify patterns that may indicate a security incident.

Question 397

Which disaster recovery strategy maintains a fully operational duplicate environment that can quickly take over if the primary site fails?

1. Hot site
2. Cold site
3. Backup tape
4. Archive site

Correct Answer: 1

Explanation

A hot site is a secondary facility that is fully equipped and ready to take over operations when the primary environment becomes unavailable. It typically contains hardware, software, networking, and other infrastructure needed to support critical services. Because it is already operational or can become operational very quickly, a hot site generally provides a faster recovery time than a cold site. However, maintaining a hot site can be expensive. Organizations choose between hot, warm, and cold recovery facilities based on business requirements, risk, and recovery objectives.

Question 398

Which disaster recovery site has equipment and infrastructure available but generally requires additional preparation before operations can resume?

1. Hot site
2. Warm site
3. Cold site
4. Offline site

Correct Answer: 2

Explanation

A warm site is a disaster recovery facility that has some equipment, connectivity, and infrastructure already available but may require additional configuration or data restoration before normal operations can resume. It provides a balance between the rapid recovery of a hot site and the lower cost of a cold site. Organizations may use warm sites when they need reasonably fast recovery but cannot justify the expense of maintaining a fully operational duplicate environment. The appropriate recovery site depends on business continuity requirements, budget, and acceptable downtime.

Question 399

Which incident response activity focuses on removing malware and closing the vulnerability that allowed an attacker to enter?

1. Identification
2. Containment
3. Eradication
4. Preparation

Correct Answer: 3

Explanation

Eradication is the incident response activity focused on completely removing the cause and remaining elements of a security incident. Security teams may remove malware, delete unauthorized accounts, terminate attacker persistence, patch exploited vulnerabilities, and correct compromised configurations. Simply isolating an infected system does not guarantee that the threat has been removed. Organizations must identify and eliminate the mechanisms that allowed the attacker to maintain access. After eradication is complete, affected systems can proceed toward recovery, validation, and a return to normal operations.

Question 400

Which security principle ensures that data has not been altered by unauthorized individuals or processes?

1. Confidentiality
2. Integrity
3. Availability
4. Authentication

Correct Answer: 2

Explanation

Integrity ensures that information remains accurate, complete, and protected against unauthorized modification or destruction. Organizations can maintain data integrity through access controls, hashing, digital signatures, file integrity monitoring, backups, and change-management procedures. For example, a digital signature can help verify that a document has not been changed after it was signed. Integrity is one of the three fundamental principles of the CIA triad, along with confidentiality and availability. Protecting integrity is essential for financial records, system configurations, databases, applications, and other critical information.