Trifectapp · original learning companion · version 1

Question review workbook — exercises

Write your decision and evidence in review-journal.csv before opening the worked solutions.

Domain 1: General Security Concepts

1. An invoice changes without approval

V8 objective 1.1

An employee can still open a supplier invoice, and access logs show no unauthorized viewing. However, someone changed the payment account after approval without permission. Which security property has most directly been compromised?

  1. Integrity
  2. Confidentiality
  3. Availability
  4. Non-repudiation

2. Prepare for a failed firewall change

V8 objective 1.2

A firewall rule change passes laboratory testing. Before approving production deployment, the service owner asks how the team will restore the previous configuration if legitimate orders stop working. Which addition best answers that concern?

  1. A list of stakeholders who will receive the maintenance notice
  2. A revised network diagram showing the intended final configuration
  3. A tested backout plan with rollback triggers, ownership, and recovery checks
  4. A schedule for reviewing the change after the maintenance window

3. Verify a downloaded firmware package

V8 objective 1.3

A manufacturer distributes firmware publicly. Customers need to verify the publisher and detect changes to the package after release; they do not need to keep the firmware secret. Which approach best meets those requirements?

  1. Encrypt each download with the customer's public key
  2. Sign the package with the manufacturer's private key and verify it with a trusted public key
  3. Publish a plain checksum beside the download on the same page
  4. Compress the package and require a password to extract it

Domain 2: Threats, Vulnerabilities, and Attacks

4. Prioritize risk beyond a severity score

V8 objective 2.1

Two fixes need the same maintenance effort. One addresses a CVSS 9.8 flaw in a disconnected test system with disposable data. The other addresses a CVSS 8.1 flaw in an internet-facing billing service; reliable threat intelligence reports active exploitation of that flaw. Which should normally receive priority?

  1. Prioritize the test system using the higher CVSS score as the main ranking factor
  2. Prioritize whichever finding has remained open longer to reduce the oldest outstanding risk
  3. Schedule both fixes in the same routine batch based on their similar implementation effort
  4. Prioritize the billing service using active exploitation, internet exposure, and business impact

5. Recognize a pattern across many accounts

V8 objective 2.5

During an authorized exercise on an isolated training portal, an analyst observes one common password being tried against 80 different usernames. Each account receives only one attempt per round. Which credential attack is being simulated?

  1. Credential stuffing
  2. Password spraying
  3. Focused brute-force guessing against one account
  4. Replay of a captured session token

6. A benefits notice hides its destination

V8 objective 2.3

An employee scans a QR code on a notice claiming to announce a benefits update. The code opens a convincing company sign-in page on an unrelated domain and requests work credentials. Which threat vector is central to this attempt?

  1. QR-code phishing, often called quishing
  2. Voice phishing through an impersonated help desk
  3. Physical tailgating into a restricted office
  4. A rogue wireless access point impersonating the corporate network

7. A trusted update delivers malicious code

V8 objective 2.4

An investigation finds that attackers compromised a software vendor's build pipeline. The vendor then distributed an update containing a backdoor through its normal channel, with a valid vendor signature. Which explanation best describes the customer's exposure?

  1. A local firewall misconfiguration made the update malicious
  2. An on-path attacker altered the signed file after it left the vendor
  3. A removable-media infection bypassed the update system
  4. A software supply-chain compromise delivered a malicious update

8. Instructions appear inside a document

V8 objective 2.6

A procurement assistant uses an LLM to summarize supplier documents. A supplier's PDF contains instructions telling the assistant to ignore the evaluation rubric and award the highest rating. The assistant follows them. The model's training data was not changed. What is the best classification?

  1. Poisoning of the model's training dataset
  2. A hallucination unrelated to the supplied document
  3. Indirect prompt injection through external content
  4. Direct prompt injection entered by the authorized user

Domain 3: Security Architecture

9. Assign responsibility for a cloud VM

V8 objective 3.1

A company rents unmanaged virtual machines from an infrastructure-as-a-service provider. Its contract assigns physical facilities and the virtualization platform to the provider, while the customer manages guest systems and applications. Which task belongs to the customer?

  1. Replace failed disks in the provider's physical servers
  2. Patch the hypervisor that hosts the virtual machines
  3. Install security updates in the guest operating system
  4. Maintain cooling equipment in the provider's data center

10. Remove automatic trust in the office network

V8 objective 3.2

An internal application currently allows anyone connected to the office LAN to read its records. The security team wants a Zero Trust design that restricts access to authorized users on suitable devices. Which change best supports that goal?

  1. Allow every company-owned device to access every internal application
  2. Require MFA at VPN sign-in, then allow unrestricted internal access
  3. Require longer passwords while retaining access based on LAN membership
  4. Evaluate resource access requests using identity, device posture, and authorization policy

11. Reference payment data without storing it

V8 objective 3.3

A retailer wants its application to reference a customer's saved card without storing the card number. A payment processor can retain the number in a restricted vault and accept a substitute identifier from the retailer. Which protection method matches this design?

  1. Tokenization using a processor-issued substitute value
  2. Masking the displayed number while retaining the original in the application
  3. Hashing the number and attempting to recover it when needed
  4. Encrypting the number while giving the application its decryption key

12. Separate recovery time from data loss

V8 objective 3.4

A business requires its order service to be restored within two hours of an outage. It can tolerate losing no more than 15 minutes of recorded transactions. Which pair correctly expresses these requirements?

  1. RTO 15 minutes; RPO 2 hours
  2. RTO 2 hours; RPO 15 minutes
  3. MTBF 2 hours; MTTR 15 minutes
  4. RTO 2 hours; RPO 2 hours

Domain 4: Security Operations

13. A repository exposes an active secret

V8 objective 4.1

A developer accidentally commits an active production API credential to a public repository. The latest commit removes it, but the credential remains in the repository's history and may have been copied. What is the most urgent next action?

  1. Delete older commits and continue using the credential
  2. Make the repository private without changing the credential
  3. Wait for next week's access-log review before changing anything
  4. Revoke the exposed credential and deploy a securely stored replacement

14. Confirm that a patch solved the finding

V8 objective 4.3

An administrator reports that a vulnerable web-server package has been updated. The remediation ticket is ready for closure, but the security team has no evidence that the running service uses the fixed version. Which action best completes verification?

  1. Review package-manager installation logs and close the finding if the update completed
  2. Run credentialed vulnerability checks and verify the version used by the active service
  3. Confirm the fixed package exists on disk and close the finding if its checksum matches
  4. Confirm change approval and maintenance completion before marking the finding resolved

15. Resist a real-time phishing relay

V8 objective 4.5

Attackers lure users to a lookalike sign-in page and immediately relay captured passwords and manually entered one-time codes to the real service. Which replacement authentication method best addresses this phishing technique?

  1. Password plus an SMS code with a shorter validity period
  2. Password plus a simple approve-or-deny push notification
  3. FIDO2/WebAuthn authentication using a security key unlocked with a PIN
  4. Password authentication with more frequent scheduled password changes

16. Constrain an automated response

V8 objective 4.6

A proposed security playbook suspends accounts associated with a suspicious source address. During testing, a shared office gateway causes hundreds of legitimate users to match one alert. Which safeguard best limits the impact of another false positive?

  1. Cap automatic suspensions and require approval for changes beyond that scope
  2. Raise the detection threshold but leave the number of automatic suspensions unlimited
  3. Schedule all matching account suspensions outside normal working hours
  4. Notify analysts after every unrestricted execution has finished

17. Contain an active ransomware incident

V8 objective 4.7

An analyst confirms ransomware is encrypting files on a workstation and accessing a shared drive. The incident playbook already authorizes EDR network isolation with an approved management channel retained. Which immediate action is best?

  1. Complete a full disk image before changing the workstation's connectivity
  2. Isolate the workstation using the approved control and preserve incident telemetry
  3. Restart the workstation and ask the employee whether it now works
  4. Notify the incident coordinator and wait for additional approval before isolating the host

Domain 5: Security Program Management and Oversight

18. Translate policy into mandatory requirements

V8 objective 5.1

A company policy requires sensitive information to be encrypted. A supporting document specifies the approved cryptographic protocols and minimum key strengths that every applicable system must use. Which governance artifact best describes that supporting document?

  1. A procedure with step-by-step implementation instructions
  2. A guideline offering optional recommendations
  3. A standard defining mandatory technical requirements
  4. A disaster recovery plan for restoring disrupted services

19. Calculate expected annual loss

V8 objective 5.2

For a simplified risk exercise, an asset is valued at $200,000. A single incident is expected to cause a 25% loss, and the estimated annualized rate of occurrence is 0.2. What is the annualized loss expectancy (ALE)?

  1. $10,000
  2. $50,000
  3. $40,000
  4. $250,000

20. Check a supplier before sharing sensitive data

V8 objective 5.3

A payroll provider offers an attractive price and displays a security badge in its sales brochure. It will process employee personal data, but procurement has not reviewed evidence about the service's controls. Which action best supports approval?

  1. Confirm the provider's general security certification and approve the payroll service on that basis
  2. Review its written security policies and approve based on the documented control requirements
  3. Use a recent assurance report for another service from the provider as the payroll assessment
  4. Review current assurance evidence for the payroll service, including scope and unresolved findings

Original Trifectapp practice, not official CompTIA exam questions. This workbook does not predict an exam score. Source: the published guide. Companion prepared November 7, 2026. The saved exercises retain the guide’s existing objective labels; this companion does not independently certify exam coverage.