Trifectapp · original learning companion · version 1
Question review workbook — worked solutions
The original guide’s explanations are shown below. Compare the reasoning and limitations, not only the final choice. All solution disclosures are expanded for printing.
Domain 1: General Security Concepts
1. An invoice changes without approval
V8 objective 1.1
An employee can still open a supplier invoice, and access logs show no unauthorized viewing. However, someone changed the payment account after approval without permission. Which security property has most directly been compromised?
- Integrity
- Confidentiality
- Availability
- Non-repudiation
Answer and explanation for Question 1
Correct answer: A. Integrity
Integrity concerns the accuracy and authorized modification of information. The invoice's payment details were changed without approval, so the record can no longer be trusted as an accurate representation of the approved transaction.
Why the other options do not fit
- B. Confidentiality concerns unauthorized disclosure; the scenario identifies an unauthorized change, not evidence of someone viewing protected information.
- C. Availability concerns timely access to information or services, and the invoice is still accessible.
- D. Non-repudiation supports evidence that an action occurred and who performed it; the direct failure described is alteration of the record.
Remember: Identify whether the scenario primarily involves disclosure, unauthorized modification, or loss of access.
2. Prepare for a failed firewall change
V8 objective 1.2
A firewall rule change passes laboratory testing. Before approving production deployment, the service owner asks how the team will restore the previous configuration if legitimate orders stop working. Which addition best answers that concern?
- A list of stakeholders who will receive the maintenance notice
- A revised network diagram showing the intended final configuration
- A tested backout plan with rollback triggers, ownership, and recovery checks
- A schedule for reviewing the change after the maintenance window
Answer and explanation for Question 2
Correct answer: C. A tested backout plan with rollback triggers, ownership, and recovery checks
A backout plan defines how to return to a known working state when a change causes unacceptable problems. Clear triggers and an assigned owner make the decision actionable during the maintenance window. Recovery checks confirm that the previous service behavior has actually been restored.
Why the other options do not fit
- A. Notifications coordinate people, but do not describe how to reverse the faulty configuration.
- B. The diagram documents the intended design rather than the steps for restoring the previous working state.
- D. A later review can improve future changes, but does not provide an immediate recovery method.
Remember: Change approval should consider both the intended result and a practical route back.
3. Verify a downloaded firmware package
V8 objective 1.3
A manufacturer distributes firmware publicly. Customers need to verify the publisher and detect changes to the package after release; they do not need to keep the firmware secret. Which approach best meets those requirements?
- Encrypt each download with the customer's public key
- Sign the package with the manufacturer's private key and verify it with a trusted public key
- Publish a plain checksum beside the download on the same page
- Compress the package and require a password to extract it
Answer and explanation for Question 3
Correct answer: B. Sign the package with the manufacturer's private key and verify it with a trusted public key
A digital signature links the package to the corresponding signing key and allows recipients to detect subsequent modification. Customers must trust the association between the verification key and the manufacturer. A valid signature does not, by itself, establish that the software is free from malicious code.
Why the other options do not fit
- A. Encryption for the recipient provides confidentiality but does not establish which publisher created the package.
- C. An attacker who replaces both the package and its unprotected checksum could defeat this check.
- D. Compression and an extraction password do not provide reliable publisher authentication.
Remember: Use signatures for publisher verification and integrity; evaluate software safety separately.
Domain 2: Threats, Vulnerabilities, and Attacks
4. Prioritize risk beyond a severity score
V8 objective 2.1
Two fixes need the same maintenance effort. One addresses a CVSS 9.8 flaw in a disconnected test system with disposable data. The other addresses a CVSS 8.1 flaw in an internet-facing billing service; reliable threat intelligence reports active exploitation of that flaw. Which should normally receive priority?
- Prioritize the test system using the higher CVSS score as the main ranking factor
- Prioritize whichever finding has remained open longer to reduce the oldest outstanding risk
- Schedule both fixes in the same routine batch based on their similar implementation effort
- Prioritize the billing service using active exploitation, internet exposure, and business impact
Answer and explanation for Question 4
Correct answer: D. Prioritize the billing service using active exploitation, internet exposure, and business impact
Prioritization combines technical severity with the environment and current threat activity. The exposed billing service presents a more immediate business risk under the stated conditions.
Why the other options do not fit
- A. Severity helps rank findings, but the score alone does not account for the billing service's active exploitation, external exposure, and business role.
- B. Time open can inform backlog management, but it does not establish the more urgent threat under the stated conditions.
- C. Implementation effort helps plan work, but equal effort does not imply equal likelihood or impact of compromise.
Remember: Prioritize vulnerabilities using severity, exposure, threat activity, and the value of affected services.
5. Recognize a pattern across many accounts
V8 objective 2.5
During an authorized exercise on an isolated training portal, an analyst observes one common password being tried against 80 different usernames. Each account receives only one attempt per round. Which credential attack is being simulated?
- Credential stuffing
- Password spraying
- Focused brute-force guessing against one account
- Replay of a captured session token
Answer and explanation for Question 5
Correct answer: B. Password spraying
Password spraying applies one or a small set of candidate passwords across many accounts. The defining clue is the reuse of the same guess across different usernames.
Why the other options do not fit
- A. Credential stuffing tests previously obtained username-and-password pairs; the scenario specifies one common guess rather than stolen pairs.
- C. Focused guessing would repeatedly test different passwords against the same account, rather than spreading one guess across accounts.
- D. Token replay reuses an authentication artifact; these requests are password-based login attempts.
Remember: Compare the number of targeted accounts with the number of guesses per account.
6. A benefits notice hides its destination
V8 objective 2.3
An employee scans a QR code on a notice claiming to announce a benefits update. The code opens a convincing company sign-in page on an unrelated domain and requests work credentials. Which threat vector is central to this attempt?
- QR-code phishing, often called quishing
- Voice phishing through an impersonated help desk
- Physical tailgating into a restricted office
- A rogue wireless access point impersonating the corporate network
Answer and explanation for Question 6
Correct answer: A. QR-code phishing, often called quishing
The QR code carries a link to an impersonated sign-in page, making it the delivery vector for phishing. The request for work credentials and unrelated destination are the key warning signs. The employee should verify the notice through an established company channel rather than submit credentials.
Why the other options do not fit
- B. Voice phishing relies on spoken interaction; no call or voice message appears in the scenario.
- C. Tailgating involves following an authorized person through a physical access boundary.
- D. A rogue access point impersonates a wireless network; the scenario describes a deceptive web destination.
Remember: A QR code is a delivery mechanism, not evidence that its destination is trustworthy.
7. A trusted update delivers malicious code
V8 objective 2.4
An investigation finds that attackers compromised a software vendor's build pipeline. The vendor then distributed an update containing a backdoor through its normal channel, with a valid vendor signature. Which explanation best describes the customer's exposure?
- A local firewall misconfiguration made the update malicious
- An on-path attacker altered the signed file after it left the vendor
- A removable-media infection bypassed the update system
- A software supply-chain compromise delivered a malicious update
Answer and explanation for Question 7
Correct answer: D. A software supply-chain compromise delivered a malicious update
The compromised build process inserted malicious behavior before the vendor signed and distributed the update. Customers were exposed through a trusted software dependency and delivery channel. The signature can remain valid because it authenticates the released package, not the safety of the build process.
Why the other options do not fit
- A. A firewall configuration can affect exposure, but the evidence identifies malicious code introduced upstream.
- B. Changing the signed content after signing would normally invalidate its signature; this scenario places the compromise before signing.
- C. No external drive or other removable medium is involved.
Remember: A valid software signature does not rule out compromise of the supplier's build process.
8. Instructions appear inside a document
V8 objective 2.6
A procurement assistant uses an LLM to summarize supplier documents. A supplier's PDF contains instructions telling the assistant to ignore the evaluation rubric and award the highest rating. The assistant follows them. The model's training data was not changed. What is the best classification?
- Poisoning of the model's training dataset
- A hallucination unrelated to the supplied document
- Indirect prompt injection through external content
- Direct prompt injection entered by the authorized user
Answer and explanation for Question 8
Correct answer: C. Indirect prompt injection through external content
The attacker placed instructions in a document the assistant was meant to analyze as data. The external content redirected the model's behavior, making this indirect prompt injection. The authorized user's legitimate request did not grant the supplier authority to replace the evaluation rules.
Why the other options do not fit
- A. Training-data poisoning changes data used to develop the model; that did not happen here.
- B. The altered rating follows the document's instructions rather than an unsupported answer invented independently.
- D. Direct injection comes through the prompt input itself; here the instruction arrived inside retrieved material.
Remember: Treat instructions embedded in external documents as untrusted content, not operational authority.
- 01 · SourceSupplier documentThe PDF contains instructions that favour the supplier.
- 02 · Entry pointDocument processingThe assistant reads the PDF while carrying out the user’s legitimate task.
- 03 · EffectChanged evaluationThe assistant follows the document’s instructions instead of the evaluation rubric.
The instruction arrives through external content. The model’s training data is unchanged in this scenario.
Source: OWASP: Prompt Injection.
Domain 3: Security Architecture
9. Assign responsibility for a cloud VM
V8 objective 3.1
A company rents unmanaged virtual machines from an infrastructure-as-a-service provider. Its contract assigns physical facilities and the virtualization platform to the provider, while the customer manages guest systems and applications. Which task belongs to the customer?
- Replace failed disks in the provider's physical servers
- Patch the hypervisor that hosts the virtual machines
- Install security updates in the guest operating system
- Maintain cooling equipment in the provider's data center
Answer and explanation for Question 9
Correct answer: C. Install security updates in the guest operating system
Under the stated IaaS arrangement, the customer administers the guest operating system and applications, including their security updates. The contract and chosen service model determine the actual division of responsibilities.
Why the other options do not fit
- A. Physical server hardware is part of the infrastructure assigned to the provider.
- B. The contract places the virtualization platform, including its hypervisor, with the provider.
- D. Data-center cooling is a physical facility responsibility rather than a guest-system administration task.
Remember: Map cloud security tasks to the service model and agreement, not the word cloud alone.
10. Remove automatic trust in the office network
V8 objective 3.2
An internal application currently allows anyone connected to the office LAN to read its records. The security team wants a Zero Trust design that restricts access to authorized users on suitable devices. Which change best supports that goal?
- Allow every company-owned device to access every internal application
- Require MFA at VPN sign-in, then allow unrestricted internal access
- Require longer passwords while retaining access based on LAN membership
- Evaluate resource access requests using identity, device posture, and authorization policy
Answer and explanation for Question 10
Correct answer: D. Evaluate resource access requests using identity, device posture, and authorization policy
Zero Trust avoids granting access solely because a request originates inside a network boundary. Resource access decisions should consider the requesting identity, relevant device state, and permitted actions. This does not mean asking the user to type credentials again for every network packet.
Why the other options do not fit
- A. Device ownership alone does not establish the user's permission to access a particular resource.
- B. Strong initial authentication does not justify unrestricted access to unrelated applications.
- C. Password strength does not repair an authorization rule that trusts network location.
Remember: Authenticate and authorize access to resources instead of treating network location as permission.
11. Reference payment data without storing it
V8 objective 3.3
A retailer wants its application to reference a customer's saved card without storing the card number. A payment processor can retain the number in a restricted vault and accept a substitute identifier from the retailer. Which protection method matches this design?
- Tokenization using a processor-issued substitute value
- Masking the displayed number while retaining the original in the application
- Hashing the number and attempting to recover it when needed
- Encrypting the number while giving the application its decryption key
Answer and explanation for Question 11
Correct answer: A. Tokenization using a processor-issued substitute value
Tokenization replaces sensitive data with a surrogate identifier that can be used in the intended workflow. In this design, the processor controls the mapping to the original card number.
Why the other options do not fit
- B. Display masking does not remove the original sensitive value from the retailer's storage.
- C. A hash is not a reversible mapping that retrieves the original number for authorized use.
- D. Encryption retains recoverable card data in the application, unlike the requested vault-and-token design.
Remember: Tokenization separates the operational reference from the sensitive value it represents.
12. Separate recovery time from data loss
V8 objective 3.4
A business requires its order service to be restored within two hours of an outage. It can tolerate losing no more than 15 minutes of recorded transactions. Which pair correctly expresses these requirements?
- RTO 15 minutes; RPO 2 hours
- RTO 2 hours; RPO 15 minutes
- MTBF 2 hours; MTTR 15 minutes
- RTO 2 hours; RPO 2 hours
Answer and explanation for Question 12
Correct answer: B. RTO 2 hours; RPO 15 minutes
The recovery time objective concerns the target time to restore service, so it is two hours. The recovery point objective concerns the acceptable data-loss window, so it is 15 minutes.
Why the other options do not fit
- A. This reverses the service-restoration target and the acceptable data-loss window.
- C. MTBF and MTTR describe reliability and repair measurements; they do not express the two stated business recovery objectives.
- D. A two-hour recovery point permits a larger data-loss window than the business accepts.
Remember: RTO asks how long recovery may take; RPO asks how much recent data may be lost.
- 09:45Data recovery pointThe recovered records must be at least this recent.
- 10:00Outage beginsThe business can lose at most the previous 15 minutes of recorded transactions.
- 12:00Restoration deadlineThe order service must be available again within two hours.
RPO = 15 minutesHow much recent data loss is acceptable?
RTO = 2 hoursHow long may service restoration take?
Times illustrate the requirements in Question 12. The timeline is not drawn to scale.
Sources: NIST definitions of recovery point objective and recovery time objective.
Domain 4: Security Operations
13. A repository exposes an active secret
V8 objective 4.1
A developer accidentally commits an active production API credential to a public repository. The latest commit removes it, but the credential remains in the repository's history and may have been copied. What is the most urgent next action?
- Delete older commits and continue using the credential
- Make the repository private without changing the credential
- Wait for next week's access-log review before changing anything
- Revoke the exposed credential and deploy a securely stored replacement
Answer and explanation for Question 13
Correct answer: D. Revoke the exposed credential and deploy a securely stored replacement
The exposed credential must be treated as compromised because deletion cannot recover copies already obtained. Revoking it removes the old credential's usefulness, while a controlled replacement restores legitimate access. The team should also investigate use, preserve relevant logs, and prevent further exposure.
Why the other options do not fit
- A. History cleanup reduces further exposure but does not invalidate copies of the existing credential.
- B. Changing repository visibility does not disable a credential that someone may already possess.
- C. Investigation matters, but delaying revocation leaves the known exposed credential usable.
Remember: Removing a leaked secret from view is not the same as invalidating it.
14. Confirm that a patch solved the finding
V8 objective 4.3
An administrator reports that a vulnerable web-server package has been updated. The remediation ticket is ready for closure, but the security team has no evidence that the running service uses the fixed version. Which action best completes verification?
- Review package-manager installation logs and close the finding if the update completed
- Run credentialed vulnerability checks and verify the version used by the active service
- Confirm the fixed package exists on disk and close the finding if its checksum matches
- Confirm change approval and maintenance completion before marking the finding resolved
Answer and explanation for Question 14
Correct answer: B. Run credentialed vulnerability checks and verify the version used by the active service
Verification checks the actual post-change state rather than relying only on completion of an installation task. An appropriate rescan and running-service checks can reveal an unapplied restart, incorrect package, or remaining vulnerable configuration. Record the evidence before closing the finding.
Why the other options do not fit
- A. Installation logs show that an update task ran, but do not prove the active service is using the fixed version.
- C. A matching file on disk does not establish that the running process has loaded it; the service may still need a restart.
- D. Change approval and maintenance records establish process completion, not that the vulnerability has been removed from the running service.
Remember: A remediation ticket should close on verified results, not just reported activity.
15. Resist a real-time phishing relay
V8 objective 4.5
Attackers lure users to a lookalike sign-in page and immediately relay captured passwords and manually entered one-time codes to the real service. Which replacement authentication method best addresses this phishing technique?
- Password plus an SMS code with a shorter validity period
- Password plus a simple approve-or-deny push notification
- FIDO2/WebAuthn authentication using a security key unlocked with a PIN
- Password authentication with more frequent scheduled password changes
Answer and explanation for Question 15
Correct answer: C. FIDO2/WebAuthn authentication using a security key unlocked with a PIN
Correctly deployed FIDO2/WebAuthn authentication binds the cryptographic response to the legitimate relying party. A lookalike site cannot obtain a valid response for the real service simply by relaying a code the user types. The key's local PIN activates the authenticator rather than becoming a password sent to the website.
Why the other options do not fit
- A. A shorter lifetime does not prevent an attacker from relaying a manually entered code immediately.
- B. A simple approval notification does not provide the specified WebAuthn origin binding and may be approved deceptively.
- D. Scheduled password changes do not bind authentication to the legitimate site.
Remember: Phishing resistance depends on the authentication protocol, not simply the presence of two factors.
Source: NIST SP 800-63B-4: Authenticator and Verifier Requirements.
16. Constrain an automated response
V8 objective 4.6
A proposed security playbook suspends accounts associated with a suspicious source address. During testing, a shared office gateway causes hundreds of legitimate users to match one alert. Which safeguard best limits the impact of another false positive?
- Cap automatic suspensions and require approval for changes beyond that scope
- Raise the detection threshold but leave the number of automatic suspensions unlimited
- Schedule all matching account suspensions outside normal working hours
- Notify analysts after every unrestricted execution has finished
Answer and explanation for Question 16
Correct answer: A. Cap automatic suspensions and require approval for changes beyond that scope
An action limit and an approval boundary constrain what the automation can do when its detection logic is wrong. These guardrails address the scale of impact rather than relying on perfect alerts.
Why the other options do not fit
- B. A stricter threshold may reduce false positives but leaves an unrestricted failure mode when one occurs.
- C. Scheduling changes does not prevent mass account disruption or account for users working at other times.
- D. An after-the-fact notification helps visibility but does not limit the initial damage.
Remember: Design automation for safe failure as well as correct detection.
17. Contain an active ransomware incident
V8 objective 4.7
An analyst confirms ransomware is encrypting files on a workstation and accessing a shared drive. The incident playbook already authorizes EDR network isolation with an approved management channel retained. Which immediate action is best?
- Complete a full disk image before changing the workstation's connectivity
- Isolate the workstation using the approved control and preserve incident telemetry
- Restart the workstation and ask the employee whether it now works
- Notify the incident coordinator and wait for additional approval before isolating the host
Answer and explanation for Question 17
Correct answer: B. Isolate the workstation using the approved control and preserve incident telemetry
Prompt isolation limits the host's opportunity to spread or continue affecting network shares. Retaining the approved management channel supports response and evidence collection. Isolation does not prove local encryption has stopped; continue the authorized playbook's containment and investigation steps.
Why the other options do not fit
- A. Waiting for full imaging while the host remains connected allows the observed activity to continue.
- C. Restarting can destroy volatile evidence and does not establish that the incident is contained.
- D. Notify the coordinator, but do not delay containment to seek approval that the playbook has already granted.
Remember: Contain active harm promptly while preserving useful evidence through the approved response process.
Domain 5: Security Program Management and Oversight
18. Translate policy into mandatory requirements
V8 objective 5.1
A company policy requires sensitive information to be encrypted. A supporting document specifies the approved cryptographic protocols and minimum key strengths that every applicable system must use. Which governance artifact best describes that supporting document?
- A procedure with step-by-step implementation instructions
- A guideline offering optional recommendations
- A standard defining mandatory technical requirements
- A disaster recovery plan for restoring disrupted services
Answer and explanation for Question 18
Correct answer: C. A standard defining mandatory technical requirements
A standard makes a policy enforceable through specific mandatory requirements. Here, the policy states the protection goal while the supporting document defines acceptable technical choices. A procedure could separately explain how administrators configure a particular system to meet that standard.
Why the other options do not fit
- A. A procedure provides an ordered method for performing work; this document defines required outcomes and parameters.
- B. Guidelines are advisory, whereas the stated cryptographic requirements are compulsory.
- D. A disaster recovery plan addresses restoration after disruption rather than approved encryption settings.
Remember: Distinguish the policy goal, mandatory standard, implementation procedure, and optional guideline.
19. Calculate expected annual loss
V8 objective 5.2
For a simplified risk exercise, an asset is valued at $200,000. A single incident is expected to cause a 25% loss, and the estimated annualized rate of occurrence is 0.2. What is the annualized loss expectancy (ALE)?
- $10,000
- $50,000
- $40,000
- $250,000
Answer and explanation for Question 19
Correct answer: A. $10,000
Single loss expectancy is $200,000 × 0.25 = $50,000. Multiply that by the annualized rate of occurrence: $50,000 × 0.2 = $10,000. ALE is an estimate of annual expected loss under the model's assumptions, not a prediction that exactly this amount will be lost next year.
Why the other options do not fit
- B. $50,000 is the estimated loss from one incident, before accounting for its annualized frequency.
- C. $40,000 multiplies the full asset value by 0.2 and omits the 25% exposure factor.
- D. $250,000 divides single loss expectancy by 0.2; ALE requires multiplication by the annualized frequency.
Remember: Calculate SLE from value and exposure, then multiply SLE by ARO to obtain ALE.
SLE = asset value × exposure factor
$200,000 × 0.25 = $50,000
ALE = single loss expectancy × annualized rate of occurrence
$50,000 × 0.2 = $10,000 per year
This is an expected value under the exercise’s assumptions, not a forecast of next year’s actual loss.
20. Check a supplier before sharing sensitive data
V8 objective 5.3
A payroll provider offers an attractive price and displays a security badge in its sales brochure. It will process employee personal data, but procurement has not reviewed evidence about the service's controls. Which action best supports approval?
- Confirm the provider's general security certification and approve the payroll service on that basis
- Review its written security policies and approve based on the documented control requirements
- Use a recent assurance report for another service from the provider as the payroll assessment
- Review current assurance evidence for the payroll service, including scope and unresolved findings
Answer and explanation for Question 20
Correct answer: D. Review current assurance evidence for the payroll service, including scope and unresolved findings
Due diligence evaluates whether the provider's controls and operating practices fit the proposed service and data exposure. Assurance evidence must cover the relevant service and be assessed for scope, currency, and exceptions. Contractual safeguards and ongoing monitoring should follow the risks identified, rather than replacing this review.
Why the other options do not fit
- A. A genuine certification is useful evidence, but its scope and applicability to the payroll service must be checked before relying on it.
- B. Written policies describe intended requirements; they do not by themselves establish how controls operate for the payroll service.
- C. Evidence for a different service does not by itself demonstrate that the payroll service's controls are covered or effective.
Remember: Evaluate evidence for the actual service and data flow before accepting third-party risk.
Answer key
Open the complete answer key
Original Trifectapp practice, not official CompTIA exam questions. This workbook does not predict an exam score. Source: the published guide. Companion prepared November 7, 2026. The saved exercises retain the guide’s existing objective labels; this companion does not independently certify exam coverage.