Advanced
Certification Prep
#comptia
#security-plus
#sy0-701
#vocabulary
CompTIA Security+ (SY0-701) Vocabulary
5 exercises — performance-based questions (PBQs), threat actor classification (nation-state, hacktivist, insider), vulnerability vs. threat vs. risk, zero trust architecture, and IoC vs. IoA. The precise English vocabulary the Security+ SY0-701 exam tests, distinct from CISSP or CEH.
Why precise Security+ vocabulary matters
- Performance-based questions (PBQs) — simulated tasks, not just multiple choice
- Threat actor types — nation-state, hacktivist, insider threat, script kiddie each carry distinct meaning
- Vulnerability vs. threat vs. risk — three separate concepts the exam tests precisely
- Zero trust — 'never trust, always verify', distinct from defense in depth or segmentation
- IoC vs. IoA — confirmed compromise evidence vs. in-progress attack behaviour
0 / 37 completed
1 / 37
The Security+ SY0-701 exam includes performance-based questions (PBQs) alongside multiple-choice questions. What distinguishes a PBQ from a standard multiple-choice item?
A performance-based question (PBQ) simulates a real task — e.g. matching security controls to the correct scenario, configuring firewall ACL rules in a mock interface, or identifying the attack type from a packet capture excerpt — rather than just picking from four static options. PBQs typically appear at the start of the exam and are weighted more heavily than a single multiple-choice item.
Exam format facts worth knowing the English for:
Exam format facts worth knowing the English for:
- Maximum of 90 questions, mixing multiple-choice and PBQs, in 90 minutes
- Passing score: 750 on a scale of 100–900 (not a percentage)
- The exam uses scenario-based wording throughout — "A security analyst notices..." — so reading comprehension under time pressure matters as much as knowledge
2 / 37
SY0-701 groups threat actors by motivation and sophistication. A company detects a slow, highly targeted, multi-month intrusion using custom malware, consistent with a well-resourced government-backed group. Which threat actor classification fits, and how is it distinct from a "hacktivist"?
A nation-state actor is characterised by high sophistication, significant funding, and patience — consistent with an advanced persistent threat (APT), a term SY0-701 tests directly: a prolonged, stealthy, targeted intrusion, often for espionage or infrastructure disruption rather than quick financial gain.
Threat actor vocabulary the exam expects you to distinguish precisely:
Threat actor vocabulary the exam expects you to distinguish precisely:
- Script kiddie — low skill, uses existing tools/scripts without understanding them
- Hacktivist — ideologically or politically motivated, often seeks public disruption/embarrassment rather than stealth
- Organised crime — financially motivated, moderately-to-highly resourced
- Insider threat — someone with legitimate authorised access who misuses it (malicious or unintentional)
- Nation-state / APT — highest sophistication and resources, long dwell time, specific strategic objectives
3 / 37
A vulnerability scanner flags a web server as having an unpatched library with a known CVE. The security team confirms the library is present but is never loaded at runtime by the application. In SY0-701 vocabulary, how should this finding be described, and why does the distinction matter?
SY0-701 tests the precise triad: vulnerability (a weakness that could be exploited), threat (something/someone capable of exploiting a vulnerability), and risk (the likelihood and impact of a threat actually exploiting the vulnerability). A vulnerability with no viable exploitation path (no attack vector) carries much lower risk even though the vulnerability technically still exists.
Why this matters in real security work: vulnerability scanners produce large volumes of findings, and teams must triage by actual risk, not just raw CVE count. Terms like compensating control (an alternative safeguard used when the primary fix isn't immediately possible) and risk acceptance (a documented decision not to remediate a low-risk finding) are the vocabulary used to justify these triage decisions to auditors and management — precise use of "vulnerability" vs. "risk" avoids both over-reacting to noise and under-reacting to genuine exposure.
Why this matters in real security work: vulnerability scanners produce large volumes of findings, and teams must triage by actual risk, not just raw CVE count. Terms like compensating control (an alternative safeguard used when the primary fix isn't immediately possible) and risk acceptance (a documented decision not to remediate a low-risk finding) are the vocabulary used to justify these triage decisions to auditors and management — precise use of "vulnerability" vs. "risk" avoids both over-reacting to noise and under-reacting to genuine exposure.
4 / 37
A company's security architecture requires every access request — internal or external — to be authenticated, authorised, and continuously validated, with no device or user trusted by default just because it is inside the corporate network perimeter. This architectural principle is called _____.
Zero trust is a major SY0-701 architecture topic: the principle of "never trust, always verify" — no implicit trust is granted based on network location alone (e.g. "it's inside the VPN, so it's safe"). Every request is authenticated and authorised individually, continuously, regardless of origin.
Related terms tested alongside zero trust, and how they differ:
Related terms tested alongside zero trust, and how they differ:
- Defense in depth — layering multiple, different security controls so a single failure doesn't compromise the whole system (a broader concept that zero trust is one modern expression of)
- Least privilege — granting only the minimum access needed for a task, a supporting principle within zero trust policy enforcement
- Network segmentation — dividing a network into isolated zones to limit lateral movement; useful, but on its own still relies on perimeter-style trust within each zone, which zero trust explicitly avoids
- Policy enforcement point / policy decision point — the SY0-701 exam objectives explicitly name these zero-trust architecture components: the PEP enforces a decision made by the PDP for every access request
5 / 37
After an incident, a security operations center (SOC) analyst reviews an indicator of compromise (IoC) — an unusual outbound DNS query pattern to a newly registered domain. What is the correct relationship between an "IoC" and an "IoA" (indicator of attack) in SY0-701 terminology?
An indicator of compromise (IoC) is typically a forensic artifact confirming a breach already happened — a malware hash, a suspicious outbound connection, an unexpected registry key. An indicator of attack (IoA) focuses on the attacker's behaviour and intent as it unfolds (e.g. a sequence of commands consistent with privilege escalation), which can allow detection during an attack rather than only after damage is done.
Related SOC vocabulary tested on SY0-701:
Related SOC vocabulary tested on SY0-701:
- SIEM (Security Information and Event Management) — aggregates and correlates logs to surface IoCs/IoAs
- SOAR (Security Orchestration, Automation, and Response) — automates the response playbook once an indicator is confirmed
- Dwell time — how long an attacker remains undetected in an environment; a key reason IoA-based detection is valued over IoC-only approaches
- CVSS (Common Vulnerability Scoring System) — a standardised severity score (0–10) used to prioritise which vulnerabilities/IoCs need the fastest response
6 / 37
PR Description:
During a code review for the new user authentication module, Lead Developer Sarah comments in the pull request description:
"@John, could you please clarify the use of 'least privilege' here? I'm seeing that the service account has broad permissions to access all database tables. While it *seems* like a good idea to grant temporary access during development, this significantly increases our attack surface if the credentials are ever compromised. We should revisit the principle and ensure only the necessary data is accessed."This question tests understanding of 'least privilege' within a developer context. The key here isn't just *knowing* the definition (minimizing access), but recognizing its application in code review and security discussions. Sarah's comment highlights the potential risks of broad permissions during development – a common mistake – demonstrating that least privilege is about actively limiting access, not just a theoretical concept. Option A is incorrect as it focuses on an unrelated issue; option C correctly identifies it as a principle, but misses the specific situation presented in the PR description.
7 / 37
John is reviewing a PR for a new API endpoint designed to process user profile updates. The PR description includes the line: 'We're using JWTs for authentication and authorization – it's simple and effective!' He suspects this might be a misinterpretation of security best practices. Which of the following statements BEST describes why John is concerned, aligning with SY0-701 concepts?
Option A: JWTs are inherently insecure due to their public key cryptography and should always be replaced with symmetric encryption. Option B: Relying solely on JWTs for authorization without validating claims or implementing robust token revocation mechanisms creates a significant vulnerability, allowing an attacker to impersonate legitimate users. Option C: Using JWTs is acceptable as long as the API endpoint is regularly patched against known vulnerabilities. Option D: JWTs are only suitable for low-traffic APIs and should be replaced with more scalable solutions like OAuth 2.0 for high-volume applications.
The correct answer highlights the critical vulnerability of relying *solely* on JWTs for authorization without proper claim validation and token revocation. This directly relates to SY0-701's emphasis on continuous access control and mitigating risks associated with compromised tokens. The other options represent misconceptions – JWTs aren't inherently insecure, patching alone isn't sufficient security, and their suitability depends on the application scale, not a blanket statement. A key principle is that authorization isn't just about authentication; it involves validating *what* a user is permitted to do.
8 / 37
During a code review for a new microservice responsible for processing customer orders, Developer Alex includes the following comment in the PR description: 'We're using API Gateway with JWTs to secure this endpoint. It's fast and easy!' Senior Security Engineer Ben flags this as potentially problematic. Which of the following best explains Ben's concern, referencing relevant SY0-701 concepts?
Ben's concern stems from the fact that JWTs provide *authentication*, not comprehensive security. While they encrypt the payload, they don't inherently protect against attacks targeting the API Gateway itself (e.g., DDoS, vulnerabilities in the gateway's code). Option A correctly identifies this gap; options B and C misrepresent JWT's capabilities, and option D suggests an unnecessary complexity upgrade.
9 / 37
PR Description:
During a code review for the new user authentication module, Lead Developer Sarah comments in the pull request description:
"@John, could you please clarify the use of 'least privilege' here? I'm seeing that the service account has broad permissions to access all database tables. While it *seems* like a good idea to grant temporary access during development, this significantly increases our attack surface if the credentials are ever compromised. We should revisit the principle and ensure only the necessary data is accessed."This question tests understanding of 'least privilege' within a developer context. The key here isn't just *knowing* the definition (minimizing access), but recognizing its application in code review and security discussions. Sarah's comment highlights the potential risks of broad permissions during development – a common mistake – demonstrating that least privilege is about actively limiting access, not just a theoretical concept. Option A is incorrect as it focuses on an unrelated issue; option C correctly identifies it as a principle, but misses the specific situation presented in the PR description.
10 / 37
John is reviewing a PR for a new API endpoint designed to process user profile updates. The PR description includes the line: 'We're using JWTs for authentication and authorization – it's simple and effective!' He suspects this might be a misinterpretation of security best practices. Which of the following statements BEST describes why John is concerned, aligning with SY0-701 concepts?
Option A: JWTs are inherently insecure due to their public key cryptography and should always be replaced with symmetric encryption. Option B: Relying solely on JWTs for authorization without validating claims or implementing robust token revocation mechanisms creates a significant vulnerability, allowing an attacker to impersonate legitimate users. Option C: Using JWTs is acceptable as long as the API endpoint is regularly patched against known vulnerabilities. Option D: JWTs are only suitable for low-traffic APIs and should be replaced with more scalable solutions like OAuth 2.0 for high-volume applications.
The correct answer highlights the critical vulnerability of relying *solely* on JWTs for authorization without proper claim validation and token revocation. This directly relates to SY0-701's emphasis on continuous access control and mitigating risks associated with compromised tokens. The other options represent misconceptions – JWTs aren't inherently insecure, patching alone isn't sufficient security, and their suitability depends on the application scale, not a blanket statement. A key principle is that authorization isn't just about authentication; it involves validating *what* a user is permitted to do.
11 / 37
During a code review for a new microservice responsible for processing customer orders, Developer Alex includes the following comment in the PR description: 'We're using API Gateway with JWTs to secure this endpoint. It's fast and easy!' Senior Security Engineer Ben flags this as potentially problematic. Which of the following best explains Ben's concern, referencing relevant SY0-701 concepts?
Ben's concern stems from the fact that JWTs provide *authentication*, not comprehensive security. While they encrypt the payload, they don't inherently protect against attacks targeting the API Gateway itself (e.g., DDoS, vulnerabilities in the gateway's code). Option A correctly identifies this gap; options B and C misrepresent JWT's capabilities, and option D suggests an unnecessary complexity upgrade.
12 / 37
PR Description:
During a code review for the new user authentication module, Lead Developer Sarah comments in the pull request description:
"@John, could you please clarify the use of 'least privilege' here? I'm seeing that the service account has broad permissions to access all database tables. While it *seems* like a good idea to grant temporary access during development, this significantly increases our attack surface if the credentials are ever compromised. We should revisit the principle and ensure only the necessary data is accessed."This question tests understanding of 'least privilege' within a developer context. The key here isn't just *knowing* the definition (minimizing access), but recognizing its application in code review and security discussions. Sarah's comment highlights the potential risks of broad permissions during development – a common mistake – demonstrating that least privilege is about actively limiting access, not just a theoretical concept. Option A is incorrect as it focuses on an unrelated issue; option C correctly identifies it as a principle, but misses the specific situation presented in the PR description.
13 / 37
John is reviewing a PR for a new API endpoint designed to process user profile updates. The PR description includes the line: 'We're using JWTs for authentication and authorization – it's simple and effective!' He suspects this might be a misinterpretation of security best practices. Which of the following statements BEST describes why John is concerned, aligning with SY0-701 concepts?
Option A: JWTs are inherently insecure due to their public key cryptography and should always be replaced with symmetric encryption. Option B: Relying solely on JWTs for authorization without validating claims or implementing robust token revocation mechanisms creates a significant vulnerability, allowing an attacker to impersonate legitimate users. Option C: Using JWTs is acceptable as long as the API endpoint is regularly patched against known vulnerabilities. Option D: JWTs are only suitable for low-traffic APIs and should be replaced with more scalable solutions like OAuth 2.0 for high-volume applications.
The correct answer highlights the critical vulnerability of relying *solely* on JWTs for authorization without proper claim validation and token revocation. This directly relates to SY0-701's emphasis on continuous access control and mitigating risks associated with compromised tokens. The other options represent misconceptions – JWTs aren't inherently insecure, patching alone isn't sufficient security, and their suitability depends on the application scale, not a blanket statement. A key principle is that authorization isn't just about authentication; it involves validating *what* a user is permitted to do.
14 / 37
During a code review for a new microservice responsible for processing customer orders, Developer Alex includes the following comment in the PR description: 'We're using API Gateway with JWTs to secure this endpoint. It's fast and easy!' Senior Security Engineer Ben flags this as potentially problematic. Which of the following best explains Ben's concern, referencing relevant SY0-701 concepts?
Ben's concern stems from the fact that JWTs provide *authentication*, not comprehensive security. While they encrypt the payload, they don't inherently protect against attacks targeting the API Gateway itself (e.g., DDoS, vulnerabilities in the gateway's code). Option A correctly identifies this gap; options B and C misrepresent JWT's capabilities, and option D suggests an unnecessary complexity upgrade.
15 / 37
PR Description:
During a code review for the new user authentication module, Lead Developer Sarah comments in the pull request description:
"@John, could you please clarify the use of 'least privilege' here? I'm seeing that the service account has broad permissions to access all database tables. While it *seems* like a good idea to grant temporary access during development, this significantly increases our attack surface if the credentials are ever compromised. We should revisit the principle and ensure only the necessary data is accessed."This question tests understanding of 'least privilege' within a developer context. The key here isn't just *knowing* the definition (minimizing access), but recognizing its application in code review and security discussions. Sarah's comment highlights the potential risks of broad permissions during development – a common mistake – demonstrating that least privilege is about actively limiting access, not just a theoretical concept. Option A is incorrect as it focuses on an unrelated issue; option C correctly identifies it as a principle, but misses the specific situation presented in the PR description.
16 / 37
John is reviewing a PR for a new API endpoint designed to process user profile updates. The PR description includes the line: 'We're using JWTs for authentication and authorization – it's simple and effective!' He suspects this might be a misinterpretation of security best practices. Which of the following statements BEST describes why John is concerned, aligning with SY0-701 concepts?
Option A: JWTs are inherently insecure due to their public key cryptography and should always be replaced with symmetric encryption. Option B: Relying solely on JWTs for authorization without validating claims or implementing robust token revocation mechanisms creates a significant vulnerability, allowing an attacker to impersonate legitimate users. Option C: Using JWTs is acceptable as long as the API endpoint is regularly patched against known vulnerabilities. Option D: JWTs are only suitable for low-traffic APIs and should be replaced with more scalable solutions like OAuth 2.0 for high-volume applications.
The correct answer highlights the critical vulnerability of relying *solely* on JWTs for authorization without proper claim validation and token revocation. This directly relates to SY0-701's emphasis on continuous access control and mitigating risks associated with compromised tokens. The other options represent misconceptions – JWTs aren't inherently insecure, patching alone isn't sufficient security, and their suitability depends on the application scale, not a blanket statement. A key principle is that authorization isn't just about authentication; it involves validating *what* a user is permitted to do.
17 / 37
During a code review for a new microservice responsible for processing customer orders, Developer Alex includes the following comment in the PR description: 'We're using API Gateway with JWTs to secure this endpoint. It's fast and easy!' Senior Security Engineer Ben flags this as potentially problematic. Which of the following best explains Ben's concern, referencing relevant SY0-701 concepts?
Ben's concern stems from the fact that JWTs provide *authentication*, not comprehensive security. While they encrypt the payload, they don't inherently protect against attacks targeting the API Gateway itself (e.g., DDoS, vulnerabilities in the gateway's code). Option A correctly identifies this gap; options B and C misrepresent JWT's capabilities, and option D suggests an unnecessary complexity upgrade.
18 / 37
During a standup meeting, Developer David says, "We've implemented multi-factor authentication for all critical systems. Users are now prompted to verify their identity via SMS code after logging in from a new device.". Which of the following best describes the security principle being demonstrated here?
This scenario illustrates 'Defense in Depth,' which is a core security principle. It emphasizes that relying on a single authentication method isn't sufficient; multiple layers of protection are needed to reduce the impact of a potential compromise. The other options represent different security concepts (DLP, Least Privilege, and Zero Trust) but aren't directly reflected in David's statement.
19 / 37
You receive the following API response from a third-party service:
```json
{
"status": "error",
"code": 403,
"message": "Forbidden: Access denied due to insufficient permissions."
}
What does this response primarily indicate about the security posture of the API?
A '403 Forbidden' status code signifies that the user or application does *not* have permission to access the requested resource. While a DoS attack could cause similar issues, the message explicitly states 'insufficient permissions'. It's crucial to verify authentication credentials and ensure users are granted appropriate roles/scopes for accessing the API.
20 / 37
Lead Developer Maria is reviewing a PR from a junior developer. The PR includes the following comment:
"We're using OAuth 2.0 for authorization. It's a standard protocol and widely supported – it will handle all our authentication needs!"
What potential security concern does Maria likely have regarding this approach?
Although OAuth 2.0 is a widely used standard, relying solely on it without careful configuration can lead to security vulnerabilities. The key concern is the potential for misconfigured scopes or improper token handling, which could allow unauthorized access. It's vital to understand and actively manage the risks associated with any authentication protocol.
21 / 37
A security analyst discovers that a server is running an outdated version of Apache HTTP Server. The vulnerability database indicates this version has a known remote code execution (RCE) flaw. What is the *most* immediate action the team should take?
Patching the server with the latest secure version is the *most* immediate action. This directly addresses the vulnerability by removing the exploitable code. While other actions (firewall rules, vendor support, monitoring) are important security practices, they don't resolve the underlying problem. Waiting to patch creates a continuous risk.
22 / 37
During a Slack conversation about securing a new microservice, Developer Ben states: 'We're using API Gateway with JWTs. It's simple and effective!' What does Ben likely mean, and what potential security consideration should be addressed?
Ben's statement highlights the use of JWTs for authentication and authorization, which is common in modern APIs. However, he's overlooking a critical vulnerability: replay attacks. Without proper safeguards (like expiration times and strong signature verification), an attacker could reuse a valid JWT to gain unauthorized access – this needs careful consideration.
23 / 37
During a standup meeting, Developer David says, "We've implemented multi-factor authentication for all critical systems. Users are now prompted to verify their identity via SMS code after logging in from a new device.". Which of the following best describes the security principle being demonstrated here?
This scenario illustrates 'Defense in Depth,' which is a core security principle. It emphasizes that relying on a single authentication method isn't sufficient; multiple layers of protection are needed to reduce the impact of a potential compromise. The other options represent different security concepts (DLP, Least Privilege, and Zero Trust) but aren't directly reflected in David's statement.
24 / 37
You receive the following API response from a third-party service:
```json
{
"status": "error",
"code": 403,
"message": "Forbidden: Access denied due to insufficient permissions."
}
What does this response primarily indicate about the security posture of the API?
A '403 Forbidden' status code signifies that the user or application does *not* have permission to access the requested resource. While a DoS attack could cause similar issues, the message explicitly states 'insufficient permissions'. It's crucial to verify authentication credentials and ensure users are granted appropriate roles/scopes for accessing the API.
25 / 37
Lead Developer Maria is reviewing a PR from a junior developer. The PR includes the following comment:
"We're using OAuth 2.0 for authorization. It's a standard protocol and widely supported – it will handle all our authentication needs!"
What potential security concern does Maria likely have regarding this approach?
Although OAuth 2.0 is a widely used standard, relying solely on it without careful configuration can lead to security vulnerabilities. The key concern is the potential for misconfigured scopes or improper token handling, which could allow unauthorized access. It's vital to understand and actively manage the risks associated with any authentication protocol.
26 / 37
A security analyst discovers that a server is running an outdated version of Apache HTTP Server. The vulnerability database indicates this version has a known remote code execution (RCE) flaw. What is the *most* immediate action the team should take?
Patching the server with the latest secure version is the *most* immediate action. This directly addresses the vulnerability by removing the exploitable code. While other actions (firewall rules, vendor support, monitoring) are important security practices, they don't resolve the underlying problem. Waiting to patch creates a continuous risk.
27 / 37
During a Slack conversation about securing a new microservice, Developer Ben states: 'We're using API Gateway with JWTs. It's simple and effective!' What does Ben likely mean, and what potential security consideration should be addressed?
Ben's statement highlights the use of JWTs for authentication and authorization, which is common in modern APIs. However, he's overlooking a critical vulnerability: replay attacks. Without proper safeguards (like expiration times and strong signature verification), an attacker could reuse a valid JWT to gain unauthorized access – this needs careful consideration.
28 / 37
During a standup meeting, Developer David says, "We've implemented multi-factor authentication for all critical systems. Users are now prompted to verify their identity via SMS code after logging in from a new device.". Which of the following best describes the security principle being demonstrated here?
This scenario illustrates 'Defense in Depth,' which is a core security principle. It emphasizes that relying on a single authentication method isn't sufficient; multiple layers of protection are needed to reduce the impact of a potential compromise. The other options represent different security concepts (DLP, Least Privilege, and Zero Trust) but aren't directly reflected in David's statement.
29 / 37
You receive the following API response from a third-party service:
```json
{
"status": "error",
"code": 403,
"message": "Forbidden: Access denied due to insufficient permissions."
}
What does this response primarily indicate about the security posture of the API?
A '403 Forbidden' status code signifies that the user or application does *not* have permission to access the requested resource. While a DoS attack could cause similar issues, the message explicitly states 'insufficient permissions'. It's crucial to verify authentication credentials and ensure users are granted appropriate roles/scopes for accessing the API.
30 / 37
Lead Developer Maria is reviewing a PR from a junior developer. The PR includes the following comment:
"We're using OAuth 2.0 for authorization. It's a standard protocol and widely supported – it will handle all our authentication needs!"
What potential security concern does Maria likely have regarding this approach?
Although OAuth 2.0 is a widely used standard, relying solely on it without careful configuration can lead to security vulnerabilities. The key concern is the potential for misconfigured scopes or improper token handling, which could allow unauthorized access. It's vital to understand and actively manage the risks associated with any authentication protocol.
31 / 37
A security analyst discovers that a server is running an outdated version of Apache HTTP Server. The vulnerability database indicates this version has a known remote code execution (RCE) flaw. What is the *most* immediate action the team should take?
Patching the server with the latest secure version is the *most* immediate action. This directly addresses the vulnerability by removing the exploitable code. While other actions (firewall rules, vendor support, monitoring) are important security practices, they don't resolve the underlying problem. Waiting to patch creates a continuous risk.
32 / 37
During a Slack conversation about securing a new microservice, Developer Ben states: 'We're using API Gateway with JWTs. It's simple and effective!' What does Ben likely mean, and what potential security consideration should be addressed?
Ben's statement highlights the use of JWTs for authentication and authorization, which is common in modern APIs. However, he's overlooking a critical vulnerability: replay attacks. Without proper safeguards (like expiration times and strong signature verification), an attacker could reuse a valid JWT to gain unauthorized access – this needs careful consideration.
33 / 37
During a standup meeting, Developer David says, "We've implemented multi-factor authentication for all critical systems. Users are now prompted to verify their identity via SMS code after logging in from a new device.". Which of the following best describes the security principle being demonstrated here?
This scenario illustrates 'Defense in Depth,' which is a core security principle. It emphasizes that relying on a single authentication method isn't sufficient; multiple layers of protection are needed to reduce the impact of a potential compromise. The other options represent different security concepts (DLP, Least Privilege, and Zero Trust) but aren't directly reflected in David's statement.
34 / 37
You receive the following API response from a third-party service:
```json
{
"status": "error",
"code": 403,
"message": "Forbidden: Access denied due to insufficient permissions."
}
What does this response primarily indicate about the security posture of the API?
A '403 Forbidden' status code signifies that the user or application does *not* have permission to access the requested resource. While a DoS attack could cause similar issues, the message explicitly states 'insufficient permissions'. It's crucial to verify authentication credentials and ensure users are granted appropriate roles/scopes for accessing the API.
35 / 37
Lead Developer Maria is reviewing a PR from a junior developer. The PR includes the following comment:
"We're using OAuth 2.0 for authorization. It's a standard protocol and widely supported – it will handle all our authentication needs!"
What potential security concern does Maria likely have regarding this approach?
Although OAuth 2.0 is a widely used standard, relying solely on it without careful configuration can lead to security vulnerabilities. The key concern is the potential for misconfigured scopes or improper token handling, which could allow unauthorized access. It's vital to understand and actively manage the risks associated with any authentication protocol.
36 / 37
A security analyst discovers that a server is running an outdated version of Apache HTTP Server. The vulnerability database indicates this version has a known remote code execution (RCE) flaw. What is the *most* immediate action the team should take?
Patching the server with the latest secure version is the *most* immediate action. This directly addresses the vulnerability by removing the exploitable code. While other actions (firewall rules, vendor support, monitoring) are important security practices, they don't resolve the underlying problem. Waiting to patch creates a continuous risk.
37 / 37
During a Slack conversation about securing a new microservice, Developer Ben states: 'We're using API Gateway with JWTs. It's simple and effective!' What does Ben likely mean, and what potential security consideration should be addressed?
Ben's statement highlights the use of JWTs for authentication and authorization, which is common in modern APIs. However, he's overlooking a critical vulnerability: replay attacks. Without proper safeguards (like expiration times and strong signature verification), an attacker could reuse a valid JWT to gain unauthorized access – this needs careful consideration.
Frequently Asked Questions
What will I practice in "CompTIA Security+ (SY0-701) Vocabulary — Certification Exam Language"?
This is a Certification Prep exercise set. It walks through 37 scenario-based multiple-choice questions built around real usage of Certification Prep terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 37 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the Certification Prep vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Certification Prep exercises?
See the Certification Prep exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — Certification Prep vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.