CompTIA Security+ certification, and which edition to sit

During a TLS handshake, a client and server establish a session. Which statement best describes the roles of asymmetric and symmetric encryption?

Use Check on the answer you favor. The verdict shows up with a short note on each choice.

1. Symmetric for key exchange; asymmetric for bulk data
   Check

   This swaps the roles: a symmetric key can't be agreed on safely without an earlier shared secret, and public-key operations are far too slow to encrypt a whole session.
2. Asymmetric only; no symmetric cipher is used
   Check

   Using asymmetric encryption alone, with no symmetric cipher, would make every record slow to protect; TLS uses public-key cryptography only to set up and authenticate the session.
3. Symmetric only; the key is sent with the first request
   Check

   A symmetric-only session whose key travels with the first request hands that key to anyone watching; the handshake exists so the key never crosses the wire in the clear.
4. Asymmetric and symmetric encryption are used interchangeably
   Check

   The two are not interchangeable in TLS; each has a fixed job, public-key cryptography in the handshake and a symmetric cipher in the record layer.
5. Asymmetric for key exchange; symmetric for bulk data
   Check

   Asymmetric key exchange (ECDHE in TLS 1.3) lets client and server agree on a shared secret over an open network; a fast symmetric cipher such as AES-GCM then encrypts the session traffic.

A regional MSP is breached through its remote management tool, and attackers pivot to multiple client networks. What threat vector does this represent?

1. Network intrusion
   Check

   Network intrusion is a generic label for almost any breach; it doesn't name what made this one possible, a trusted third party.
2. Insider threat
   Check

   An insider threat would be an employee of the victim organizations acting against them; here the intrusion came through an outside provider's tool.
3. Advanced persistent threat
   Check

   An advanced persistent threat (APT) describes a well-resourced, long-dwelling attacker, not the route used to get in; the question asks for the vector.
4. Supply chain attack
   Check

   Compromising a managed service provider gives attackers its trusted remote access into every client, so the provider becomes a supply chain vector for those clients.
5. Phishing attack
   Check

   Phishing tricks a person with a deceptive message; here the attackers rode the provider's remote management tool, and no lure to a user is described.

A user transfers from finance to marketing but retains access to finance file shares containing sensitive data. What should be done to align with least privilege?

1. Notify the finance manager
   Check

   Telling the finance manager raises awareness but leaves the excess access in place; least privilege requires changing the permissions.
2. Add marketing access to the existing permissions
   Check

   Adding marketing access on top of the old rights is exactly how privilege creep builds up; the finance access has to be removed.
3. Modify permissions to fit the new role
   Check

   Modifying the permissions, removing finance share access and granting only what the marketing job needs, ends the permission creep while the user keeps working.
4. Decommission the user account
   Check

   The employee still works for the company, so deleting the account stops legitimate work instead of trimming the excess rights.

A security team performs a test that actively exploits SQL injection to exfiltrate data. This activity is BEST described as:

1. Risk assessment
   Check

   A risk assessment weighs the likelihood and impact of threats; it is an analysis exercise, not a hands-on attack.
2. Penetration test
   Check

   Actually exploiting the SQL injection and pulling data out is what separates a penetration test from work that only finds and lists weaknesses.
3. Vulnerability scanning
   Check

   Scanning is an automated check for known flaws; it would report the SQL injection rather than use it to exfiltrate records.
4. Vulnerability assessment
   Check

   A vulnerability assessment identifies and ranks weaknesses but stops short of exploiting them to extract data.