CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 91:

  Which of the following documents provides expectations at a technical level for quality, availability, and responsibilities?

  A. EOL
  B. SLA
  C. MOU
  D. EOSL
  B. SLA

  ---

  Explanation

  A document that provides expectations at a technical level for quality, availability, and responsibilities is a Service Level Agreement (SLA). An SLA is a contract between a service provider and a customer that specifies the level of service that the provider will deliver. This typically includes technical details such as uptime, response times, and performance criteria. The SLA is used to ensure that the customer receives the level of service that they have agreed to and that the provider is held accountable for meeting those expectations. Options A, C, and D are not related to the technical level of service expectations. EOL refers to the end of life for a product or service, MOU is a memorandum of understanding, and EOSL is the end of service life.

• Question 92:

  The application development teams have been asked to answer the following questions:

  1. Does this application receive patches from an external source?

  2. Does this application contain open-source code?

  3. Is this application accessible by external users?

  4. Does this application meet the corporate password standard?

  Which of the following are these questions part of?

  A. Risk control self-assessment
  B. Risk management strategy
  C. Risk acceptance
  D. Risk matrix
  A. Risk control self-assessment

  ---

  Explanation

  The questions listed are part of a Risk Control Self-Assessment (RCSA), which is a process where teams evaluate the risks associated with their operations and assess the effectiveness of existing controls. The questions focus on aspects such as patch management, the use of open-source code, external access, and compliance with corporate standards, all of which are critical for identifying and mitigating risks.

  References:

  CompTIA Security+ SY0-701 Course Content: The course discusses various risk management processes, including self-assessments that help in identifying and managing risks within the organization.

• Question 93:

  An administrator assists the legal and compliance team with ensuring information about customer transactions is archived for the proper time period.

  Which of the following data policies is the administrator carrying out?

  A. Compromise
  B. Retention
  C. Analysis
  D. Transfer
  E. Inventory
  B. Retention

  ---

  Explanation

  A data retention policy is a set of rules that defines how long data should be stored and when it should be deleted or archived. An administrator assists the legal and compliance team with ensuring information about customer transactions is archived for the proper time period by following the data retention policy of the organization. This policy helps the organization to comply with legal and regulatory requirements, optimize storage space, and protect data privacy and security.

  References CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, Chapter 3, Section 3.4, page 1211

  CompTIA Security+ Practice Tests: Exam SY0-701, 3rd Edition, Chapter 3, Question15, page 832

• Question 94:

  After a series of account compromises and credential misuse, a company hires a security manager to develop a security program.

  Which of the following steps should the security manager take first to increase security awareness?

  A. Evaluate tools that identify risky behavior and distribute reports on the findings.
  B. Send quarterly newsletters that explain the importance of password management.
  C. Develop phishing campaigns and notify the management team of any successes.
  D. Update policies and handbooks to ensure all employees are informed of the new procedures.
  D. Update policies and handbooks to ensure all employees are informed of the new procedures.

• Question 95:

  Which of the following best explains how open service ports increase an organization's attack surface?

  A. They are commonly overlooked by endpoint antivirus tools during scans.
  B. They can make the company's remote entry point available to the internet.
  C. They enable automatic application updates to reduce vulnerability windows.
  D. They can expose unnecessary services to unauthorized access if not properly restricted.
  D. They can expose unnecessary services to unauthorized access if not properly restricted.

  ---

  Explanation

  Open service ports directly contribute to an organization's attack surface because they provide potential entry points that attackers can probe, exploit, or abuse. In the context of the Security+ SY0-701 objectives, the attack surface is defined as the sum of all possible points where an attacker can attempt to enter or extract data from a system. Each open port corresponds to a service or application that is listening for incoming connections, and if that service is unnecessary, misconfigured, unpatched, or weakly protected, it becomes a viable attack vector.

  Option D is correct because open ports may expose services that do not need to be accessible, especially if proper access controls, firewall rules, or network segmentation are not in place. For example, leaving management interfaces, legacy services, or test services open can allow attackers to perform reconnaissance, banner grabbing, credential attacks, or exploitation of known vulnerabilities. The SY0-701 study guide emphasizes the principle of minimizing attack surface by disabling unused services, closing unnecessary ports, and applying the principle of least functionality.

  Option A is incorrect because endpoint antivirus tools are not responsible for identifying or managing open network ports at an architectural level.

  Option B is partially true but incomplete; while open ports can allow remote access, not all open ports are remote entry points, and the question asks for the best explanation of how attack surface increases.

  Option C is incorrect because open ports do not inherently enable updates and, in fact, often increase risk rather than reduce it.

  In summary, open service ports increase attack surface by exposing services that attackers can target. Proper port management, firewall enforcement, and regular vulnerability scanning are critical controls emphasized in Security+ SY0-701 to reduce exposure and limit unauthorized access.

• Question 96:

  Which of the following should be used to ensure a device is inaccessible to a network-connected resource?

  A. Disablement of unused services
  B. Web application firewall
  C. Host isolation
  D. Network-based IDS
  C. Host isolation

  ---

  Explanation

  Host isolation ensures that a device is separated from the network, preventing it from accessing or being accessed by other network resources. This is typically achieved by quarantining the device.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 4: Security Operations, Section: "Isolation and Containment".

• Question 97:

  A security analyst identifies an incident in the network.

  Which of the following incident response activities would the security analyst perform next?

  A. Containment
  B. Detection
  C. Eradication
  D. Recovery
  A. Containment

  ---

  Explanation

• Question 98:

  Which of the following most likely describes why a security engineer would configure all outbound emails to use S/MIME digital signatures?

  A. To meet compliance standards
  B. To increase delivery rates
  C. To block phishing attacks
  D. To ensure non-repudiation
  D. To ensure non-repudiation

• Question 99:

  Which of the following factors are the most important to address when formulating a training curriculum plan for a security awareness program? (Select two).

  A. Channels by which the organization communicates with customers
  B. The reporting mechanisms for ethics violations
  C. Threat vectors based on the industry in which the organization operates
  D. Secure software development training for all personnel
  E. Cadence and duration of training events
  F. Retraining requirements for individuals who fail phishing simulations
  C. Threat vectors based on the industry in which the organization operates
  E. Cadence and duration of training events

  ---

  Explanation

  A training curriculum plan for a security awareness program should address the following factors: The threat vectors based on the industry in which the organization operates. This will help the employees to understand the specific risks and challenges that their organization faces, and how to protect themselves and the organization from cyberattacks. For example, a healthcare organization may face different threat vectors than a financial organization, such as ransomware, data breaches, or medical device hacking. The cadence and duration of training events. This will help the employees to retain the information and skills they learn, and to keep up with the changing security landscape. The training events should be frequent enough to reinforce the key concepts and behaviors, but not too long or too short to lose the attention or interest of the employees. For example, a security awareness program may include monthly newsletters, quarterly webinars, annual workshops, or periodic quizzes.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, Chapter 2, page 34

  CompTIA Security+ Certification Kit: Exam SY0-701, 7th Edition, Chapter 2, page 55.

• Question 100:

  Which of the following is used to protect a computer from viruses, malware, and Trojans being installed and moving laterally across the network?

  A. IDS
  B. ACL
  C. EDR
  D. NAC
  C. EDR

  ---

  Explanation

  Endpoint detection and response (EDR) is a technology that monitors and analyzes the activity and behavior of endpoints, such as computers, laptops, mobile devices, and servers. EDR can help to detect and prevent malicious software, such as viruses, malware, and Trojans, from infecting the endpoints and spreading across the network. EDR can also provide visibility and response capabilities to contain and remediate threats. EDR is different from IDS, which is a network-based technology that monitors and alerts on network traffic anomalies. EDR is also different from ACL, which is a list of rules that control the access to network resources. EDR is also different from NAC, which is a technology that enforces policies on the network access of devices based on their identity and compliance status.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 2561