CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 1001:

  An employee receives a text message from an unknown number claiming to be the company's Chief Executive Officer and asking the employee to purchase several gift cards.

  Which of the following types of attacks does this describe?

  A. Vishing
  B. Smishing
  C. Pretexting
  D. Phishing
  B. Smishing

  ---

  Explanation

  Smishing is a type of phishing attack that uses text messages or common messaging apps to trick victims into clicking on malicious links or providing personal information. The scenario in the question describes a smishing attack that uses pretexting, which is a form of social engineering that involves impersonating someone else to gain trust or access. The unknown number claims to be the company's CEO and asks the employee to purchase gift cards, which is a common scam tactic. Vishing is a similar type of attack that uses phone calls or voicemails, while phishing is a broader term that covers any email-based attack.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 77

  Smishing vs. Phishing: Understanding the Differences

• Question 1002:

  Which of the following should be used to prevent changes to system-level data?

  A. NIDS
  B. DLP
  C. NAC
  D. FIM
  D. FIM

  ---

  Explanation

  File Integrity Monitoring (FIM) is specifically designed to detect and prevent unauthorized changes to critical system files, configuration files, registry entries, binaries, and logs. According to CompTIA Security+ SY0- 701, FIM creates a cryptographic baseline (usually via hashing) of protected system files. Any attempt to modify, add, or delete protected files immediately triggers an alert, enabling rapid detection of tampering-whether caused by malware, insider threats, or misconfigurations.

  NIDS (A) monitors network traffic, not system-level modifications. DLP (B) prevents unauthorized data exfiltration, not system-file tampering. NAC (C) controls device access to the network but does not protect system files.

  FIM is a core tool for ensuring system integrity in compliance frameworks such as PCI-DSS, which explicitly requires organizations to monitor critical system files. By preventing unauthorized changes to system-level data and alerting administrators to suspicious activity, FIM provides a strong defensive mechanism against malware, ransomware, and configuration drift.

  Thus, FIM is the correct answer.

• Question 1003:

  A systems administrator is creating a script that would save time and prevent human error when performing account creation for a large number of end users.

  Which of the following would be a good use case for this task?

  A. Off-the-shelf software
  B. Orchestration
  C. Baseline
  D. Policy enforcement
  B. Orchestration

  ---

  Explanation

  Orchestration is the process of automating multiple tasks across different systems and applications. It can help save time and reduce human error by executing predefined workflows and scripts. In this case, the systems administrator can use orchestration to create accounts for a large number of end users without having to manually enter their information and assign permissions.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 457

• Question 1004:

  A security administrator is performing an audit on a stand-alone UNIX server, and the following message is immediately displayed:

  (Error 13): /etc/shadow: Permission denied.

  Which of the following best describes the type of tool that is being used?

  A. Pass-the-hash monitor
  B. File integrity monitor
  C. Forensic analysis
  D. Password cracker
  B. File integrity monitor

• Question 1005:

  A security administrator is configuring fileshares. The administrator removed the default permissions and added permissions for only users who will need to access the fileshares as part of their job duties.

  Which of the following best describes why the administrator performed these actions?

  A. Encryption standard compliance
  B. Data replication requirements
  C. Least privilege
  D. Access control monitoring
  C. Least privilege

  ---

  Explanation

  The security administrator's actions of removing default permissions and adding permissions only for users who need access as part of their job duties best describe the principle of least privilege. This principle ensures that users are granted the minimum necessary access to perform their job functions, reducing the risk of unauthorized access or data breaches.

  Least privilege: Limits access rights for users to the bare minimum necessary for their job duties, enhancing security by reducing potential attack surfaces. Encryption standard compliance: Involves meeting encryption requirements, but it does not explain the removal and assignment of specific permissions. Data replication requirements: Focus on duplicating data across different systems for redundancy and availability, not related to user permissions. Access control monitoring: Involves tracking and reviewing access to resources, but the scenario is about setting permissions, not monitoring them.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 4.5 - Modify enterprise capabilities to enhance security (Least privilege).

• Question 1006:

  A software development manager wants to ensure the authenticity of the code created by the company.

  Which of the following options is the most appropriate?

  A. Testing input validation on the user input fields
  B. Performing code signing on company-developed software
  C. Performing static code analysis on the software
  D. Ensuring secure cookies are use
  B. Performing code signing on company-developed software

  ---

  Explanation

  Code signing is a technique that uses cryptography to verify the authenticity and integrity of the code created by the company. Code signing involves applying a digital signature to the code using a private key that only the company possesses. The digital signature can be verified by anyone who has the corresponding public key, which can be distributed through a trusted certificate authority. Code signing can prevent unauthorized modifications, tampering, or malware injection into the code, and it can also assure the users that the code is from a legitimate source.

  References:

  74. CompTIA Security+ (SY0-701) Certification Exam Objectives, Domain 3.2, page

  11. Application Security - SY0-601

  CompTIA Security+ : 3.2

• Question 1007:

  A cyber operations team informs a security analyst about a new tactic malicious actors are using to compromise networks.

  SIEM alerts have not yet been configured.

  Which of the following best describes what the security analyst should do to identify this behavior?

  A. Digital forensics
  B. E-discovery
  C. Incident response
  D. Threat hunting
  D. Threat hunting

  ---

  Explanation

  Threat hunting is the process of proactively searching for signs of malicious activity or compromise in a network, rather than waiting for alerts or indicators of compromise (IOCs) to appear. Threat hunting can help identify new tactics, techniques, and procedures (TTPs) used by malicious actors, as well as uncover hidden or stealthy threats that may have evaded detection by security tools. Threat hunting requires a combination of skills, tools, and methodologies, such as hypothesis generation, data collection and analysis, threat intelligence, and incident response. Threat hunting can also help improve the security posture of an organization by providing feedback and recommendations for security improvements.

  References:

  CompTIA Security+ Certification Exam Objectives, Domain 4.1: Given a scenario, analyze potential indicators of malicious activity. CompTIA Security+ Study Guide (SY0-701), Chapter 4: Threat Detection and Response, page 153. Threat Hunting -SY0-701 CompTIA Security+ : 4.1, Video 3:18. CompTIA Security+ Certification Exam SY0-701 Practice Test 1, Question3.

• Question 1008:

  A security engineer at a large company needs to enhance IAM to ensure that employees can only access corporate systems during their shifts.

  Which of the following access controls should the security engineer implement?

  A. Role-based
  B. Time-of-day restrictions
  C. Least privilege
  D. Biometric authentication
  B. Time-of-day restrictions

  ---

  Explanation

  Time-of-day restrictions limit access to corporate systems based on predefined schedules. This ensures employees can only access resources during their assigned work hours.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 3: Security Architecture, Section: "Access Control Models".

• Question 1009:

  An administrator discovers a cross-site scripting vulnerability on a company website.

  Which of the following will most likely remediate the issue?

  A. Input validation
  B. NGFW
  C. Vulnerability scan
  D. WAF
  A. Input validation

  ---

  Explanation

  Cross-site scripting (XSS) occurs when a web application fails to properly validate or sanitize user input, allowing attackers to inject malicious scripts into web pages viewed by other users. The most effective remediation is input validation, which ensures that only safe, expected data is accepted by the application.

  Security+ SY0-701 highlights input validation as a primary defense against:

  XSS

  SQL injection

  Command injection

  Path traversal attacks

  By validating and sanitizing input at both the client and server layers, organizations can strip harmful characters, block script tags, enforce strict data types, and ensure proper encoding. A NGFW (B) or WAF (D) can mitigate attacks by blocking malicious payloads, but they do not fix the root cause within the web application. A vulnerability scan (C) identifies the issue but does not remediate it.

  Therefore, only input validation (A) directly resolves the underlying coding flaw responsible for XSS.

• Question 1010:

  Which of the following would a systems administrator follow when upgrading the firmware of an organization's router?

  A. Software development life cycle
  B. Risk tolerance
  C. Certificate signing request
  D. Maintenance window
  D. Maintenance window

  ---

  Explanation

  A maintenance window is a pre-scheduled period when system or network changes, updates, or repairs are performed. By using a designated maintenance window, a systems administrator can minimize disruption to the organization's operations, as this window is typically chosen during a time when network usage is lower, reducing the impact on users.