CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 1011:

  A company's Chief Information Security Officer (CISO) wants to enhance the capabilities of the incident response team. The CISO directs the incident response team to deploy a tool that rapidly analyzes host and network data from potentially compromised systems and forwards the data for further review.

  Which of the following tools should the incident response team deploy?

  A. NAC
  B. IPS
  C. SIEM
  D. EDR
  D. EDR

  ---

  Explanation

  An Endpoint Detection and Response (EDR) solution is designed to monitor, detect, and respond to security incidents on endpoints (such as workstations and servers). It collects and analyzes data, detecting suspicious activity and forwarding relevant information for further investigation.

  Network Access Control (NAC) (A) enforces network access policies but does not analyze security threats on hosts.

  Intrusion Prevention Systems (IPS) (B) detect and block network threats but do not provide deep endpoint analytics.

  Security Information and Event Management (SIEM) (C) aggregates logs and provides security analytics but lacks direct endpoint detection and response capabilities.

  EDR is the best choice for analyzing and responding to endpoint security incidents.

• Question 1012:

  Which of the following types of vulnerabilities involves attacking a system to access adjacent hosts?

  A. VM escape
  B. Side loading
  C. Remote code execution
  D. Resource exhaustion
  A. VM escape

• Question 1013:

  A growing organization, which hosts an externally accessible application, adds multiple virtual servers to improve application performance and decrease the resource usage on individual servers.

  Which of the following solutions is the organization most likely to employ to further increase performance and availability?

  A. Load balancer
  B. Jump server
  C. Proxy server
  D. SD-WAN
  A. Load balancer

• Question 1014:

  An employee recently resigned from a company. The employee was responsible for managing and supporting weekly batch jobs over the past five years. A few weeks after the employee resigned. one of the batch jobs talked and caused a major disruption.

  Which of the following would work best to prevent this type of incident from reoccurring?

  A. Job rotation
  B. Retention
  C. Outsourcing
  D. Separation of duties
  A. Job rotation

  ---

  Explanation

  Job rotation is a security control that involves regularly moving employees to different roles within an organization. This practice helps prevent incidents where a single employee has too much control or knowledge about a specific job function, reducing the risk of disruption when an employee leaves. It also helps in identifying any hidden issues or undocumented processes that could cause problems after an employee ' s departure.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 5: Security Program Management and Oversight, which includes job rotation as a method to ensure business continuity and reduce risks.

• Question 1015:

  During a penetration test, a flaw in the internal PKI was exploited to gain domain administrator rights using specially crafted certificates.

  Which of the following remediation tasks should be completed as part of the cleanup phase?

  A. Updating the CRL
  B. Patching the CA
  C. Changing passwords
  D. Implementing SOAR
  A. Updating the CRL

  ---

  Explanation

  In the cleanup phase, the priority is to invalidate any malicious or unauthorized certificates that were used during the exploitation. Updating the CRL ensures those certificates are revoked and no longer trusted. Patching the CA is a remediation or recovery action to fix the root cause, but it does not by itself invalidate certificates that were already issued and abused. Changing passwords does not address certificate-based abuse directly, and implementing SOAR is unrelated.

• Question 1016:

  An organization would like to store customer data on a separate part of the network that is not accessible to users on the main corporate network.

  Which of the following should the administrator use to accomplish this goal?

  A. Segmentation
  B. Isolation
  C. Patching
  D. Encryption
  A. Segmentation

  ---

  Explanation

  Segmentation is a network design technique that divides the network into smaller and isolated segments based on logical or physical boundaries. Segmentation can help improve network security by limiting the scope of an attack, reducing the attack surface, and enforcing access control policies. Segmentation can also enhance network performance, scalability, and manageability. To accomplish the goal of storing customer data on a separate part of the network, the administrator can use segmentation technologies such as subnetting, VLANs, firewalls, routers, or switches.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 308-309