CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 101:

  An organization is required to maintain financial data records for three years and customer data for five years.

  Which of the following data management policies should the organization implement?

  A. Retention
  B. Destruction
  C. Inventory
  D. Certification
  A. Retention

  ---

  Explanation

  The organization should implement a retention policy to ensure that financial data records are kept for three years and customer data for five years. A retention policy specifies how long different types of data should be maintained and when they should be deleted.

  Retention: Ensures that data is kept for a specific period to comply with legal, regulatory, or business requirements.

  Destruction: Involves securely deleting data that is no longer needed, which is part of the retention lifecycle but not the primary focus here.

  Inventory: Involves keeping track of data assets, not specifically about how long to retain data.

  Certification: Ensures that processes and systems meet certain standards, not directly related to data retention periods.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 5.2 - Risk management process (Data retention).

• Question 102:

  An administrator has configured a quarantine subnet for all guest devices that connect to the network.

  Which of the following would be best for the security team to configure on the MDM before allowing access to corporate resources?

  A. Device fingerprinting
  B. Compliance attestation
  C. NAC
  D. 802.1X
  B. Compliance attestation

  ---

  Explanation

  Compliance attestation (B)ensures that devices meetpredefined security policies(e.g., encryption enabled, updated antivirus, latest OS patches) before being allowed access to corporate resources. This is commonly enforced usingMobile Device Management (MDM)systems.

  By using compliance checks via MDM, only secure,policy-compliantdevices are promoted from quarantine to trusted network segments.

  References:

  CompTIA Security+ SY0-701

  Objectives, Domain 3.2 - "MDM, NAC, and compliance enforcement: Compliance attestation before access."

• Question 103:

  A company's online shopping website became unusable shortly after midnight on January 30, 2023. When a security analyst reviewed the database server, the analyst noticed the following code used for backing up data:

  

  Which of the following should the analyst do next?

  A. Check for recently terminated DBAs.
  B. Review WAF logs for evidence of command injection.
  C. Scan the database server for malware.
  D. Search the web server for ransomware notes.
  B. Review WAF logs for evidence of command injection.

• Question 104:

  An administrator is installing an LDAP browser tool in order to view objects in the corporate LDAP directory. Secure connections to the LDAP server are required. When the browser connects to the server, certificate errors are being displayed, and then the connection is terminated.

  Which of the following is the most likely solution?

  A. The administrator should allow SAN certificates in the browser configuration.
  B. The administrator needs to install the server certificate into the local truststore.
  C. The administrator should request that the secure LDAP port be opened to the server.
  D. The administrator needs to increase the TLS version on the organization's RA.
  B. The administrator needs to install the server certificate into the local truststore.

• Question 105:

  A security analyst wants to automate a task that shares data between systems.

  Which of the following is the best option for the analyst to use?

  A. SOAR
  B. API
  C. SFTP
  D. RDP
  B. API

• Question 106:

  During an investigation, an incident response team attempts to understand the source of an incident.

  Which of the following incident response activities describes this process?

  A. Analysis
  B. Lessons learned
  C. Detection
  D. Containment
  A. Analysis

  ---

  Explanation

  Analysis is the incident response activity that describes the process of understanding the source of an incident. Analysis involves collecting and examining evidence, identifying the root cause, determining the scope and impact, and assessing the threat actor's motives and capabilities. Analysis helps the incident response team to formulate an appropriate response strategy, as well as to prevent or mitigate future incidents. Analysis is usually performed after detection and before containment, eradication, recovery, and lessons learned.

• Question 107:

  After a recent ransomware attack on a company's system, an administrator reviewed the log files.

  Which of the following control types did the administrator use?

  A. Compensating
  B. Detective
  C. Preventive
  D. Corrective
  B. Detective

  ---

  Explanation

  Detective controls are used after or during an event to identify, analyze, and provide evidence of what has occurred. In this scenario, the administrator is reviewing log files after a ransomware attack, which is a classic example of a detective control being used for investigation and situational awareness.

  The key distinction is time-oriented: Preventive controls act before an incident to stop it from occurring.

  Detective controls act during or after an incident to identify and analyze it.

  Corrective controls act after detection to remediate and restore systems.

  Compensating controls are alternative measures used when primary controls are not feasible.

  Reviewing logs does not prevent or fix the attack; it helps detect, reconstruct, and understand the incident.

• Question 108:

  Which of the following enables the ability to receive a consolidated report from different devices on the network?

  A. IPS
  B. DLP
  C. SIEM
  D. Firewall
  C. SIEM

  ---

  Explanation

  SIEM (Security Information and Event Management) systems aggregate and analyze log data from various devices across a network, enabling the collection, correlation, and analysis of security-related events. SIEM provides a consolidated report of activities, helping to identify potential security incidents by correlating data from multiple sources, which enhances visibility and response capabilities across the network.

• Question 109:

  Which of the following would best explain why a security analyst is running daily vulnerability scans on all corporate endpoints?

  A. To track the status of patching installations
  B. To find shadow IT cloud deployments
  C. To continuously the monitor hardware inventory
  D. To hunt for active attackers in the network
  A. To track the status of patching installations

  ---

  Explanation

  Running daily vulnerability scans on all corporate endpoints is primarily done to track the status of patching installations. These scans help identify any missing security patches or vulnerabilities that could be exploited by attackers. Keeping the endpoints up-to-date with the latest patches is critical for maintaining security. Finding shadow IT cloud deployments and monitoring hardware inventory are better achieved through other tools.

  Hunting for active attackers would typically involve more real-time threat detection methods than daily vulnerability scans.

• Question 110:

  An organization is looking to optimize its environment and reduce the number of patches necessary for operating systems.

  Which of the following will best help to achieve this objective?

  A. Microservices
  B. Virtualization
  C. Real-time operating system
  D. Containers
  D. Containers

  ---

  Explanation

  Containers package applications with only the necessary components and dependencies, which reduces the footprint of the operating system components in each instance. This approach minimizes the number of OS patches required, as each container runs only essential services instead of a full OS environment, making it easier to isolate and update application dependencies without affecting the host or requiring frequent OS-level patches.