CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 111:

  A recent audit cited a risk involving numerous low-criticality vulnerabilities created by a web application using a third-party library. The development staff state there are still customers using the application even though it is end of life and it would be a substantial burden to update the application for compatibility with more secure libraries.

  Which of the following would be the MOST prudent course of action?

  A. Accept the risk if there is a clear road map for timely decommission
  B. Deny the risk due to the end-of-life status of the application.
  C. Use containerization to segment the application from other applications to eliminate the risk
  D. Outsource the application to a third-party developer group
  A. Accept the risk if there is a clear road map for timely decommission

  ---

  Explanation

  Accept the risk if there is a clear road map for timely decommission.

  The audit found low-criticality vulnerabilities so, from the organization's perspective, it's not an issue that requires immediate attention. If the organization's understands the level of severity of the vulnerabilities and plans to decommission the application when they see fit, then that would be the most prudent(practical) action for them.

  There are still users that are using the application, so there should be time given to notify the users when it is time to decommission the application to minimize disruption.

• Question 112:

  Which of the following is the primary reason why false negatives on a vulnerability scan should be a concern?

  A. The system has vulnerabilities that are not being detected.
  B. The time to remediate vulnerabilities that do not exist is excessive.
  C. Vulnerabilities with a lower severity will be prioritized over critical vulnerabilities.
  D. The system has vulnerabilities, and a patch has not yet been released.
  A. The system has vulnerabilities that are not being detected.

  ---

  Explanation

  False negatives in vulnerability scanning occur when the scan fails to detect existing vulnerabilities. This is a concern because it means that the system has vulnerabilities, but they are not being identified and addressed, leaving the system potentially exposed to exploitation. Unlike false positives, which result in wasted time on vulnerabilities that aren't actually present, false negatives directly impact security by failing to identify real risks.

• Question 113:

  Which of the following aspects of the data management life cycle is most directly impacted by local and international regulations?

  A. Destruction
  B. Certification
  C. Retention
  D. Sanitization
  C. Retention

  ---

  Explanation

  Retention policies dictate how long data must be stored to comply with local and international regulations. Non-compliance can result in legal and financial penalties.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 5: Security Program Management, Section: "Data Retention and Legal Requirements".

• Question 114:

  A third-party vendor is moving a particular application to the end-of-life stage at the end of the current year.

  Which of the following is the most critical risk if the company chooses to continue running the application?

  A. Lack of security updates
  B. Lack of new features
  C. Lack of support
  D. Lack of source code access
  A. Lack of security updates

• Question 115:

  A new vulnerability enables a type of malware that allows the unauthorized movement of data from a system.

  Which of the following would detect this behavior?

  A. Implementing encryption
  B. Monitoring outbound traffic
  C. Using default settings
  D. Closing all open ports
  B. Monitoring outbound traffic

  ---

  Explanation

  Monitoring outbound traffic is essential for detecting unauthorized data exfiltration from a system. A new vulnerability that allows malware to move data unauthorizedly would typically attempt to send this data out of the network. By monitoring outbound traffic, security tools can detect unusual data transfers, trigger alerts, and help prevent the exfiltration of sensitive information.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 04 Security Operations. CompTIA Security+ SY0-601 Study Guide: Chapter on Threat Detection and Response.

• Question 116:

  A security team is addressing a risk associated with the attack surface of the organization's web application over port 443. Currently, no advanced network security capabilities are in place.

  Which of the following would be best to set up? (Choose two.)

  A. NIDS
  B. Honeypot
  C. Certificate revocation list
  D. HIPS
  E. WAF
  F. SIEM
  E. WAF
  F. SIEM

• Question 117:

  Which of the following provides the details about the terms of a test with a third-party penetration tester?

  A. Rules of engagement
  B. Supply chain analysis
  C. Right to audit clause
  D. Due diligence
  A. Rules of engagement

  ---

  Explanation

  Rules of engagement are the detailed guidelines and constraints regarding the execution of information security testing, such as penetration testing. They define the scope, objectives, methods, and boundaries of the test, as well as the roles and responsibilities of the testers and the clients. Rules of engagement help to ensure that the test is conducted in a legal, ethical, and professional manner, and that the results are accurate and reliable. Rules of engagement typically include the following elements: The type and scope of the test, such as black box, white box, or gray box, and the target systems, networks, applications, or data.

  The client contact details and the communication channels for reporting issues, incidents, or emergencies during the test.

  The testing team credentials and the authorized tools and techniques that they can use.

  The sensitive data handling and encryption requirements, such as how to store, transmit, or dispose of any data obtained during the test. The status meeting and report schedules, formats, and recipients, as well as the confidentiality and non-disclosure agreements for the test results. The timeline and duration of the test, and the hours of operation and testing windows. The professional and ethical behavior expectations for the testers, such as avoiding unnecessary damage, disruption, or disclosure of information. Supply chain analysis, right to audit clause, and due diligence are not related to the terms of a test with a third-party penetration tester. Supply chain analysis is the process of evaluating the security and risk posture of the suppliers and partners in a business network. Right to audit clause is a provision in a contract that gives one party the right to audit another party to verify their compliance with the contract terms and conditions. Due diligence is the process of identifying and addressing the cyber risks that a potential vendor or partner brings to an organization.

  References:

  https://www.yeahhub.com/every-penetration-tester-you-should-know-about-this-rules-of-engagement/

  https://bing.com/search?q=rules+of+engagement+penetration+testing

• Question 118:

  An external security assessment report indicates a high click rate on suspicious emails. The Chief Intelligence Security Officer (CISO) must reduce this behavior.

  Which of the following should the CISO do first?

  A. Update the acceptable use policy.
  B. Deploy a password management solution.
  C. Issue warning letters to affected users.
  D. Implement a phishing awareness campaign.
  D. Implement a phishing awareness campaign.

• Question 119:

  A security analyst received a tip that sensitive proprietary information was leaked to the public. The analyst is reviewing the PCAP and notices traffic between an internal server and an external host that includes the following:

  ...

  12:47:22.327233 PPPoE [ses 0x8122] IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto IPv6 (41), length 331) 10.5.1.1 > 52.165.16.154: IP6 (hlim E3, next-header TCP (6) paylcad length: 271) 2001:67c:2158:a019::ace.53104 >

  2001:0:5ef5:79fd:380c:dddd:a601:24fa.13788: Flags [P.], cksum 0xd7ee (correct), seq 97:348, ack 102, win 16444, length 251 ...

  Which of the following was most likely used to exfiltrate the data?

  A. Encapsulation
  B. MAC address spoofing
  C. Steganography
  D. Broken encryption
  E. Sniffing via on-path position
  A. Encapsulation

• Question 120:

  As part of new compliance audit requirements, multiple servers need to be segmented on different networks and should be reachable only from authorized internal systems.

  Which of the following would meet the requirements?

  A. Configure firewall rules to block external access to Internal resources.
  B. Set up a WAP to allow internal access from public networks.
  C. Implement a new IPSec tunnel from internal resources.
  D. Deploy an Internal Jump server to access resources.
  A. Configure firewall rules to block external access to Internal resources.

  ---

  Explanation

  The requirement is to segment servers on different networks and restrict access to only authorized internal systems. Option A directly addresses this by using firewall rules to block external access while allowing internal traffic, aligning with network segmentation best practices.

  Option B (WAP) refers to a Wireless Access Point, which doesn't fit the context of segmentation and could expose resources to public networks.

  Option C (IPSec tunnel) secures communication but doesn't inherently segment networks.

  Option D (jump server) adds a layer of access control but doesn't address the segmentation requirement alone. Thus, A is the best fit.