CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 121:

  Which of the following activities uses OSINT?

  A. Social engineering testing
  B. Data analysis of logs
  C. Collecting evidence of malicious activity
  D. Producing IOC for malicious artifacts
  A. Social engineering testing

• Question 122:

  An attacker used XSS to compromise a web server.

  Which of the following solutions could have been used to prevent this attack?

  A. NGFW
  B. UTM
  C. WAF
  D. NAC
  C. WAF

  ---

  Explanation

  A Web Application Firewall (WAF) is designed to protect web applications from attacks such as Cross-Site Scripting (XSS) by filtering and monitoring HTTP traffic between the internet and a web application. Next-Generation Firewalls (NGFW) (A) provide advanced network security but are not specifically designed to protect web applications from XSS attacks. Unified Threat Management (UTM) (B) provides multiple security functions but lacks the specialized application-layer protection needed to mitigate XSS.

  Network Access Control (NAC) (D) controls device access to the network but does not prevent web-based attacks.

  A WAF is the best solution for protecting web servers from XSS, SQL injection, and other web-based threats.

• Question 123:

  A service provider wants a cost-effective way to rapidly expand from providing internet links to managing them.

  Which of the following methods will allow the service provider to best scale its services while maintaining performance consistency?

  A. Escalation support
  B. Increased workforce
  C. Baseline enforcement
  D. Technical debt
  C. Baseline enforcement

• Question 124:

  After a recent ransomware attack on a company's system, an administrator reviewed the log files.

  Which of the following control types did the administrator use?

  A. Compensating
  B. Detective
  C. Preventive
  D. Corrective
  B. Detective

  ---

  Explanation

  Detective controls are used after or during an event to identify, analyze, and provide evidence of what has occurred. In this scenario, the administrator is reviewing log files after a ransomware attack, which is a classic example of a detective control being used for investigation and situational awareness.

  The key distinction is time-oriented: Preventive controls act before an incident to stop it from occurring.

  Detective controls act during or after an incident to identify and analyze it.

  Corrective controls act after detection to remediate and restore systems.

  Compensating controls are alternative measures used when primary controls are not feasible.

  Reviewing logs does not prevent or fix the attack; it helps detect, reconstruct, and understand the incident.

• Question 125:

  Which of the following is a social engineering attack in which a bad actor impersonates a web URL?

  A. Pretexting
  B. Misinformation
  C. Typosquatting
  D. Watering-hole
  C. Typosquatting

• Question 126:

  The management team reports employees are missing features on company-provided tablets, causing productivity issues. The team directs IT to resolve the issue within 48 hours.

  Which of the following is the best solution?

  A. EDR
  B. COPE
  C. MDM
  D. FDE
  C. MDM

  ---

  Explanation

  The best solution is Mobile Device Management (MDM), which allows IT administrators to centrally configure, update, and push applications or settings to company-owned devices. When employees report missing features or misconfigurations, MDM platforms enable rapid remote remediation, policy enforcement, patch distribution, and application deployment-all of which can be completed within the 48-hour requirement.

  Security+ SY0-701 emphasizes MDM as the primary tool for ensuring consistent configuration baselines, enforcing security restrictions, deploying apps, and preventing unauthorized changes on mobile devices.

  EDR (A) provides threat detection, not configuration restoration. COPE (B) is a device ownership model (Corporate Owned, Personally Enabled); it does not solve configuration issues.

  FDE (D) encrypts storage, unrelated to missing features.

  Therefore, C: MDM is the correct answer.

• Question 127:

  To improve the security at a data center, a security administrator implements a CCTV system and posts several signs about the possibility of being filmed.

  Which of the following best describe these types of controls?

  (Select two).

  A. Preventive
  B. Deterrent
  C. Corrective
  D. Directive
  E. Compensating
  F. Detective
  B. Deterrent
  F. Detective

  ---

  Explanation

  The CCTV system and signs about the possibility of being filmed serve as both deterrent and detective controls.

  Deterrent controls: Aim to discourage potential attackers from attempting unauthorized actions. Posting signs about CCTV serves as a deterrent by warning individuals that their actions are being monitored. Detective controls: Identify and record unauthorized or suspicious activity. The CCTV system itself functions as a detective control by capturing and recording footage that can be reviewed later.

  Preventive controls: Aim to prevent security incidents but are not directly addressed by the CCTV and signs in this context.

  Corrective controls: Aim to correct or mitigate the impact of a security incident. Directive controls: Provide guidelines or instructions but are not directly addressed by the CCTV and signs.

  Compensating controls: Provide alternative measures to compensate for the absence or failure of primary controls.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 1.1 - Compare and contrast various types of security controls (Deterrent and detective controls).

• Question 128:

  An organization's internet-facing website was compromised when an attacker exploited a buffer overflow.

  Which of the following should the organization deploy to best protect against similar attacks in the future?

  A. NGFW
  B. WAF
  C. TLS
  D. SD-WAN
  B. WAF

  ---

  Explanation

  A buffer overflow is a type of software vulnerability that occurs when an application writes more data to a memory buffer than it can hold, causing the excess data to overwrite adjacent memory locations. This can lead to unexpected behavior, such as crashes, errors, or code execution. A buffer overflow can be exploited by an attacker to inject malicious code or commands into the application, which can compromise the security and functionality of the system. An organization's internet-facing website was compromised when an attacker exploited a buffer overflow. To best protect against similar attacks in the future, the organization should deploy a web application firewall (WAF). A WAF is a type of firewall that monitors and filters the traffic between a web application and the internet. A WAF can detect and block common web attacks, such as buffer overflows, SQL injections, cross-site scripting (XSS), and more. A WAF can also enforce security policies and rules, such as input validation, output encoding, and encryption. A WAF can provide a layer of protection for the web application, preventing attackers from exploiting its vulnerabilities and compromising its data.

  References:

  Buffer Overflows -CompTIA Security+ SY0-701 ?2.3, Web Application Firewalls -CompTIA Security+ SY0-701 ?2.4, [CompTIA Security+ Study Guide with over 500 Practice Test Questions: Exam SY0-701, 9th Edition]

• Question 129:

  A company is using a legacy FTP server to transfer nancial data to a third party. The legacy system does not support SFTP, so a compensating control is needed to protect the sensitive, nancial data in transit.

  Which of the following would be the most appropriate for the company to use?

  A. Telnet connection
  B. SSH tunneling
  C. Patch installation
  D. Full disk encryption
  B. SSH tunneling

• Question 130:

  A company is expanding its threat surface program and allowing individuals to security test the company's internet-facing application. The company will compensate researchers based on the vulnerabilities discovered.

  Which of the following best describes the program the company is setting up?

  A. Open-source intelligence
  B. Bug bounty
  C. Red team
  D. Penetration testing
  B. Bug bounty

  ---

  Explanation

  A bug bounty is a program that rewards security researchers for finding and reporting vulnerabilities in an application or system. Bug bounties are often used by companies to improve their security posture and incentivize ethical hacking. A bug bounty program typically defines the scope, rules, and compensation for the researchers.

  References:

  CompTIA Security+ Study Guide with over 500 Practice Test Questions: Exam SY0-701, 9th Edition, Chapter 1, page 10. CompTIA Security+ (SY0-701) Certification Exam Objectives, Domain 1.1, page 2.