CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 121:

  A security analyst finds a rogue device during a monthly audit of current endpoint assets that are connected to the network. The corporate network utilizes 802.1 X for access control. To be allowed on the network, a device must have a known hardware address, and a valid username and password must be entered in a captive portal. The following is the audit report:

  

  Which of the following is the most likely way a rogue device was allowed to connect?

  A. A user performed a MAC cloning attack with a personal device.
  B. A DHCP failure caused an incorrect IP address to be distributed.
  C. An administrator bypassed the security controls for testing.
  D. DNS hijacking let an attacker intercept the captive portal traffic.
  A. A user performed a MAC cloning attack with a personal device.

  ---

  Explanation

  The audit report shows a suspicious device named WIN10 using user3 and a hardware address that closely matches an existing authorized device, which strongly suggests MAC cloning. Since access requires a known hardware address plus valid credentials in the captive portal, an attacker could have used a personal device, spoofed a permitted MAC address, and authenticated with stolen or reused user credentials. The other choices do not explain how a rogue endpoint would satisfy both access-control requirements and appear as an allowed device on the network.

• Question 122:

  An organization is implementing a COPE mobile device management policy.

  Which of the following should the organization include in the COPE policy? (Choose two.)

  A. Remote wiping of the device
  B. Data encryption
  C. Requiring passwords with eight characters
  D. Data usage caps
  E. Employee data ownership
  F. Personal application store access
  A. Remote wiping of the device
  B. Data encryption

• Question 123:

  Which vulnerability is most likely mitigated by setting up an MDM platform?

  A. TPM
  B. Buffer overflow
  C. Jailbreaking
  D. SQL injection
  C. Jailbreaking

  ---

  Explanation

  Mobile Device Management (MDM) platforms enforce security policies on mobile devices, including preventing or detecting jailbreaking, which is the act of removing manufacturer restrictions on devices. Jailbroken devices bypass security protections, allow installation of unauthorized apps, expose system files, and greatly increase risk.

  Security+ SY0-701 identifies MDM as a key defense for mobile ecosystems, providing controls such as:

  Jailbreak/root detection Remote wipe

  App allow/deny lists

  Configuration enforcement

  Encryption enforcement

  TPM (A) is hardware-based protection unrelated to MDM. Buffer overflow (B) and SQL injection (D) are software coding vulnerabilities not affected by mobile device policy enforcement.

  Thus, the correct answer is C: Jailbreaking.

• Question 124:

  Which of the following roles, according to the shared responsibility model, is responsible for securing the company's database in an IaaS model for a cloud environment?

  A. Client
  B. Third-party vendor
  C. Cloud provider
  D. DBA
  A. Client

  ---

  Explanation

  According to the shared responsibility model, the client and the cloud provider have different roles and responsibilities for securing the cloud environment, depending on the service model. In an IaaS (Infrastructure as a Service) model, the cloud provider is responsible for securing the physical infrastructure, such as the servers, storage, and network devices, while the client is responsible for securing the operating systems, applications, and data that run on the cloud infrastructure. Therefore, the client is responsible for securing the company's database in an IaaS model for a cloud environment, as the database is an application that stores data. The client can use various security controls, such as encryption, access control, backup, and auditing, to protect the database from unauthorized access, modification, or loss. The third-party vendor and the DBA (Database Administrator) are not roles defined by the shared responsibility model, but they may be involved in the implementation or management of the database security.

  References:

  CompTIA Security+ SY0-701 Certification Study Guide, page 263- 264

  Professor Messer's CompTIA SY0-701 Security+ Training Course, video 3.1 - Cloud and Virtualization, 5:00 - 7:40.

• Question 125:

  A company hired a security manager from outside the organization to lead security operations.

  Which of the following actions should the security manager perform first in this new role?

  A. Establish a security baseline.
  B. Review security policies.
  C. Adopt security benchmarks.
  D. Perform a user ID revalidation.
  B. Review security policies.

  ---

  Explanation

  When a security manager is hired from outside the organization to lead security operations, the first action should be to review the existing security policies. Understanding the current security policies provides a foundation for identifying strengths, weaknesses, and areas that require improvement, ensuring that the security program aligns with the organization's goals and regulatory requirements. Review security policies: Provides a comprehensive understanding of the existing security framework, helping the new manager to identify gaps and areas for enhancement.

  Establish a security baseline: Important but should be based on a thorough understanding of existing policies and practices.

  Adopt security benchmarks: Useful for setting standards, but reviewing current policies is a necessary precursor.

  Perform a user ID revalidation: Important for ensuring user access is appropriate but not the first step in understanding overall security operations.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 5.1 - Summarize elements of effective security governance (Reviewing security policies).

• Question 126:

  Which of the following analysis methods allows an organization to measure the exposure factor associated with organizational assets?

  A. Heuristic
  B. Quantitative
  C. User-driven
  D. Trend-based
  B. Quantitative

  ---

  Explanation

  Quantitative analysis is a risk assessment method that assigns numerical values to risk factors, including the Exposure Factor (EF) - which represents the percentage of an asset's value that would be lost if a specific threat were realized. This approach helps organizations calculate the Single Loss Expectancy (SLE) and Annualized Loss Expectancy (ALE), providing a data-driven method for risk management.

• Question 127:

  An engineer moved to another team and is unable to access the new team's shared folders while still being able to access the shared folders from the former team. After opening a ticket, the engineer discovers that the account was never moved to the new group.

  Which of the following access controls is most likely causing the lack of access?

  A. Role-based
  B. Discretionary
  C. Time of day
  D. Least privilege
  A. Role-based

• Question 128:

  A business received a small grant to migrate its infrastructure to an off-premises solution.

  Which of the following should be considered first?

  A. Security of cloud providers
  B. Cost of implementation
  C. Ability of engineers
  D. Security of architecture
  D. Security of architecture

  ---

  Explanation

  Security of architecture is the process of designing and implementing a secure infrastructure that meets the business objectives and requirements. Security of architecture should be considered first when migrating to an off-premises solution, such as cloud computing, because it can help to identify and mitigate the potential risks and challenges associated with the migration, such as data security, compliance, availability, scalability, and performance. Security of architecture is different from security of cloud providers, which is the process of evaluating and selecting a trustworthy and reliable cloud service provider that can meet the security and operational needs of the business. Security of architecture is also different from cost of implementation, which is the amount of money required to migrate and maintain the infrastructure in the cloud. Security of architecture is also different from ability of engineers, which is the level of skill and knowledge of the IT staff who are responsible for the migration and management of the cloud infrastructure.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 3491

• Question 129:

  Which of the following security program audits includes a comprehensive evaluation of the security controls in place at an organization over a six- to 12-month time period?

  A. NIST CSF
  B. SOC 2 Type II
  C. ISO 27001
  D. PCI DSS
  B. SOC 2 Type II

• Question 130:

  Which of the following is the most effective way to protect an application server running software that is no longer supported from network threats?

  A. Air gap
  B. Barricade
  C. Port security
  D. Screen subnet
  A. Air gap

  ---

  Explanation

  Air-gapping is the most effective way to protect an application server running unsupported software from network threats. By physically isolating the server from any network connection (no wired or wireless communication), it is protected from external cyber threats. While other options like port security or a screened subnet can provide some level of protection, an air gap offers the highest level of security by preventing any network-based attacks entirely.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 03 Security Architecture. CompTIA Security+ SY0-601 Study Guide: Chapter on Secure System Design.