CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 171:

  A company with a high-availability website is looking to harden its controls at any cost. The company wants to ensure that the site is secure by finding any possible issues.

  Which of the following would most likely achieve this goal?

  A. Permission restrictions
  B. Bug bounty program
  C. Vulnerability scan
  D. Reconnaissance
  B. Bug bounty program

  ---

  Explanation

  A bug bounty program encourages ethical hackers to find and report vulnerabilities, helping organizations discover security flaws before they are exploited by malicious actors. Unlike vulnerability scans, bug bounty programs use real-world testing techniques.

  References:

  CompTIA Security+ SY0-701 Official Study Guide, Security Operations domain.

• Question 172:

  The security operations center is researching an event concerning a suspicious IP address. A security analyst looks at the following event logs and discovers that a significant portion of the user accounts have experienced faded log-In attempts when authenticating from the same IP address:

  

  Which of the following most likely describes attack that took place?

  A. Spraying
  B. Brute-force
  C. Dictionary
  D. Rainbow table
  A. Spraying

  ---

  Explanation

  Password spraying is a type of attack where an attacker tries a small number of commonly used passwords across a large number of accounts. The event logs showing failed login attempts for many user accounts from the same IP address are indicative of a password spraying attack, where the attacker is attempting to gain access by guessing common passwords.

  References:

  CompTIA Security+ SY0-701 study materials, particularly in the domain of identity and access management and common attack vectors like password spraying.

• Question 173:

  A customer reports that software the customer downloaded from a public website has malware in it. However, the company that created the software denies any malware in its software at delivery time.

  Which of the following techniques will address this concern?

  A. Secure storage
  B. Static code analysis
  C. Input validation
  D. Code signing
  D. Code signing

• Question 174:

  A company requires hard drives to be securely wiped before sending decommissioned systems to recycling.

  Which of the following best describes this policy?

  A. Enumeration
  B. Sanitization
  C. Destruction
  D. Inventory
  B. Sanitization

  ---

  Explanation

  Sanitization is the process of removing sensitive data from a storage device or a system before it is disposed of or reused. Sanitization can be done by using software tools or hardware devices that overwrite the data with random patterns or zeros, making it unrecoverable. Sanitization is different from destruction, which is the physical damage of the storage device to render it unusable. Sanitization is also different from enumeration, which is the identification of network resources or devices, and inventory, which is the tracking of assets and their locations. The policy of securely wiping hard drives before sending decommissioned systems to recycling is an example of sanitization, as it ensures that no confidential data can be retrieved from the recycled devices.

  References:

  Secure Data Destruction -SY0-601 CompTIA Security+ : 2.7, video at 1:00

  CompTIA Security+ SY0-701 Certification Study Guide, page 387.

• Question 175:

  Security controls in a data center are being reviewed to ensure data is properly protected and that human life considerations are included.

  Which of the following best describes how the controls should be set up?

  A. Remote access points should fail closed.
  B. Logging controls should fail open.
  C. Safety controls should fail open.
  D. Logical security controls should fail closed.
  C. Safety controls should fail open.

  ---

  Explanation

  Safety controls are security controls that are designed to protect human life and physical assets from harm or damage. Examples of safety controls include fire alarms, sprinklers, emergency exits, backup generators, and surge protectors.

  Safety controls should fail open, which means that they should remain operational or allow access when a failure or error occurs. Failing open can prevent or minimize the impact of a disaster, such as a fire, flood, earthquake, or power outage, on human life and physical assets. For example, if a fire alarm fails, it should still trigger the sprinklers and unlock the emergency exits, rather than remain silent and locked. Failing open can also ensure that essential services, such as healthcare, transportation, or communication, are available during a crisis. Remote access points, logging controls, and logical security controls are other types of security controls, but they should not fail open in a data center. Remote access points are security controls that allow users or systems to access a network or a system from a remote location, such as a VPN, a web portal, or a wireless access point. Remote access points should fail closed, which means that they should deny access when a failure or error occurs. Failing closed can prevent unauthorized or malicious access to the data center's network or systems, such as by hackers, malware, or rogue devices. Logging controls are security controls that record and monitor the activities and events that occur on a network or a system, such as user actions, system errors, security incidents, or performance metrics. Logging controls should also fail closed, which means that they should stop or suspend the activities or events when a failure or error occurs. Failing closed can prevent data loss, corruption, or tampering, as well as ensure compliance with regulations and standards. Logical security controls are security controls that use software or code to protect data and systems from unauthorized or malicious access, modification, or destruction, such as encryption, authentication, authorization, or firewall. Logical security controls should also fail closed, which means that they should block or restrict access when a failure or error occurs. Failing closed can prevent data breaches, cyberattacks, or logical flaws, as well as ensure confidentiality, integrity, and availability of data and systems.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 142-143, 372-373, 376-377

• Question 176:

  A Chief Information Security Officer is developing procedures to guide detective and corrective activities associated with common threats, including phishing, social engineering, and business email compromise.

  Which of the following documents would be most relevant to revise as part of this process?

  A. SDLC
  B. IRP
  C. BCP
  D. AUP
  B. IRP

• Question 177:

  An organization wants to implement a secure solution for remote users. The users handle sensitive PHI on a regular basis and need to access an internally developed corporate application.

  Which of the following best meet the organization's security requirements? (Choose two.)

  A. Local administrative password
  B. Perimeter network
  C. Jump server
  D. WAF
  E. MFA
  F. VPN
  E. MFA
  F. VPN

  ---

  Explanation

  Multi-factor authentication (MFA) and a virtual private network (VPN) best meet the organization's security requirements for remote access to sensitive information like protected health information (PHI).

  MFA adds a layer of security by requiring multiple forms of verification before granting access, which helps protect against unauthorized access. VPN provides a secure encrypted connection for remote users, ensuring that data transmitted over the network remains confidential and secure.

  Together, these controls help secure remote access to the corporate application handling sensitive data.

• Question 178:

  Which of the following is the best way to consistently determine on a daily basis whether security settings on servers have been modified?

  A. Automation
  B. Compliance checklist
  C. Attestation
  D. Manual audit
  A. Automation

  ---

  Explanation

  Automation is the best way to consistently determine on a daily basis whether security settings on servers have been modified. Automation is the process of using software, hardware, or other tools to perform tasks that would otherwise require human intervention or manual effort. Automation can help to improve the efficiency, accuracy, and consistency of security operations, as well as reduce human errors and costs. Automation can be used to monitor, audit, and enforce security settings on servers, such as firewall rules, encryption keys, access controls, patch levels, and configuration files. Automation can also alert security personnel of any changes or anomalies that may indicate a security breach or compromise.

  The other options are not the best ways to consistently determine on a daily basis whether security settings on servers have been modified: Compliance checklist: This is a document that lists the security requirements, standards, or best practices that an organization must follow or adhere to. A compliance checklist can help to ensure that the security settings on servers are aligned with the organizational policies and regulations, but it does not automatically detect or report any changes or modifications that may occur on a daily basis.

  Attestation: This is a process of verifying or confirming the validity or accuracy of a statement, claim, or fact. Attestation can be used to provide assurance or evidence that the security settings on servers are correct and authorized, but it does not continuously monitor or audit any changes or modifications that may occur on a daily basis.

  Manual audit: This is a process of examining or reviewing the security settings on servers by human inspectors or auditors. A manual audit can help to identify and correct any security issues or discrepancies on servers, but it is time-consuming, labor-intensive, and prone to human errors. A manual audit may not be feasible or practical to perform on a daily basis.

  References:

  1: CompTIA Security+ SY0-701 Certification Study Guide, page 102

  2: Automation and Scripting -CompTIA Security+ SY0-701 -5.1, video by Professor Messer

  3: CompTIA Security+ SY0-701 Certification Study Guide, page 97

  4: CompTIA Security+ SY0-701 Certification Study Guide, page 98. : CompTIA Security+ SY0-701 Certification Study Guide, page 99.

• Question 179:

  A company is developing a business continuity strategy and needs to determine how many staff members would be required to sustain the business in the case of a disruption.

  Which of the following best describes this step?

  A. Capacity planning
  B. Redundancy
  C. Geographic dispersion
  D. Tabletop exercise
  A. Capacity planning

  ---

  Explanation

  Capacity planning is the process of determining the resources needed to meet the current and future demands of an organization. Capacity planning can help a company develop a business continuity strategy by estimating how many staff members would be required to sustain the business in the case of a disruption, such as a natural disaster, a cyberattack, or a pandemic. Capacity planning can also help a company optimize the use of its resources, reduce costs, and improve performance.

  References:

  184. CompTIA Security+ (SY0- 701) Certification Exam Objectives, Domain 4.1, page

  14. Business Continuity -SY0-601

  CompTIA Security+ : 4.1

• Question 180:

  A company's gate access logs show multiple entries from an employee's ID badge within a two-minute period.

  Which of the following is this an example of?

  A. RFID cloning
  B. Side-channel attack
  C. Shoulder sur ng
  D. Tailgating
  A. RFID cloning