CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 11:

  A security analyst is concerned malicious actors are lurking in an environment but has not received any alerts regarding suspicious activity.

  Which of the following should the analyst conduct to further investigate the presence of these actors?

  A. Threat hunting
  B. Digital forensics
  C. Vulnerability scanning
  D. E-discovery
  A. Threat hunting

  ---

  Explanation

  Threat hunting is a proactive security activity focused on identifying hidden or undetected threats within an environment, even when no alerts or indicators have been triggered. According to CompTIA Security+ SY0- 701, threat hunting assumes that attackers may already be present and actively evading traditional security controls such as SIEMs, IDS/IPS, or endpoint protection tools.

  Threat hunting involves manually analyzing logs, endpoint telemetry, network traffic, and behavioral patterns to uncover anomalies that automated systems may miss. This aligns directly with the scenario, where the analyst has a suspicion of malicious actors but no alerts confirming activity. Threat hunting helps identify advanced persistent threats (APTs), living-off-the-land techniques, credential misuse, and lateral movement that may not generate immediate alerts.

  Digital forensics (B) is typically performed after an incident has been confirmed. Vulnerability scanning (C) identifies weaknesses but does not detect active attackers. E-discovery (D) is a legal process for collecting electronically stored information and is not used for threat detection.

  Because the analyst is proactively searching for hidden threats without existing alerts, the correct action is A: Threat hunting.

• Question 12:

  Which of the following would be the most appropriate way to protect data in transit?

  A. SHA-256
  B. SSL3.0
  C. TLS 1.3
  D. AES-256
  C. TLS 1.3

• Question 13:

  A systems administrator notices that the research and development department is not using the company VPN when accessing various company-related services and systems.

  Which of the following scenarios describes this activity?

  A. Espionage
  B. Data exfiltration
  C. Nation-state attack
  D. Shadow IT
  D. Shadow IT

  ---

  Explanation

  The activity described, where a department is not using the company VPN when accessing various company-related services and systems, is an example of Shadow IT. Shadow IT refers to the use of IT systems, devices, software, applications, and services without explicit IT department approval.

  Espionage: Involves spying to gather confidential information, not simply bypassing the VPN.

  Data exfiltration: Refers to unauthorized transfer of data, which might involve not using a VPN but is more specific to the act of transferring data out of the organization.

  Nation-state attack: Involves attacks sponsored by nation-states, which is not indicated in the scenario.

  Shadow IT: Use of unauthorized systems and services, which aligns with bypassing the company VPN.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 2.1 - Compare and contrast common threat actors and motivations (Shadow IT).

• Question 14:

  Which of the following risk management strategies should an enterprise adopt first if a legacy application is critical to business operations and there are preventative controls that are not yet implemented?

  A. Mitigate
  B. Accept
  C. Transfer
  D. Avoid
  A. Mitigate

  ---

  Explanation

  Mitigate is the risk management strategy that involves reducing the likelihood or impact of a risk. If a legacy application is critical to business operations and there are preventative controls that are not yet implemented, the enterprise should adopt the mitigate strategy first to address the existing vulnerabilities and gaps in the application. This could involve applying patches, updates, or configuration changes to the application, or adding additional layers of security controls around the application. Accept, transfer, and avoid are other risk management strategies, but they are not the best options for this scenario. Accept means acknowledging the risk and accepting the consequences without taking any action. Transfer means shifting the risk to a third party, such as an insurance company or a vendor. Avoid means eliminating the risk by removing the source or changing the process. These strategies may not be feasible or desirable for a legacy application that is critical to business operations and has no preventative controls in place.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 122

  A Risk-Based Framework for Legacy System Migration and Deprecation

• Question 15:

  A security analyst needs to propose a remediation plan for each item in a risk register. The item with the highest priority requires employees to have separate logins for SaaS solutions and different password complexity requirements for each solution.

  Which of the following implementation plans will most likely resolve this security issue?

  A. Creating a unified password complexity standard
  B. Integrating each SaaS solution with the Identity provider
  C. Securing access to each SaaS by using a single wildcard certificate
  D. Configuring geofencing on each SaaS solution
  B. Integrating each SaaS solution with the Identity provider

  ---

  Explanation

  Integrating each SaaS solution with an Identity Provider (IdP) is the most effective way to address the security issue. This approach allows for Single Sign-On (SSO) capabilities, where users can access multiple SaaS applications with a single set of credentials while maintaining strong password policies across all services. It simplifies the user experience and ensures consistent security enforcement across different SaaS platforms.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 05 Security Program Management and Oversight.

  CompTIA Security+ SY0-601 Study Guide: Chapter on Identity and Access Management.

• Question 16:

  An IT manager is putting together a documented plan describing how the organization will keep operating in the event of a global incident.

  Which of the following plans is the IT manager creating?

  A. Business continuity
  B. Physical security
  C. Change management
  D. Disaster recovery
  A. Business continuity

  ---

  Explanation

  The IT manager is creating a Business Continuity Plan (BCP). A BCP describes how an organization will continue to operate during and after a disaster or global incident. It ensures that critical business functions remain operational despite adverse conditions, with a focus on minimizing downtime and maintaining essential services. Physical security relates to protecting physical assets. Change management ensures changes in IT systems are introduced smoothly, without disrupting operations.

  Disaster recovery is a subset of business continuity but focuses specifically on recovering from IT-related incidents.

• Question 17:

  A business needs a recovery site but does not require immediate failover. The business also wants to reduce the workload required to recover from an outage.

  Which of the following recovery sites is the best option?

  A. Hot
  B. Cold
  C. Warm
  D. Geographically dispersed
  C. Warm

  ---

  Explanation

  A warm site is the best option for a business that does not require immediate failover but wants to reduce the workload required for recovery. A warm site has some pre-installed equipment and data, allowing for quicker recovery than a cold site, but it still requires some setup before becoming fully operational. Hot sites provide immediate failover but are more expensive and require constant maintenance. Cold sites require significant time and effort to get up and running after an outage. Geographically dispersed sites refer to a specific location strategy rather than the readiness of the recovery site.

• Question 18:

  Which of the following is an example of memory injection?

  A. Two processes access the same variable, allowing one to cause a privilege escalation.
  B. A process receives an unexpected amount of data, which causes malicious code to be executed.
  C. Malicious code is copied to the allocated space of an already running process.
  D. An executable is overwritten on the disk, and malicious code runs the next time it is executed.
  C. Malicious code is copied to the allocated space of an already running process.

• Question 19:

  An engineer wants to inspect traffic to a cluster of web servers in a cloud environment.

  Which of the following solutions should the engineer implement?

  A. CASB
  B. WAF
  C. Load balancer
  D. VPN
  B. WAF

  ---

  Explanation

  A web application firewall (WAF) is designed to inspect and filter HTTP/HTTPS traffic to web servers, providing visibility and protection at the application layer. CASB focuses on cloud service governance, a load balancer distributes traffic rather than inspecting it for security purposes, and a VPN provides secure connectivity but does not inspect web application traffic.

• Question 20:

  A security administrator is hardening corporate systems and applying appropriate mitigations by consulting a real-world knowledge base for adversary behavior.

  Which of the following would be best for the administrator to reference?

  A. MITRE ATT&CK
  B. CSIRT
  C. CVSS
  D. SOAR
  A. MITRE ATT&CK