CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 191:

  A penetration testing report indicated that an organization should implement controls related to database input validation.

  Which of the following best identifies the type of vulnerability that was likely discovered during the test?

  A. XSS
  B. Command injection
  C. Buffer overflow
  D. SQLi
  D. SQLi

• Question 192:

  An organization wants to improve the company's security authentication method for remote employees. Given the following requirements:

  1. Must work across SaaS and internal network applications

  2. Must be device manufacturer agnostic

  3. Must have offline capabilities

  Which of the following would be the most appropriate authentication method?

  A. Username and password
  B. Biometrics
  C. SMS verification
  D. Time-based tokens
  D. Time-based tokens

• Question 193:

  A security analyst must recover files from a USB drive associated with a ransomware attack.

  Which of the following tools will help the analyst securely retrieve the files?

  A. Sandboxing environment
  B. Intrusion prevention system
  C. File integrity management tool
  D. Static code analysis tool
  A. Sandboxing environment

  ---

  Explanation

  The best answer is A. Sandboxing environment. A USB drive associated with a ransomware attack should be treated as highly suspicious. To securely retrieve files without risking infection of production systems, the analyst should use a sandboxing environment. A sandbox provides an isolated environment where files can be opened, examined, and extracted while containing any malicious behavior. This is the safest option because ransomware may execute automatically or contain hidden malicious payloads. Why the other options are incorrect:

  B. Intrusion prevention systemAn IPS monitors and blocks malicious network traffic. It does not provide a secure environment for opening files from a suspicious USB drive.

  C. File integrity management toolFile integrity monitoring detects changes to files, but it is not designed to safely retrieve files from potentially malicious media.

  D. Static code analysis toolStatic code analysis is used to inspect source code for vulnerabilities. It is not intended for safely interacting with suspicious files on removable media. From the SY0-701 perspective, suspicious files and removable media should be handled in an isolated sandbox to reduce the risk of malware execution. Therefore, A is the correct answer.

• Question 194:

  A software developer released a new application and is distributing application files via the developer's website.

  Which of the following should the developer post on the website to allow users to verify the integrity of the downloaded files?

  A. Hashes
  B. Certificates
  C. Algorithms
  D. Salting
  A. Hashes

• Question 195:

  Which of the following physical controls can be used to both detect and deter? (Choose two.)

  A. Lighting
  B. Fencing
  C. Signage
  D. Sensor
  E. Bollard
  F. Lock
  A. Lighting
  D. Sensor

• Question 196:

  A store is setting up wireless access for employees. Management wants to limit the number of access points while ensuring full coverage.

  Which tool will help determine how many access points are needed?

  A. Signal locator
  B. WPA3
  C. Heat map
  D. Site survey
  D. Site survey

  ---

  Explanation

  A site survey is the formal process used to determine the required number, placement, and configuration of wireless access points (APs). Security+ SY0-701 states that site surveys measure RF propagation, identify dead zones, account for building materials, detect interference sources, and evaluate coverage overlap. This information allows network engineers to deploy the fewest APs necessary while still ensuring full coverage.

  Although heat maps (C) are generated as a result of a site survey, they are visualization tools-not the actual survey process. A signal locator (A) is not a standardized tool in wireless planning. WPA3 (B) is a wireless security protocol and has no impact on access point planning or coverage optimization.

  A full site survey ensures optimal AP placement to balance coverage, performance, and cost-exactly the concern described in the scenario.

  Thus, the correct answer is D: Site survey.

• Question 197:

  Which of the following will harden access to a new database system? (Select two)

  A. Jump server
  B. NIDS
  C. Monitoring
  D. Proxy server
  E. Host-based firewall
  F. WAF
  A. Jump server
  E. Host-based firewall

  ---

  Explanation

  Hardening access to a new database system requires implementing controls that restrict and secure how administrators and applications connect to the database. A jump server (A) is a hardened intermediary system used to manage access to sensitive systems such as databases. By forcing administrators to authenticate through a controlled, monitored jump host instead of connecting directly, organizations reduce attack surfaces and prevent unauthorized lateral movement.

  Security+ SY0-701 identifies jump servers as critical in securing high-value systems.

  A host-based firewall (E) provides system-level traffic filtering directly on the database server. It allows only trusted IPs, ports, and services to communicate with the database, significantly reducing exposure. This is an essential hardening measure because databases should only accept connections from specific application servers or administrative hosts.

  NIDS (B) monitors traffic but does not harden access. Monitoring (C) provides visibility but does not restrict access. A proxy server (D) is not typically used for database access. A WAF (F) protects web applications, not internal database systems.

  Thus, A (Jump server) and E (Host-based firewall) are the correct hardening controls.

• Question 198:

  The SOC for a large MSSP is meeting to discuss the lessons learned from a recent incident that took much too long to resolve. This type of incident has become more common in recent weeks and is consuming large amounts of the analysts' time due to manual tasks being performed.

  Which of the following solutions should the SOC consider to BEST improve its response time?

  A. Configure a NIDS appliance using a Switched Port Analyzer
  B. Collect OSINT and catalog the artifacts in a central repository
  C. Implement a SOAR with customizable playbooks
  D. Install a SIEM with community-driven threat intelligence
  C. Implement a SOAR with customizable playbooks

  ---

  Explanation

  SOAR (Security Orchestration, Automation, and Response) Can use either playbook or runbook. It assists in collecting threat related data from a range of sources and automate responses to low level threats. (frees up some of the CSIRT time)

• Question 199:

  An organization authorizes system deployment on the network after reducing the number of Category 1 vulnerabilities to zero.

  Which of the following is this scenario an example of?

  A. Risk avoidance
  B. Risk tolerance
  C. Risk transference
  D. Risk reporting
  B. Risk tolerance

  ---

  Explanation

  Risk tolerance is the correct answer because the organization is defining an acceptable threshold for deployment. The system is allowed onto the network only after Category 1 vulnerabilities are reduced to zero. That means the organization is not saying all risk must be eliminated; it is saying a specific level of risk is unacceptable, while deployment is permitted once the risk falls within the approved threshold. Risk avoidance would mean not deploying the system or eliminating the activity entirely. Risk transference would shift financial or operational risk to another party, such as through insurance or outsourcing. Risk reporting is communication of risk status, not the decision threshold itself. This is a classic example of risk tolerance criteria.

• Question 200:

  A security engineer needs to configure an NGFW to minimize the impact of the increasing number of various traffic types during attacks.

  Which of the following types of rules is the engineer the most likely to configure?

  A. Signature-based
  B. Behavioral-based
  C. URL-based
  D. Agent-based
  B. Behavioral-based

  ---

  Explanation

  To minimize the impact of the increasing number of various traffic types during attacks, a security engineer is most likely to configure behavioral-based rules on a Next-Generation Firewall (NGFW). Behavioral-based rules analyze the behavior of traffic patterns and can detect and block unusual or malicious activity that deviates from normal behavior.

  Behavioral-based: Detects anomalies by comparing current traffic behavior to known good behavior, making it effective against various traffic types during attacks.

  Signature-based: Relies on known patterns of known threats, which might not be as effective against new or varied attack types.

  URL-based: Controls access to websites based on URL categories but is not specifically aimed at handling diverse traffic types during attacks.

  Agent-based: Typically involves software agents on endpoints to monitor and enforce policies, not directly related to NGFW rules.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 4.5 - Modify enterprise capabilities to enhance security (Behavioral-based rules on NGFW).