CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 201:

  A malicious insider from the marketing team alters records and transfers company funds to a personal account.

  Which of the following methods would be the best way to secure company records in the future?

  A. Permission restrictions
  B. Hashing
  C. Input validation
  D. Access control list
  A. Permission restrictions

  ---

  Explanation

  Implementing strict permission restrictions ensures that users can only access the data and functions necessary for their specific roles. By limiting access rights, the company can reduce the risk of unauthorized modifications by restricting sensitive financial records to only those who absolutely need access. Additionally, permission restrictions allow for better monitoring and control over sensitive data, making it harder for malicious insiders to perform unauthorized actions.

• Question 202:

  A database administrator is updating the company's SQL database, which stores credit card information for pending purchases.

  Which of the following is the best method to secure the data against a potential breach?

  A. Hashing
  B. Obfuscation
  C. Tokenization
  D. Masking
  C. Tokenization

  ---

  Explanation

  Tokenization replaces sensitive data, like credit card information, with a unique identifier (token) that has no exploitable value outside of a specific context. This approach is widely used to secure payment card information and reduces the risk of exposure in case of a breach, as the actual credit card data is not stored in the database.

• Question 203:

  A group of developers has a shared backup account to access the source code repository.

  Which of the following is the best way to secure the backup account if there is an SSO failure?

  A. RAS
  B. EAP
  C. SAML
  D. PAM
  D. PAM

  ---

  Explanation

  Privileged Access Management (PAM) solutions enhance security by enforcing strong authentication, rotation of credentials, and access control for shared accounts. This is especially critical in scenarios like SSO failures.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 5: Security Program Management, Section: "Privileged Access and Identity Management".

• Question 204:

  A city municipality lost its primary data center when a tornado hit the facility.

  Which of the following should the city staff use immediately after the disaster to handle essential public services?

  A. BCP
  B. Communication plan
  C. DRP
  D. IRP
  C. DRP

• Question 205:

  During a routine audit, an analyst discovers that a department uses software that was not vetted.

  Which threat is this?

  A. Espionage
  B. Data exfiltration
  C. Shadow IT
  D. Zero-day
  C. Shadow IT

  ---

  Explanation

  Shadow IT refers to software, hardware, cloud services, or applications deployed without approval from the IT or security department. In this scenario, a high school department is using an unvetted simulation program-classic Shadow IT behavior.

  Security+ SY0-701 explains that Shadow IT:

  Introduces unknown vulnerabilities

  Bypasses security controls

  Creates compliance risks

  Leads to data exposure

  Interferes with standard configuration management

  Espionage (A) involves intelligence gathering, not unauthorized software use. Data exfiltration (B) involves data theft, not unauthorized software deployment. Zero-day (D) refers to unknown vulnerabilities, not unapproved systems.

  Thus, Shadow IT is the correct answer.

• Question 206:

  A company is planning to set up a SIEM system and assign an analyst to review the logs on a weekly basis.

  Which of the following types of controls is the company setting up?

  A. Corrective
  B. Preventive
  C. Detective
  D. Deterrent
  C. Detective

  ---

  Explanation

  A detective control is a type of control that monitors and analyzes the events and activities in a system or a network, and alerts or reports when an incident or a violation occurs. A SIEM (Security Information and Event Management) system is a tool that collects, correlates, and analyzes the logs from various sources, such as firewalls, routers, servers, or applications, and provides a centralized view of the security status and incidents. An analyst who reviews the logs on a weekly basis can identify and investigate any anomalies, trends, or patterns that indicate a potential threat or a breach. A detective control can help the company to respond quickly and effectively to the incidents, and to improve its security posture and resilience.

  References:

  CompTIA Security+ Study Guide with over 500 Practice Test Questions: Exam SY0-701, 9th Edition, Chapter 1, page 23. CompTIA Security+ SY0-701 Exam Objectives, Domain 4.3, page 14.

• Question 207:

  Which of the following is a directive managerial control?

  A. Acceptable use policy
  B. Login warning banner
  C. Master service agreement
  D. No trespassing sign
  A. Acceptable use policy

  ---

  Explanation

  A directive managerial control provides guidance and expectations for behavior through policy and governance. An Acceptable Use Policy (AUP) is a classic example, as it defines how users may and may not use organizational systems and data. Security+ SY0-701 categorizes policies as managerial (administrative) controls that direct user behavior and establish accountability.

  A login warning banner (B) is typically a deterrent/administrative control but is not managerial in nature. A master service agreement (C) is a contractual/legal document, not a managerial directive for internal users. A "No trespassing" sign (D) is a physical deterrent control.

  Because an AUP formally directs behavior and is enforced through management processes, A: Acceptable use policy is correct.

• Question 208:

  An organization is evaluating new regulatory requirements associated with the implementation of corrective controls on a group of interconnected financial systems.

  Which of the following is the most likely reason for the new requirement?

  A. To defend against insider threats altering banking details
  B. To ensure that errors are not passed to other systems
  C. To allow for business insurance to be purchased
  D. To prevent unauthorized changes to financial data
  B. To ensure that errors are not passed to other systems

  ---

  Explanation

  Theprimary goal of corrective controls in financial systems is to ensure that errors do not propagate across interconnected systems. Financial transactions are ofteninterdependent, meaning one incorrect or unauthorized change can affect multiple systems. Regulations often mandate these controls tomaintain accuracy and prevent cascading failures. A (insider threats altering banking details)is a concern, but thisscenario focuses on corrective controls, not insider threats specifically.

  C (business insurance)is unrelated to why corrective controls are implemented.

  D (preventing unauthorized changes)falls underpreventive, notcorrectivecontrols.

  References:

  CompTIA Security+ SY0-701

  Official Study Guide, Security Program Management and Oversight domain.

• Question 209:

  Which of the following best distinguishes hacktivists from insider threats?

  A. Hacktivists often act based on ideological or political beliefs rather than organizational access.
  B. Hacktivists are generally employed by the target organization at the time of attack.
  C. Hacktivists often target organizations without prior access or internal affiliation.
  D. Hacktivists are primarily motivated by personal conflicts or employment-related dissatisfaction.
  C. Hacktivists often target organizations without prior access or internal affiliation.

  ---

  Explanation

  The best answer is C. Hacktivists often target organizations without prior access or internal affiliation. The clearest distinction between hacktivists and insider threats is that insider threats typically have authorized access or internal affiliation with the organization, while hacktivists usually act from the outside. Hacktivists are often motivated by political, ideological, or social causes, but the strongest differentiator in this comparison is that they generally do not begin with legitimate internal access. Why the other options are less correct:

  A. Hacktivists often act based on ideological or political beliefs rather than organizational access.This is true about motivation, but it does not distinguish them as directly as the lack of internal access does.

  B. Hacktivists are generally employed by the target organization at the time of attack.This describes insiders, not hacktivists.

  D. Hacktivists are primarily motivated by personal conflicts or employment-related dissatisfaction. This is more typical of some insider threats, not hacktivists. From the SY0-701 perspective, the strongest distinction is external targeting without prior authorized access, so C is the best answer.

• Question 210:

  A technician needs to apply a high-priority patch to a production system.

  Which of the following steps should be taken first?

  A. Air gap the system.
  B. Move the system to a different network segment.
  C. Create a change control request.
  D. Apply the patch to the system.
  C. Create a change control request.

  ---

  Explanation

  A change control request is a document that describes the proposed change to a system, the reason for the change, the expected impact, the approval process, the testing plan, the implementation plan, the rollback plan, and the communication plan. A change control request is a best practice for applying any patch to a production system, especially a high-priority one, as it ensures that the change is authorized, documented, tested, and communicated. A change control request also minimizes the risk of unintended consequences, such as system downtime, data loss, or security breaches.

  References:

  CompTIA Security+ Study Guide with over 500 Practice Test Questions: Exam SY0-701, 9th Edition, Chapter 6, page 235. CompTIA Security+ SY0-701 Exam Objectives, Domain 4.1, page 13.