CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 211:

  Which of the following data types relates to data sovereignty?

  A. Data classified as public in other countries
  B. Personally Identifiable data while traveling
  C. Health data shared between doctors in other nations
  D. Data at rest outside of a country's borders
  D. Data at rest outside of a country's borders

• Question 212:

  A company discovers suspicious transactions that were entered into the company's database and attached to a user account that was created as a trap for malicious activity.

  Which of the following is the user account an example of?

  A. Honeytoken
  B. Honeynet
  C. Honeypot
  D. Honeyfile
  A. Honeytoken

• Question 213:

  A company receives an alert that a network device vendor, which is widely used in the enterprise, has been banned by the government.

  Which of the following will the company's general counsel most likely be concerned with during a hardware refresh of these devices?

  A. Sanctions
  B. Data sovereignty
  C. Cost of replacement
  D. Loss of license
  A. Sanctions

  ---

  Explanation

  When the government bans a vendor, the primary concern for the company's general counsel is sanctions, which are legal restrictions that prohibit the purchase, use, import, or continued operation of products associated with restricted entities. Security+ SY0-701 stresses that compliance with government regulations and legal mandates is a critical oversight responsibility. Failure to comply may result in severe penalties, including fines, loss of contracting eligibility, and reputational damage.

  During a hardware refresh, general counsel will ensure the organization is not violating federal trade sanctions, procurement laws, or export/import restrictions. Even if devices are already purchased, continued use may still violate the sanctions, creating legal liability.

  Data sovereignty (B) relates to storage location requirements, not vendor bans. Cost of replacement (C) is an operational and financial concern, not a legal one. Loss of license (D) typically applies to software but is not the primary legal concern tied to a government-issued vendor ban. Therefore, sanctions are the general counsel's primary focus.

• Question 214:

  Which of the following is the best way to prevent an unauthorized user from plugging a laptop into an employee's phone network port and then using tools to scan for database servers?

  A. MAC filtering
  B. Segmentation
  C. Certification
  D. Isolation
  A. MAC filtering

  ---

  Explanation

  MAC filtering allows network administrators to control device access by specifying allowed MAC addresses. This prevents unauthorized devices, such as a laptop plugged into a network port, from gaining access.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 2: Threats and Vulnerabilities, Section:"Network Access Control Methods".

• Question 215:

  Which of the following methods to secure credit card data is best to use when a requirement is to see only the last four numbers on a credit card?

  A. Encryption
  B. Hashing
  C. Masking
  D. Tokenization
  C. Masking

  ---

  Explanation

  Masking is the technique that directly meets the requirement of displaying only the last four digits of a credit card number. It works by obscuring part of the original value (for example, **** **** **** 1234) while leaving a limited portion visible for identification and verification.

  The distinction is important: Masking is a display control. The original data remains unchanged in storage, and only the visible output is partially hidden.

  Tokenization is a data replacement method. It substitutes the entire card number with a non-sensitive token, and the original value is stored separately in a secure token vault. It is not intended for partially revealing digits.

  Encryption and hashing transform the data and are not designed to selectively display only part of the original value.

• Question 216:

  Which of the following control types involves restricting IP connectivity to a router's web management interface to protect it from being exploited by a vulnerability?

  A. Corrective
  B. Physical
  C. Preventive
  D. Managerial
  C. Preventive

• Question 217:

  Various company stakeholders meet to discuss roles and responsibilities in the event of a security breach affecting offshore offices.

  Which of the following is this an example of?

  A. Tabletop exercise
  B. Penetration test
  C. Geographic dispersion
  D. Incident response
  A. Tabletop exercise

  ---

  Explanation

  A tabletop exercise is a discussion-based activity where stakeholders simulate a security breach scenario to identify gaps in response plans and clarify roles and responsibilities.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 5: Security Program Management, Section: "Incident Response Planning and Exercises".

• Question 218:

  A city municipality lost its primary data center when a tornado hit the facility.

  Which of the following should the city staff use immediately after the disaster to handle essential public services?

  A. BCP
  B. Communication plan
  C. DRP
  D. IRP
  C. DRP

• Question 219:

  A company wants to ensure that the software it develops will not be tampered with after the final version is completed.

  Which of the following should the company most likely use?

  A. Hashing
  B. Encryption
  C. Baselines
  D. Tokenization
  A. Hashing

• Question 220:

  A penetration tester enters an office building at the same time as a group of employees despite not having an access badge.

  Which of the following attack types is the penetration tester performing?

  A. Tailgating
  B. Shoulder surfing
  C. RFID cloning
  D. Forgery
  A. Tailgating

  ---

  Explanation

  Tailgating is a social engineering technique where an unauthorized person gains access to a restricted area by following closely behind authorized individuals without their knowledge or consent. In this scenario, the penetration tester enters the office building at the same time as a group of employees despite not having an access badge, which exemplifies tailgating.