CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 221:

  Which of the following could potentially be introduced at the time of side loading?

  A. User impersonation
  B. Rootkit
  C. On-path attack
  D. Buffer overflow
  B. Rootkit

• Question 222:

  An employee receives a text message from an unrecognized number claiming to be the Chief Executive Officer and asking the employee to purchase gift cards.

  Which of the following types of attacks describes this example?

  A. Watering-hole
  B. Disinformation
  C. Phishing
  D. Impersonation
  D. Impersonation

  ---

  Explanation

  Impersonation involves an attacker pretending to be a trusted individual, such as a CEO, to trick someone into taking an action - in this case, purchasing gift cards - often seen in social engineering attacks via text or email.

• Question 223:

  An accounting clerk sent money to an attacker ' s bank account after receiving fraudulent instructions over the phone to use a new account.

  Which of the following would most likely prevent this activity in the future?

  A. Standardizing security incident reporting
  B. Executing regular phishing campaigns
  C. Implementing insider threat detection measures
  D. Updating processes for sending wire transfers
  D. Updating processes for sending wire transfers

  ---

  Explanation

  Updating wire transfer processes to include verification steps (such as requiring dual approval or verifying account changes via a secondary communication method) canprevent fraudulenttransactions. Attackers often use business email compromise (BEC) or pretexting to trick employees into transferring funds to fraudulent accounts.

  Standardizing security incident reportingis useful for tracking security events but does not prevent fraud in real time.

  Executing regular phishing campaignsimproves awareness but does not enforce a verification process for financial transactions.

  Implementing insider threat detectionfocuses on internal risks but does not specifically prevent external fraud.

  Amore secure wire transfer processwith additional verification steps is the most effective measure against fraudulent transactions.

• Question 224:

  A security analyst is investigating an alert that was produced by endpoint protection software. The analyst determines this event was a false positive triggered by an employee who attempted to download a file.

  Which of the following is the most likely reason the download was blocked?

  A. A misconfiguration in the endpoint protection software
  B. A zero-day vulnerability in the file
  C. A supply chain attack on the endpoint protection vendor
  D. Incorrect file permissions
  A. A misconfiguration in the endpoint protection software

  ---

  Explanation

  The most likely reason the download was blocked, resulting in a false positive, is a misconfiguration in the endpoint protection software. False positives occur when legitimate actions are incorrectly identified as threats due to incorrect settings or overly aggressive rules in the security software.

  Misconfiguration in the endpoint protection software: Common cause of false positives, where legitimate activities are flagged incorrectly due to improper settings. Zero-day vulnerability: Refers to previously unknown vulnerabilities, which are less likely to be associated with a false positive. Supply chain attack: Involves compromising the software supply chain, which is a broader and more severe issue than a simple download being blocked. Incorrect file permissions: Would prevent access to files but not typically cause an alert in endpoint protection software.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 4.3 - Explain various activities associated with vulnerability management (False positives).

• Question 225:

  A security team wants to work with the development team to ensure WAF policies are automatically created when applications are deployed.

  Which concept describes this capability?

  A. IaC
  B. IoT
  C. IoC
  D. IaaS
  A. IaC

  ---

  Explanation

  The ability to automatically generate WAF (Web Application Firewall) policies during application deployment is a characteristic of Infrastructure as Code (IaC). IaC allows infrastructure components-such as firewalls, WAF policies, load balancers, and security groups-to be defined, version-controlled, and deployed programmatically.

  According to Security+ SY0-701, IaC enhances DevSecOps workflows by embedding security controls directly into deployment pipelines, ensuring consistent, repeatable, and automated application protection. This reduces human error, eliminates configuration drift, and ensures that every new application instance is deployed with the correct WAF rules already in place.

  IoT (B) involves connected devices.

  IoC (C) refers to Indicators of Compromise.

  IaaS (D) provides cloud infrastructure but does not itself automate security policy generation.

  Thus, A: IaC is the correct concept enabling automated WAF policy creation.

• Question 226:

  A systems administrator is advised that an external web server is not functioning property. The administrator reviews the following firewall logs containing traffic going to the web server:

  

  Which of the following attacks is likely occurring?

  A. DDoS
  B. Directory traversal
  C. Brute-force
  D. HTTPS downgrade
  A. DDoS

• Question 227:

  An employee used a company's billing system to issue fraudulent checks. The administrator is looking for evidence of other occurrences of this activity.

  Which of the following should the administrator examine?

  A. Application logs
  B. Vulnerability scanner logs
  C. IDS/IPS logs
  D. Firewall logs
  A. Application logs

  ---

  Explanation

  Application logs will contain records of activities within the billing system, including transactions, actions taken by users, and any anomalies. This is the most direct source of evidence for tracing fraudulent activity within the specific application, such as issuing unauthorized checks.

• Question 228:

  A new corporate policy requires all staff to use multifactor authentication to access company resources.

  Which of the following can be utilized to set up this form of identity and access management? (Choose two.)

  A. Authentication tokens
  B. Least privilege
  C. Biometrics
  D. LDAP
  E. Password vaulting
  F. SAML
  A. Authentication tokens
  C. Biometrics

  ---

  Explanation

  Authentication tokens: Tokens, such as hardware or software-based one-time password (OTP) generators, are commonly used as one factor in multifactor authentication (MFA). They provide an additional layer of security beyond just a password.

  Biometrics: Biometric factors, such as fingerprint scans or facial recognition, are another common component of MFA, providing a "something you are" factor for identity verification.

  These factors, when combined with something the user knows (e.g., a password), fulfill the requirements for MFA by incorporating multiple layers of authentication.

• Question 229:

  A bank set up a new server that contains customers' PII.

  Which of the following should the bank use to make sure the sensitive data is not modified?

  A. Full disk encryption
  B. Network access control
  C. File integrity monitoring
  D. User behavior analytics
  C. File integrity monitoring

• Question 230:

  A security analyst has determined that a security breach would have a financial impact of $15,000 and is expected to occur twice within a three-year period.

  Which of the following is the ALE for this risk?

  A. $7,500
  B. $10,000
  C. $15,000
  D. $30,000
  B. $10,000

  ---

  Explanation

  The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). In this case:

  1. SLE (Single Loss Expectancy) = $15,000

  2. ARO (Annualized Rate of Occurrence) = 2 occurrences / 3 years = 0.67 per year