CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 231:

  Which of the following would most likely prevent exploitation of an end-of-life, business-critical system?

  A. Monitoring
  B. Isolation
  C. Decommissioning
  D. Encryption
  B. Isolation

  ---

  Explanation

  End-of-life (EOL) systems no longer receive security patches, vendor support, or vulnerability updates. Because of this, they are highly susceptible to exploitation, especially if attackers can reach them over a network. When the system is business-critical and cannot be decommissioned, the most effective strategy is isolation, also known as network segmentation, air-gapping, or restrictive network zoning. Isolation removes direct exposure to external and internal threats by limiting communication paths to only essential systems and users.

  According to the Security+ SY0-701 guidance, isolating legacy systems helps reduce the attack surface when patching is no longer possible. Monitoring (A) is useful for detection but does not prevent exploitation.

  Decommissioning (C) would be ideal but is not possible for business-critical systems, as stated in the question. Encryption (D) protects data confidentiality but does not stop an attacker from exploiting vulnerabilities in an unpatched OS or application.

  Isolation is a recommended compensating control for legacy and unsupported systems in SY0-701's Security Architecture & Resilience domain, which emphasizes micro-segmentation, firewalls, and restricted access to minimize risk when systems cannot be replaced or patched.

• Question 232:

  A malicious actor is trying to access sensitive nancial information from a company's database by intercepting and reusing log-in credentials.

  Which of the following attacks is the malicious actor attempting?

  A. SQL injection
  B. On-path
  C. Brute-force
  D. Password spraying
  B. On-path

• Question 233:

  Which of the following explains how organizations benefit from SCAP?

  A. The configurations defined as part of established baselines allow organizations to deploy well-tested security solutions quickly and easily.
  B. The consolidated reporting layout makes it easier for technicians to communicate incident response to senior decision-makers.
  C. The common format for vulnerability scanning and reporting enables greater interoperability between security tools from different vendors.
  D. The strict compliance to international standards reduces overall cost and risk to organizations when a security breach occurs.
  C. The common format for vulnerability scanning and reporting enables greater interoperability between security tools from different vendors.

  ---

  Explanation

  The best answer is C. The common format for vulnerability scanning and reporting enables greater interoperability between security tools from different vendors. SCAP (Security Content Automation Protocol) is a standardized framework that helps security tools use common methods for expressing, measuring, and reporting security issues such as vulnerabilities, misconfigurations, and compliance results. One of its biggest benefits is interoperability across tools from different vendors. Because SCAP uses standardized formats and naming conventions, organizations can more easily: share scan results compare findings across platforms automate vulnerability and compliance checks integrate multiple security products.

  Why the other options are incorrect:

  A. The configurations defined as part of established baselines allow organizations to deploy well-tested security solutions quickly and easily.Baselines are important, but this answer is too general and does not capture the main benefit of SCAP.

  B. The consolidated reporting layout makes it easier for technicians to communicate incident response to senior decision-makers.SCAP is not primarily about incident response reporting to executives.

  D. The strict compliance to international standards reduces overall cost and risk to organizations when a security breach occurs.This is too broad and not the clearest explanation of what SCAP actually provides. From the SY0-701 perspective, SCAP is valuable because it supports standardized vulnerability and configuration assessment and improves tool interoperability. Therefore, C is the correct answer.

• Question 234:

  A malicious update was distributed to a common software platform and disabled services at many organizations.

  Which of the following best describes this type of vulnerability?

  A. DDoS attack
  B. Rogue employee
  C. Insider threat
  D. Supply chain
  D. Supply chain

• Question 235:

  Which of the following attacks primarily targets insecure networks?

  A. Evil twin
  B. Impersonation
  C. Watering hole
  D. Pretexting
  A. Evil twin

• Question 236:

  Which of the following is an example of a certificate that is generated by an internal source?

  A. Digital signature
  B. Asymmetric key
  C. Self-signed
  D. Symmetric key
  C. Self-signed

  ---

  Explanation

  A self-signed certificate is generated internally without involving an external Certificate Authority (CA). In a self-signed certificate, the certificate issuer and certificate subject are the same entity. Security+ SY0-701 explains that organizations frequently use self-signed certificates for internal systems, lab environments, or testing scenarios where external trust chains are unnecessary.

  A digital signature (A) is a cryptographic function, not a certificate. Asymmetric keys (B) are used in public-key cryptography but do not constitute a certificate by themselves. Symmetric keys (D) are encryption tools, not certificates.

  Therefore, the example of a certificate generated internally is C: Self-signed.

• Question 237:

  A systems administrator wants to implement a backup solution. The solution needs to allow recovery of the entire system, including the operating system, in case of a disaster.

  Which of the following backup types should the administrator consider?

  A. Incremental
  B. Storage area network
  C. Differential
  D. Image
  D. Image

  ---

  Explanation

  An image backup, also known as a full system backup, captures the entire contents of a system, including the operating system, applications, settings, and all data. This type of backup allows for a complete recovery of the system in case of a disaster, as it includes everything needed to restore the system to its previous state. This makes it the ideal choice for a systems administrator who needs to ensure the ability to recover the entire system, including the OS.

  References:

  CompTIA Security+ SY0-701 study materials, domain on Security Operations.

• Question 238:

  Which of the following digital forensics activities would a security team perform when responding to legal requests in a pending investigation?

  A. E-discovery
  B. User provisioning
  C. Firewall log export
  D. Root cause analysis
  A. E-discovery

• Question 239:

  A growing company would like to enhance the ability of its security operations center to detect threats but reduce the amount of manual work required tor the security analysts.

  Which of the following would best enable the reduction in manual work?

  A. SOAR
  B. SIEM
  C. MDM
  D. DLP
  A. SOAR

  ---

  Explanation

  Security Orchestration, Automation, and Response (SOAR) systems help organizations automate repetitive security tasks, reduce manual intervention, and improve the efficiency of security operations. By integrating with various security tools, SOAR can automatically respond to incidents, helping to enhance threat detection while reducing the manual workload on security analysts.

  References:

  CompTIA Security+ SY0-701 study materials, particularly in the domain of security operations and automation technologies.

• Question 240:

  Which of the following best describe a penetration test that resembles an actual external attack?

  A. Known environment
  B. Partially known environment
  C. Bug bounty
  D. Unknown environment
  D. Unknown environment

  ---

  Explanation

  An unknown environment in penetration testing, also known as a black-box test, simulates an actual external attack where the tester has no prior knowledge of the system. This type of penetration test is designed to mimic real-world attack scenarios, where an attacker has little to no information about the target environment. The tester must rely on various reconnaissance and attack techniques to uncover vulnerabilities, much like a real-world attacker would. This approach helps organizations understand their security posture from an external perspective, providing insights into how their defenses would hold up against a true outsider threat.

  References:

  CompTIA Security+ SY0-701 Course Content: The course highlights the importance of understanding different penetration testing environments, including black-box testing, which aligns with the "unknown environment" in the provided answer.

  CompTIA Security+ SY0-601 Study Guide: The guide details penetration testing methodologies, including black-box testing, which is crucial for simulating real external attacks.