CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 241:

  Which of the following best describes the concept of information being stored outside of its country of origin while still being subject to the laws and requirements of the country of origin?

  A. Data sovereignty
  B. Geolocation
  C. Intellectual property
  D. Geographic restrictions
  A. Data sovereignty

  ---

  Explanation

  Data sovereignty refers to the principle that data stored in another country remains subject to the originating country's laws. This is a common concern in cloud computing.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 3: Security Architecture, Section: "Data Sovereignty and Regulatory Compliance".

• Question 242:

  The Chief Information Security Officer (CISO) at a large company would like to gain an understanding of how the company's security policies compare to the requirements imposed by external regulators.

  Which of the following should the CISO use?

  A. Penetration test
  B. Internal audit
  C. Attestation
  D. External examination
  B. Internal audit

• Question 243:

  The management team reports that employees are missing features on company-provided tablets, which is causing productivity issues. The management team directs the IT team to resolve the issue within 48 hours.

  Which of the following would be the best solution for the IT team to leverage in this scenario?

  A. EDR
  B. COPE
  C. MDM
  D. FDE
  C. MDM

• Question 244:

  Which of the following log sources best detects port scan activity?

  A. Firewall
  B. Proxy
  C. Endpoint
  D. NetFlow
  D. NetFlow

  ---

  Explanation

  The correct answer is D. NetFlow.

  NetFlow records network traffic metadata, such as source IP address, destination IP address, source port, destination port, protocol, timestamps, and traffic volume. This makes it especially useful for detecting port scan activity, because port scans often show a pattern of one system attempting connections to many ports or many hosts in a short period of time.

  This aligns with CompTIA Security+ SY0-701 security operations topics related to log analysis, network monitoring, and detection of suspicious traffic patterns.

  Why the other options are incorrect:

  A. Firewall Firewall logs can detect some port scan activity, especially if the firewall blocks and logs connection attempts. However, NetFlow is generally better for identifying scan patterns across network traffic because it provides broader flow visibility.

  B. Proxy Proxy logs are mainly useful for web traffic analysis, URL filtering, and HTTP/HTTPS activity. They are not the best source for detecting port scans across many ports.

  C. Endpoint Endpoint logs may show local connection attempts or suspicious activity on a host, but they do not provide the same network-wide visibility as NetFlow. Therefore, the best log source for detecting port scan activity is NetFlow.

• Question 245:

  A user needs to complete training at https://comptiatraining.com. After manually entering the URL, the user sees that the accessed website is noticeably different from the standard company website.

  Which of the following is the most likely explanation for the difference?

  A. Cross-site scripting
  B. Pretexting
  C. Typosquatting
  D. Vishing
  C. Typosquatting

  ---

  Explanation

  Typosquatting (also known as URL hijacking) is a type of attack where cybercriminals register domain names similar to legitimate sites but with slight misspellings (e.g., comptiatraning.com instead of comptiatraining.com). Attackers use these fake sites to steal credentials or distribute malware. Since the user manually entered the URL and reached an unexpected website, this strongly indicates a typosquatting attack.

  References:

  CompTIA Security+ SY0-701 Official Study Guide, Threats, Vulnerabilities, and Mitigations domain.

• Question 246:

  A company receives an alert that a widely used network device vendor has been banned by the government.

  What will general counsel most likely be concerned with during hardware refresh?

  A. Sanctions
  B. Data sovereignty
  C. Cost of replacement
  D. Loss of license
  A. Sanctions

  ---

  Explanation

  When the government bans a vendor, the legal concern is sanctions-laws that restrict purchasing, using, or importing products from certain companies or countries. The general counsel's job is to ensure the organization is not violating federal restrictions, export controls, trade compliance laws, or sanctions lists such as OFAC or government procurement bans.

  Security+ SY0-701 notes that legal and regulatory compliance is a critical part of risk management, especially when handling prohibited vendors or technologies. Continued use of banned devices could expose the organization to legal penalties, fines, or federal investigation. Data sovereignty (B) refers to data storage location laws, not hardware bans. Cost of replacement (C) is an operational concern, not a legal one. Loss of license (D) typically applies to software, not network hardware.

  Therefore, the general counsel's primary concern is A: Sanctions.

• Question 247:

  Which of the following architecture models ensures that critical systems are physically isolated from the network to prevent access from users with remote access privileges?

  A. Segmentation
  B. Virtualized
  C. Air-gapped
  D. Serverless
  C. Air-gapped

• Question 248:

  A security investigation revealed that malicious software was installed on a server using a server administrator's credentials. During the investigation, the server administrator explained that Telnet was regularly used to log in.

  Which of the following most likely occurred?

  A. A spraying attack was used to determine which credentials to use.
  B. A packet capture tool was used to steal the password.
  C. A remote-access Trojan was used to install the malware.
  D. A dictionary attack was used to log in as the server administrator.
  B. A packet capture tool was used to steal the password.

• Question 249:

  An organization wants to ensure the integrity of compiled binaries in the production environment.

  Which of the following security measures would best support this objective?

  A. Input validation
  B. Code signing
  C. SQL injection
  D. Static analysis
  B. Code signing

  ---

  Explanation

  To ensure the integrity of compiled binaries in the production environment, the best security measure is code signing. Code signing uses digital signatures to verify the authenticity and integrity of the software, ensuring that the code has not been tampered with or altered after it was signed.

  Code signing: Involves signing code with a digital signature to verify its authenticity and integrity, ensuring the compiled binaries have not been altered. Input validation: Ensures that only properly formatted data enters an application but does not verify the integrity of compiled binaries. SQL injection: A type of attack, not a security measure. Static analysis: Analyzes code for vulnerabilities and errors but does not ensure the integrity of compiled binaries in production.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 1.4 - Explain the importance of using appropriate cryptographic solutions (Code signing).

• Question 250:

  Which of the following exercises should an organization use to improve its incident response process?

  A. Tabletop
  B. Replication
  C. Failover
  D. Recovery
  A. Tabletop

  ---

  Explanation

  A tabletop exercise is a simulated scenario that tests the organization's incident response plan and procedures. It involves key stakeholders and decision-makers who discuss their roles and actions in response to a hypothetical incident. It can help identify gaps, weaknesses, and improvement areas in the incident response process. It can also enhance communication, coordination, and collaboration among the participants.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 525