CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 251:

  Which of the following is the first step to secure a newly deployed server?

  A. Close unnecessary service ports.
  B. Update the current version of the software.
  C. Add the device to the ACL.
  D. Upgrade the OS version.
  A. Close unnecessary service ports.

  ---

  Explanation

  The first step in securing a newly deployed server is to close unnecessary service ports. Open ports can expose the server to unauthorized access and potential cyber threats. By closing unused ports, the attack surface is reduced, limiting the number of entry points available to attackers.

  Updating the software version (B) and upgrading the OS version (D) are important security measures but should follow the step of securing open ports to prevent immediate exposure to threats. Adding the device to the Access Control List (ACL) (C) is a step in network security but does not directly secure the server itself against potential attacks. Closing unnecessary ports helps in minimizing the risk of network-based attacks, such as port scanning and exploitation of default services.

• Question 252:

  A company wants to use new Wi-Fi-enabled environmental sensors in order to automatically collect metrics.

  Which of the following will the security team most likely do?

  A. Add the sensor software to the risk register.
  B. Create a VLAN for the sensors.
  C. Physically air gap the sensors.
  D. Configure TLS 1.2 on all sensors.
  B. Create a VLAN for the sensors.

  ---

  Explanation

  Because these are Wi-Fi-enabled environmental sensors, they are effectively IoT/embedded devices that often have limited security controls, inconsistent patch support, and may expose management interfaces or services. A common Security+ best practice is to reduce their attack surface and limit lateral movement by placing them in a separate, protected network segment and tightly controlling what they can talk to (for example, only to the metrics collector/broker). The Study Guide explicitly calls out VLAN-based segmentation for IoT as a hardening technique: "A common technique used in hardening networks is the use of VLANs... Placing IoT devices on a separate, protected VLAN with appropriate access controls... can help to ensure that frequently vulnerable devices are more protected." It also reinforces this in a practice question scenario: "What security control should she recommend...?... Deploy the IoT devices to a protected VLAN."

  Why the other options are less likely:

  Option A (risk register) is governance documentation, not the most likely immediate technical control for deployment.

  Option C (air gap) is usually unrealistic for Wi-Fi sensors that must transmit metrics.

  Option D (TLS 1.2) may be beneficial, but many sensors can't support strong crypto consistently; segmentation is the most broadly applicable first move to contain risk.

  References:

  CompTIA Security+ Study Guide (SY0-701) - Network Hardening/VLAN segmentation guidance

  related IoT hardening practice question recommending a protected VLAN.

• Question 253:

  Which of the following is an example of a data protection strategy that uses tokenization?

  A. Encrypting databases containing sensitive data
  B. Replacing sensitive data with surrogate values
  C. Removing sensitive data from production systems
  D. Hashing sensitive data in critical systems
  B. Replacing sensitive data with surrogate values

  ---

  Explanation

  Tokenization replaces sensitive data with non-sensitive surrogate values that retain the necessary format but are meaningless without access to the original data.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 3: Security Architecture, Section: "Data Masking and Tokenization".

• Question 254:

  An application developer accidentally uploaded a company's code-signing certificate private key to a public web server. The company is concerned about malicious use of its certificate.

  Which of the following should the company do FIRST?

  A. Delete the private key from the repository.
  B. Verify the public key is not exposed as well.
  C. Update the DLP solution to check for private keys.
  D. Revoke the code-signing certificate.
  D. Revoke the code-signing certificate.

  ---

  Explanation

  We need to revoke the code-signing certificate as this is the most secure way to ensure that the comprised key wont be used by attackers. Usually there are bots crawking all over repos searching this kind of human errors.

• Question 255:

  Which of the following is a risk of conducting a vulnerability assessment?

  A. A disruption of business operations
  B. Unauthorized access to the system
  C. Reports of false positives
  D. Finding security gaps in the system
  A. A disruption of business operations

  ---

  Explanation

  During a vulnerability assessment, scanning or testing can sometimes interfere with normal system operations, potentially leading to slowdowns, unresponsiveness, or even outages. This can disrupt business operations, especially if the assessment is run on production systems without adequate precautions or scheduling during low-impact times.

• Question 256:

  A security analyst discovers that a large number of employee credentials had been stolen and were being sold on the dark web. The analyst investigates and discovers that some hourly employee credentials were compromised, but salaried employee credentials were not affected.

  Most employees clocked in and out while they were inside the building using one of the kiosks connected to the network. However, some clocked out and recorded their time after leaving to go home. Only those who clocked in and out while inside the building had credentials stolen. Each of the kiosks are on different floors, and there are multiple routers, since the business segments environments for certain business functions.

  Hourly employees are required to use a website called acmetimekeeping.com to clock in and out. This website is accessible from the internet.

  Which of the following is the most likely reason for this compromise?

  A. A brute-force attack was used against the time-keeping website to scan for common passwords.
  B. A malicious actor compromised the time-keeping website with malicious code using an unpatched vulnerability on the site, stealing the credentials.
  C. The internal DNS servers were poisoned and were redirecting acmetimekeeping.com to a malicious domain that intercepted the credentials and then passed them through to the real site.
  D. ARP poisoning affected the machines in the building and caused the kiosks to send a copy of all the submitted credentials to a malicious machine.
  B. A malicious actor compromised the time-keeping website with malicious code using an unpatched vulnerability on the site, stealing the credentials.

  ---

  Explanation

  The scenario suggests that only the employees who used the kiosks inside the building had their credentials compromised. Since the time-keeping website is accessible from the internet, it is possible that a malicious actor exploited an unpatched vulnerability in the site, allowing them to inject malicious code that captured the credentials of those who logged in from the kiosks. This is a common attack vector for stealing credentials from web applications.

  References:

  CompTIA Security+ SY0-701 Course Content: The course discusses web application vulnerabilities and how attackers can exploit them to steal credentials.

• Question 257:

  Which of the following actors attacking an organization is the most likely to be motivated by personal beliefs?

  A. Nation-state
  B. Organized crime
  C. Hacktivist
  D. Insider threat
  C. Hacktivist

  ---

  Explanation

  A hacktivist is a type of attacker who is motivated by personal or political beliefs, often aiming to promote a cause or to protest against certain actions or policies. Hacktivists typically use hacking as a means of expressing their views or making a statement, rather than for financial gain or other personal benefits, which distinguishes them from other types of threat actors like nation-states or organized crime groups.

• Question 258:

  The CIRT is reviewing an incident that involved a human resources recruiter exfiltrating sensitive company data. The CIRT found that the recruiter was able to use HTTP over port 53 to upload documents to a web server.

  Which of the following security infrastructure devices could have identified and blocked this activity?

  A. WAF utilizing SSL decryption
  B. NGFW utilizing application inspection
  C. UTM utilizing a threat feed
  D. SD-WAN utilizing IPSec
  B. NGFW utilizing application inspection

• Question 259:

  An organization experiences a compromise in a cloud-hosted solution that contains customer information.

  Which of the following strategies will help determine the sensitivity level of the breach?

  A. Permission restrictions
  B. Tabletop exercise
  C. Data classification
  D. Asset inventory
  C. Data classification

  ---

  Explanation

  The correct answer is Data classification because it is the primary mechanism used to determine the sensitivity and criticality of information involved in a security incident. According to the Security+ SY0-701 governance and risk management concepts, data classification assigns labels-such as public, internal, confidential, or restricted-to information based on its sensitivity, value to the organization, and potential impact if disclosed, altered, or destroyed. When a breach occurs, these classifications allow security teams and management to quickly assess how severe the incident is and what regulatory, legal, or business consequences may apply.

  In this scenario, the compromised cloud-hosted solution contains customer information. By referencing the organization's data classification scheme, incident responders can determine whether the exposed data includes personally identifiable information (PII), financial data, health records, or other regulated data types. This directly influences breach notification requirements, incident escalation, response prioritization, and communication with stakeholders. The SY0- 701 study guide emphasizes that effective security governance depends on having clearly defined classification standards before an incident occurs, so decisions during response are consistent and defensible.

  The other options do not meet the goal of determining sensitivity. Permission restrictions are access control mechanisms used to prevent unauthorized access, not to evaluate the importance of data after a compromise. Tabletop exercises are preparedness and training activities designed to test incident response plans, not to classify real data. Asset inventory identifies systems, hardware, software, and data locations, but it does not define how sensitive the data is; it only helps locate what may be affected.

  Therefore, data classification is the most appropriate strategy for determining the sensitivity level of the breach, aligning directly with Security+ SY0-701 objectives related to risk management, privacy, and incident impact assessment.

• Question 260:

  Which of the following organizational documents is most often used to establish and communicate expectations associated with integrity and ethical behavior within an organization?

  A. AUP
  B. SLA
  C. EULA
  D. MOA
  A. AUP

  ---

  Explanation

  An Acceptable Use Policy (AUP) is commonly used to establish and communicate the organization's expectations regarding acceptable behavior, integrity, and ethical conduct. It outlines guidelines for appropriate use of company resources and sets standards for employees to follow, promoting a secure and ethical work environment.