CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 261:

  Which of the following allows an exploit to go undetected by the operating system?

  A. Firmware vulnerabilities
  B. Side loading
  C. Memory injection
  D. Encrypted payloads
  C. Memory injection

  ---

  Explanation

  Memory injection techniques allow attackers to inject malicious code directly into a process's memory space, often bypassing traditional file-based detection methods. By operating in-memory, these exploits can evade detection by the operating system and avoid leaving traces on disk, making them harder for antivirus and other security software to identify.

• Question 262:

  Which of the following threat actors is the most likely to use large financial resources to attack critical systems located in other countries?

  A. Insider
  B. Unskilled attacker
  C. Nation-state
  D. Hacktivist
  C. Nation-state

  ---

  Explanation

  A nation-state is a threat actor that is sponsored by a government or a political entity to conduct cyberattacks against other countries or organizations. Nation-states have large financial resources, advanced technical skills, and strategic objectives that may target critical systems such as military, energy, or infrastructure. Nation-states are often motivated by espionage, sabotage, or warfare.

• Question 263:

  Which of the following would help ensure a security analyst is able to accurately measure the overall risk to an organization when a new vulnerability is disclosed?

  A. A full inventory of all hardware and software
  B. Documentation of system classifications
  C. A list of system owners and their departments
  D. Third-party risk assessment documentation
  A. A full inventory of all hardware and software

  ---

  Explanation

  A full inventory of all hardware and software is essential for measuring the overall risk to an organization when a new vulnerability is disclosed, because it allows the security analyst to identify which systems are affected by the vulnerability and prioritize the remediation efforts. Without a full inventory, the security analyst may miss some vulnerable systems or waste time and resources on irrelevant ones. Documentation of system classifications, a list of system owners and their departments, and third-party risk assessment documentation are all useful for risk management, but they are not sufficient to measure the impact of a new vulnerability.

• Question 264:

  A Chief Information Security Officer wants to monitor the company's servers for SQLi attacks and allow for comprehensive investigations if an attack occurs. The company uses SSL decryption to allow traffic monitoring.

  Which of the following strategies would best accomplish this goal?

  A. Logging all NetFlow traffic into a SIEM
  B. Deploying network traffic sensors on the same subnet as the servers
  C. Logging endpoint and OS-specific security logs
  D. Enabling full packet capture for traffic entering and exiting the servers
  D. Enabling full packet capture for traffic entering and exiting the servers

  ---

  Explanation

  Full packet capture is a technique that records all network traffic passing through a device, such as a router or firewall. It allows for detailed analysis and investigation of network events, such as SQLi attacks, by providing the complete content and context of the packets. Full packet capture can help identify the source, destination, payload, and timing of an SQLi attack, as well as the impact on the server and database. Logging NetFlow traffic, network traffic sensors, and endpoint and OS-specific security logs can provide some information about network activity, but they do not capture the full content of the packets, which may limit the scope and depth of the investigation.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 372-373

• Question 265:

  Which of the following is a common source of unintentional corporate credential leakage in cloud environments?

  A. Code repositories
  B. Dark web
  C. Threat feeds
  D. State actors
  E. Vulnerability databases
  A. Code repositories

  ---

  Explanation

  Code repositories are a common source of unintentional corporate credential leakage, especially in cloud environments. Developers may accidentally commit and push sensitive information, such as API keys, passwords, and other credentials, to public or poorly secured repositories. These credentials can then be accessed by unauthorized users, leading to security breaches. Ensuring that repositories are properly secured and that sensitive data is never committed is critical for protecting against this type of leakage.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 03 Security Architecture. CompTIA Security+ SY0-601 Study Guide: Chapter on Threats and Vulnerability Management.

• Question 266:

  A bank insists all of its vendors must prevent data loss on stolen laptops.

  Which of the following strategies is the bank requiring?

  A. Encryption at rest
  B. Masking
  C. Data classification
  D. Permission restrictions
  A. Encryption at rest

  ---

  Explanation

  Encryption at rest is a strategy that protects data stored on a device, such as a laptop, by converting it into an unreadable format that can only be accessed with a decryption key or password. Encryption at rest can prevent data loss on stolen laptops by preventing unauthorized access to the data, even if the device is physically compromised. Encryption at rest can also help comply with data privacy regulations and standards that require data protection. Masking, data classification, and permission restrictions are other strategies that can help protect data, but they may not be sufficient or applicable for data stored on laptops. Masking is a technique that obscures sensitive data elements, such as credit card numbers, with random characters or symbols, but it is usually used for data in transit or in use, not at rest. Data classification is a process that assigns labels to data based on its sensitivity and business impact, but it does not protect the data itself. Permission restrictions are rules that define who can access, modify, or delete data, but they may not prevent unauthorized access if the laptop is stolen and the security controls are bypassed.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 17-18, 372-373

• Question 267:

  A multinational bank hosts several servers in its data center. These servers run a business-critical application used by customers to access their account information.

  Which of the following should the bank use to ensure accessibility during peak usage times?

  A. Load balancer
  B. Cloud backups
  C. Geographic dispersal
  D. Disk multipathing
  A. Load balancer

• Question 268:

  Which of the following activities should a systems administrator perform to quarantine a potentially infected system?

  A. Move the device into an air-gapped environment.
  B. Disable remote log-in through Group Policy.
  C. Convert the device into a sandbox.
  D. Remote wipe the device using the MDM platform.
  A. Move the device into an air-gapped environment.

  ---

  Explanation

  Quarantining a potentially infected system by placing it into an air-gapped environment physically disconnects it from the network. This prevents the spread of malware while maintaining the integrity of forensic evidence.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 4: Security Operations, Section:"Incident Response and Containment".

• Question 269:

  An employee receives a text message that appears to have been sent by the payroll department and is asking for credential verification.

  Which of the following social engineering techniques are being attempted? (Choose two.)

  A. Typosquatting
  B. Phishing
  C. Impersonation
  D. Vishing
  E. Smishing
  F. Misinformation
  C. Impersonation
  E. Smishing

  ---

  Explanation

  In this scenario, where an employee receives a text message appearing to be from the payroll department asking for credential verification, the following social engineering techniques are being attempted: Impersonation

  The attacker is pretending to be a trusted entity (the payroll department) to gain the employee's trust and obtain their credentials.

  Smishing

  Smishing (SMS phishing) involves sending fraudulent text messages to trick individuals into revealing personal information, such as credentials, by clicking on a link or responding to the message.

• Question 270:

  An organization issued new laptops to all employees and wants to provide web filtering both in and out of the office without configuring additional access to the network.

  Which of the following types of web filtering should a systems administrator configure?

  A. Agent-based
  B. Centralized proxy
  C. URL scanning
  D. Content categorization
  A. Agent-based

  ---

  Explanation

  An agent-based web filtering solution installs a software agent directly on the laptops. This approach allows the filtering to work regardless of the device's location (in or out of the office) without requiring additional network configuration. The agent enforces web filtering policies locally on each laptop, ensuring consistent protection across various network environments.