CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 271:

  A user is attempting to patch a critical system, but the patch fails to transfer.

  Which of the following access controls is most likely inhibiting the transfer?

  A. Attribute-based
  B. Time of day
  C. Role-based
  D. Least privilege
  D. Least privilege

  ---

  Explanation

  The least privilege principle states that users and processes should only have the minimum level of access required to perform their tasks. This helps to prevent unauthorized or unnecessary actions that could compromise security. In this case, the patch transfer might be failing because the user or process does not have the appropriate permissions to access the critical system or the network resources needed for the transfer. Applying the least privilege principle can help to avoid this issue by granting the user or process the necessary access rights for the patching activity.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page

• Question 272:

  Which of the following is used to add extra complexity before using a one-way data transformation algorithm?

  A. Key stretching
  B. Data masking
  C. Steganography
  D. Salting
  D. Salting

  ---

  Explanation

  Salting is the process of adding extra random data to a password or other data before applying a one-way data transformation algorithm, such as a hash function. Salting increases the complexity and randomness of the input data, making it harder for attackers to guess or crack the original data using precomputed tables or brute force methods. Salting also helps prevent identical passwords from producing identical hash values, which could reveal the passwords to attackers who have access to the hashed data. Salting is commonly used to protect passwords stored in databases or transmitted over networks.

• Question 273:

  An organization is struggling with scaling issues on its VPN concentrator and internet circuit due to remote work. The organization is looking for a software solution that will allow it to reduce traffic on the VPN and internet circuit, while still providing encrypted tunnel access to the data center and monitoring of remote employee internet traffic.

  Which of the following will help achieve these objectives?

  A. Deploying a SASE solution to remote employees
  B. Building a load-balanced VPN solution with redundant internet
  C. Purchasing a low-cost SD-WAN solution for VPN traffic
  D. Using a cloud provider to create additional VPN concentrators
  A. Deploying a SASE solution to remote employees

  ---

  Explanation

  SASE stands for Secure Access Service Edge. It is a cloud-based service that combines network and security functions into a single integrated solution. SASE can help reduce traffic on the VPN and internet circuit by providing secure and optimized access to the data center and cloud applications for remote employees. SASE can also monitor and enforce security policies on the remote employee internet traffic, regardless of their location or device. SASE can offer benefits such as lower costs, improved performance, scalability, and flexibility compared to traditional VPN solutions.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 457-458

• Question 274:

  A company that is located in an area prone to hurricanes is developing a disaster recovery plan and looking at site considerations that allow the company to immediately continue operations.

  Which of the following is the best type of site for this company?

  A. Cold
  B. Tertiary
  C. Warm
  D. Hot
  D. Hot

  ---

  Explanation

  For a company located in an area prone to hurricanes and needing to immediately continue operations, the best type of site is a hot site. A hot site is a fully operational offsite data center that is equipped with hardware, software, and network connectivity and is ready to take over operations with minimal downtime. Hot site: Fully operational and can take over business operations almost immediately after a disaster. Cold site: A basic site with infrastructure in place but without hardware or data, requiring significant time to become operational. Tertiary site: Not a standard term in disaster recovery; it usually refers to an additional backup location but lacks the specifics of readiness. Warm site: Equipped with hardware and connectivity but requires some time and effort to become fully operational, not as immediate as a hot site.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 3.4 - Importance of resilience and recovery in security architecture (Site considerations: Hot site).

• Question 275:

  An accounting intern receives an invoice via email from the Chief Executive Officer (CEO). In the email, the CEO demands the immediate release of funds to the bank account that is listed.

  Which of the following principles best describes why this attack might be successful?

  A. Authority
  B. Scarcity
  C. Consensus
  D. Familiarity
  A. Authority

  ---

  Explanation

  The attack works by exploiting authority. The message appears to come from the CEO, a high-ranking executive whose instructions are more likely to be obeyed without verification. Although the email also creates urgency, the primary social engineering principle being used is authority.

• Question 276:

  A hosting provider needs to prove that its security controls have been in place over the last six months and have sufficiently protected customer data.

  Which of the following would provide the best proof that the hosting provider has met the requirements?

  A. NIST CSF
  B. SOC 2 Type 2 report
  C. CIS Top 20 compliance reports
  D. Vulnerability report
  B. SOC 2 Type 2 report

• Question 277:

  A security engineer needs to analyze the implications of moving proprietary company data from a local server to a public cloud storage service.

  Which of the following actions should the engineer take first?

  A. Create an architecture diagram of cloud storage solutions.
  B. Migrate sample data to the cloud to run security tests.
  C. Agree on data classification labels with stakeholders.
  D. Make a backup of the data on cloud-neutral storage.
  C. Agree on data classification labels with stakeholders.

  ---

  Explanation

  The correct answer is C. Agree on data classification labels with stakeholders.

  Before moving proprietary company data to a public cloud storage service, the organization must first determine how the data should be classified. Data classification identifies the sensitivity, ownership, regulatory requirements, and handling requirements of the data. Examples of classification labels may include public, internal, confidential, restricted, private, regulated, or proprietary.

  This aligns with CompTIA Security+ SY0-701 concepts related to protecting data, cloud security considerations, and governance. A security engineer cannot properly evaluate cloud risks, encryption needs, access controls, retention rules, compliance requirements, or contractual protections until the organization agrees on what type of data is being moved and how sensitive it is.

  Why the other options are incorrect:

  A. Create an architecture diagram of cloud storage solutions. This is useful later, but it should not be the first step. The architecture depends on the data classification and security requirements.

  B. Migrate sample data to the cloud to run security tests. This is premature and risky. Data should not be moved to the cloud before classification, risk analysis, access control requirements, and compliance requirements are understood.

  D. Make a backup of the data on cloud-neutral storage. Backups are important, but they do not address the first security concern: understanding the sensitivity and handling requirements of the proprietary data. Therefore, the best first action is to agree on data classification labels with stakeholders.

• Question 278:

  An employee from the accounting department logs in to a website. A desktop application automatically downloads on the employee's computer.

  Which of the following has occurred?

  A. XSS
  B. Watering hole
  C. Typosquatting
  D. Buffer overflow
  B. Watering hole

• Question 279:

  Which of the following activities is included in the post-incident review phase?

  A. Determining the root cause of the incident
  B. Developing steps to mitigate the risks of the incident
  C. Validating the accuracy of the evidence collected during the investigation
  D. Reestablishing the compromised system's configuration and settings
  A. Determining the root cause of the incident

  ---

  Explanation

  During the post-incident review, the team analyzes the incident to understand its root cause. This phase is focused on learning from the incident, identifying vulnerabilities, and implementing improvements to prevent similar future incidents.

• Question 280:

  An administrator needs to perform server hardening before deployment.

  Which of the following steps should the administrator take?

  (Select two).

  A. Disable default accounts.
  B. Add the server to the asset inventory.
  C. Remove unnecessary services.
  D. Document default passwords.
  E. Send server logs to the SIEM.
  F. Join the server to the corporate domain.
  A. Disable default accounts.
  C. Remove unnecessary services.

  ---

  Explanation

  To perform server hardening before deployment, the administrator should disable default accounts and remove unnecessary services. These steps are crucial to reducing the attack surface and enhancing the security of the server. Disable default accounts: Default accounts often come with default credentials that are well-known and can be exploited by attackers. Disabling these accounts helps prevent unauthorized access. Remove unnecessary services: Unnecessary services can introduce vulnerabilities and be exploited by attackers. Removing them reduces the number of potential attack vectors.

  Add the server to the asset inventory: Important for tracking and management but not directly related to hardening.

  Document default passwords: Documentation is useful, but changing or disabling default passwords is the hardening step.

  Send server logs to the SIEM: Useful for monitoring and analysis but not a direct hardening step.

  Join the server to the corporate domain: Part of integration into the network but not specific to hardening.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 1.1 - Compare and contrast various types of security controls (Server hardening).