CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 281:

  Which of the following is the best security reason for closing service ports that are not needed?

  A. To mitigate risks associated with unencrypted traffic
  B. To eliminate false positives from a vulnerability scan
  C. To reduce a system's attack surface
  D. To improve a system's resource utilization
  C. To reduce a system's attack surface

  ---

  Explanation

  Closing unnecessary service ports is a critical security measure because it helps to reduce the system's attack surface. Each open port represents a potential entry point for attackers, and if a service is not needed, keeping the associated port open unnecessarily increases the risk of exploitation. By closing unused ports, you minimize the number of possible attack vectors, making it harder for attackers to compromise the system.

• Question 282:

  A company wants to verify that the software the company is deploying came from the vendor the company purchased the software from.

  Which of the following is the best way for the company to confirm this information?

  A. Validate the code signature.
  B. Execute the code in a sandbox.
  C. Search the executable for ASCII strings.
  D. Generate a hash of the files.
  A. Validate the code signature.

  ---

  Explanation

  Validating the code signature is the best way to verify software authenticity, as it ensures that the software has not been tampered with and that it comes from a verified source. Code signatures are digital signatures applied by the software vendor, and validating them confirms the software's integrity and origin.

  References:

  CompTIA Security+ SY0-701 course content and official CompTIA study resources.

• Question 283:

  Which of the following technologies must be used in an organization that intends to automate infrastructure deployment?

  A. IaC
  B. IaaS
  C. IoC
  D. IoT
  A. IaC

  ---

  Explanation

  Infrastructure as Code (IaC) is the technology required for automating infrastructure deployment. IaC allows organizations to define and deploy servers, networks, containers, and cloud resources using machine-readable configuration files rather than manual configuration. This leads to faster deployment, consistent environments, repeatability, version control, and lower human error.

  CompTIA Security+ SY0-701 highlights IaC as a foundational component of DevOps and modern cloud operations. It supports automated provisioning through tools such as Terraform, Ansible, CloudFormation, and Puppet. IaC also enhances security by enabling automated compliance checks and standardized hardened configurations.

  IaaS (B) is a cloud service model, not an automation mechanism. IoC (C) refers to Indicators of Compromise used in threat intelligence. IoT (D) refers to Internet-connected devices and is unrelated to infrastructure deployment.

  Therefore, IaC is the required technology for automated, repeatable, secure infrastructure deployments.

• Question 284:

  A security analyst reviews firewall configurations and finds that firewalls are configured to fail-open mode in the event of a crash.

  Which of the following describes the security risk associated with this configuration?

  A. There may be increased latency during failover.
  B. Authentication tokens may be invalidated during an outage.
  C. Traffic will bypass inspection during a failure.
  D. All encrypted traffic will be blocked during an outage.
  C. Traffic will bypass inspection during a failure.

  ---

  Explanation

  The best answer is C. Traffic will bypass inspection during a failure.

  A firewall configured to fail open will allow traffic to continue flowing if the device crashes or fails. This preserves availability, but it creates a security risk because traffic may pass through without being inspected or filtered.

  That means malicious traffic, unauthorized connections, or prohibited traffic could traverse the network during the outage.

  Why the other options are incorrect:

  A. There may be increased latency during failover.This is not the main security risk associated with fail-open mode.

  B. Authentication tokens may be invalidated during an outage.This is unrelated to firewall fail-open behavior.

  D. All encrypted traffic will be blocked during an outage.Fail-open does the opposite of blocking traffic; it allows traffic to pass through. From a SY0-701 perspective, fail-open prioritizes availability, but the tradeoff is that security inspection may be bypassed, making C the correct answer.

• Question 285:

  A systems administrator receives an alert that a company's internal file server is very slow and is only working intermittently. The systems administrator reviews the server management software and finds the following information about the server:

  

  Which of the following indicators most likely triggered this alert?

  A. Concurrent session usage
  B. Network saturation
  C. Account lockout
  D. Resource consumption
  D. Resource consumption

  ---

  Explanation

  The attached information shows that the CPU usage is at 99.6% and memory usage is at 97%. These high levels of resource consumption would lead to slow performance and intermittent issues, triggering an alert due to the server's limited ability to handle additional requests.

• Question 286:

  A security practitioner completes a vulnerability assessment on a company's network and finds several vulnerabilities, which the operations team remediates.

  Which of the following should be done next?

  A. Conduct an audit.
  B. Initiate a penetration test.
  C. Rescan the network.
  D. Submit a report.
  C. Rescan the network.

  ---

  Explanation

  After completing a vulnerability assessment and remediating the identified vulnerabilities, the next step is to rescan the network to verify that the vulnerabilities have been successfully fixed and no new vulnerabilities have been introduced. A vulnerability assessment is a process of identifying and evaluating the weaknesses and exposures in a network, system, or application that could be exploited by attackers. A vulnerability assessment typically involves using automated tools, such as scanners, to scan the network and generate a report of the findings. The report may include information such as the severity, impact, and remediation of the vulnerabilities. The operations team is responsible for applying the appropriate patches, updates, or configurations to address the vulnerabilities and reduce the risk to the network. A rescan is necessary to confirm that the remediation actions have been effective and that the network is secure. Conducting an audit, initiating a penetration test, or submitting a report are not the next steps after completing a vulnerability assessment and remediating the vulnerabilities. An audit is a process of reviewing and verifying the compliance of the network with the established policies, standards, and regulations. An audit may be performed by internal or external auditors, and it may use the results of the vulnerability assessment as part of the evidence. However, an audit is not a mandatory step after a vulnerability assessment, and it does not validate the effectiveness of the remediation actions. A penetration test is a process of simulating a real-world attack on the network to test the security defenses and identify any gaps or weaknesses. A penetration test may use the results of the vulnerability assessment as a starting point, but it goes beyond scanning and involves exploiting the vulnerabilities to gain access or cause damage. A penetration test may be performed after a vulnerability assessment, but only with the proper authorization, scope, and rules of engagement. A penetration test is not a substitute for a rescan, as it does not verify that the vulnerabilities have been fixed. Submitting a report is a step that is done after the vulnerability assessment, but before the remediation. The report is a document that summarizes the findings and recommendations of the vulnerability assessment, and it is used to communicate the results to the stakeholders and the operations team. The report may also include a follow-up plan and a timeline for the remediation actions. However, submitting a report is not the final step after the remediation, as it does not confirm that the network is secure.

  References:

  CompTIA Security+ SY0-701 Certification Study Guide, page 372- 375

  Professor Messer's CompTIA SY0-701 Security+ Training Course, video 4.1 - Vulnerability Scanning, 0:00 - 8:00.

• Question 287:

  An organization would like to give remote workers the ability to use applications hosted inside the corporate network Users will be allowed to use their personal computers or they will be provided organization assets Either way no data or applications will be installed locally on any user systems

  Which of the following mobile solutions would accomplish these goals?

  A. VDI
  B. MDM
  C. COPE
  D. UTM
  A. VDI

  ---

  Explanation

  MDM would require something to be installed. VDI, virtual desktop infrastructure, would allow employees to use run apps on the company network without installing locally.

• Question 288:

  An enterprise is working with a third party and needs to allow access between the internal networks of both parties for a secure file migration. The solution needs to ensure encryption is applied to all traffic that is traversing the networks.

  Which of the following solutions should most likely be implemented?

  A. EAP
  B. IPSec
  C. SD-WAN
  D. TLS
  B. IPSec

• Question 289:

  In a rush to meet an end-of-year business goal, the IT department was told to implement a new business application. The security engineer reviews the attributes of the application and decides the time needed to perform due diligence is insufficient from a cybersecurity perspective.

  Which of the following best describes the security engineer's response?

  A. Risk tolerance
  B. Risk acceptance
  C. Risk importance
  D. Risk appetite
  D. Risk appetite

  ---

  Explanation

  Risk appetite refers to the level of risk that an organization is willing to accept in order to achieve its objectives. In this scenario, the security engineer is concerned that the timeframe for implementing a new application does not allow for sufficient cybersecurity due diligence. This reflects a situation where the organization's risk appetite might be too high if it proceeds without the necessary security checks.

  References:

  CompTIA Security+ SY0-701 study materials, particularly in the domain of risk management and understanding organizational risk appetite.

• Question 290:

  Which of the following hardening techniques must be applied on a container image before deploying it to a production environment? (Select two).

  A. Remove default applications.
  B. Install a NIPS.
  C. Disable Telnet.
  D. Reconfigure the DNS
  E. Add an SFTP server.
  F. Delete the public certificate.
  A. Remove default applications.
  C. Disable Telnet.