CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 21:

  Which of the following actions is best performed by ticketing automation to ensure that incidents receive the correct level of attention and response?

  A. Notification
  B. Creation
  C. Closure
  D. Escalation
  D. Escalation

  ---

  Explanation

  The key phrase is "ensure that incidents receive the correct level of attention and response." In operations, that aligns most directly with escalation-moving high-severity or time-sensitive incidents to the right people /teams quickly and consistently, according to predefined criteria (severity, impacted systems, threat intel enrichment, SLA timers). The Study Guide lists ticketing and escalation explicitly as automation use cases: "Ticket creation: Automation can streamline the ticketing process, enabling immediate creation and routing of issues to the right teams." and, crucially for this question, "Escalation: In case of a major incident, scripts can automate the escalation process, alerting key personnel quickly."

  While automation can also handle notification and ticket creation, escalation is the control that most directly enforces that the incident gets the proper priority and response path (for example: paging on-call, invoking the IR lead, opening a bridge, and applying "major incident" workflows). Closure is typically less suitable because it often requires validation and human judgment to ensure containment, eradication, and recovery steps are complete.

  References:

  Automation use cases for ticketing, including escalation for major incidents.

• Question 22:

  A security analyst needs to improve the company's authentication policy following a password audit.

  Which of the following should be included in the policy? (Choose two.)

  A. Length
  B. Complexity
  C. Least privilege
  D. Something you have
  E. Security keys
  F. Biometrics
  A. Length
  B. Complexity

• Question 23:

  In which of the following will unencrypted network traffic most likely be found?

  A. SDN
  B. IoT
  C. VPN
  D. SCADA
  D. SCADA

  ---

  Explanation

  SCADA (Supervisory Control and Data Acquisition) systems often use legacy protocols that do not include encryption. As a result, unencrypted network traffic is more likely to be found in SCADA environments, making them vulnerable to interception and attacks unless additional security measures are implemented.

• Question 24:

  A security analyst is prioritizing vulnerability scan results using a risk-based approach.

  Which of the following is the most efficient resource for the analyst to use?

  A. Business impact analysis
  B. Common Vulnerability Scoring System
  C. Risk register
  D. Exposure factor
  B. Common Vulnerability Scoring System

  ---

  Explanation

  The Common Vulnerability Scoring System (CVSS) is a standardized framework for assessing the severity of vulnerabilities. It provides a numerical score (0-10) based on factors such as exploitability, impact, and complexity, helping security analysts prioritize remediation efforts based on risk. Business impact analysis (A) helps identify critical business functions but does not specifically prioritize vulnerabilities.

  Risk register (C) tracks identified risks but does not classify vulnerabilities.

  Exposure factor (D) is used in quantitative risk assessment but is not an industry standard for vulnerability prioritization.

  References:

  CompTIA Security+ SY0-701 Official Study Guide, Risk Management domain.

• Question 25:

  The Chief Information Security Officer of an organization needs to ensure recovery from ransomware would likely occur within the organization's agreed-upon RPOs end RTOs.

  Which of the following backup scenarios would best ensure recovery?

  A. Hourly differential backups stored on a local SAN array
  B. Dally full backups stored on premises in magnetic offline media
  C. Daly differential backups maintained by a third-party cloud provider
  D. Weekly full backups with daily incremental stored on a NAS drive
  D. Weekly full backups with daily incremental stored on a NAS drive

  ---

  Explanation

  A backup strategy that combines weekly full backups with daily incremental backups stored on a NAS (Network Attached Storage) drive is likely to meet an organization's Recovery Point Objectives (RPOs) and Recovery Time Objectives (RTOs). This approach ensures that recent data is regularly backed up and that recovery can be done efficiently, without significant data loss or lengthy downtime.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 05 Security Program Management and Oversight.

  CompTIA Security+ SY0-601 Study Guide: Chapter on Disaster Recovery and Backup Strategies.

• Question 26:

  A store is setting up wireless access for their employees. Management wants to limit the number of access points while ensuring all areas of the store are covered.

  Which of the following tools will help management determine the number of access points needed?

  A. Signal locator
  B. WPA3
  C. Heat map
  D. Site survey
  D. Site survey

  ---

  Explanation

  A site survey is the formal assessment used to determine the optimal number and placement of wireless access points (APs). According to Security+ SY0-701, wireless site surveys evaluate factors such as building layout, RF interference, wall material density, antenna propagation, and signal overlap. The goal is to ensure full wireless coverage while minimizing the number of APs needed, maximizing performance, and reducing dead zones.

  During a site survey, technicians analyze: Signal strength patterns Interference sources (microwaves, metal shelving, wiring, etc.) Required coverage zones Capacity needs (number of users, devices)

  Although heat maps (C) visually represent wireless signal distribution, they are a result of a site survey, not the process itself. WPA3 (B) is a security protocol unrelated to determining coverage. A signal locator (A) is not an enterprise-grade planning tool.

  Therefore, the correct answer is D: Site survey.

• Question 27:

  A penetration tester finds an unused Ethernet port during an on-site penetration test. Upon plugging a device into the unused port, the penetration tester notices that the machine is assigned an IP address, allowing the tester to enumerate the local network.

  Which of the following should an administrator implement in order to prevent this situation from happening in the future?

  A. Port security
  B. Transport Layer Security
  C. Proxy server
  D. Security zones
  A. Port security

  ---

  Explanation

  Port security is a network security feature that restricts input to an Ethernet port based on MAC addresses, which helps prevent unauthorized devices from gaining access to the network. By implementing port security, administrators can control which devices are allowed to connect to specific network ports, preventing unauthorized access through unused or untrusted ports. This measure would have prevented the penetration tester from gaining access to the local network by plugging into an unused port.

• Question 28:

  A vendor salesperson is a personal friend of a company's Chief Financial Officer (CFO). The company recently made a large purchase from the vendor, which was directly approved by the CFO.

  Which of the following best describes this situation?

  A. Rules of engagement
  B. Conflict of interest
  C. Due diligence
  D. Contractual impact
  E. Reputational damage
  B. Conflict of interest

• Question 29:

  A security analyst locates a potentially malicious video file on a server and needs to identify both the creation date and the file's creator.

  Which of the following actions would most likely give the security analyst the information required?

  A. Obtain the file's SHA-256 hash.
  B. Use hexdump on the file's contents.
  C. Check endpoint logs.
  D. Query the file's metadata.
  D. Query the file's metadata.

  ---

  Explanation

  Metadata is data that describes other data, such as its format, origin, creation date, author, and other attributes. Video files, like other types of files, can contain metadata that can provide useful information for forensic analysis. For example, metadata can reveal the camera model, location, date and time, and software used to create or edit the video file. To query the file's metadata, a security analyst can use various tools, such as MediaInfo, ffprobe or hexdump, to extract and display the metadata from the video file. By querying the file's metadata, the security analyst can most likely identify both the creation date and the file's creator, as well as other relevant information. Obtaining the file's SHA-256 hash, checking endpoint logs, or using hexdump on the file's contents are other possible actions, but they are not the most appropriate to answer the question. The file's SHA-256 hash is a cryptographic value that can be used to verify the integrity or uniqueness of the file, but it does not reveal any information about the file's creation date or creator. Checking endpoint logs can provide some clues about the file's origin or activity, but it may not be reliable or accurate, especially if the logs are tampered with or incomplete. Using hexdump on the file's contents can show the raw binary data of the file, but it may not be easy or feasible to interpret the metadata from the hex output, especially if the file is large or encrypted.

  References:

  1: How do I get the meta-data of a video file?

  2: How to check if an mp4 file contains malware?

  3: [Hexdump - Wikipedia]

• Question 30:

  An administrator has configured a quarantine subnet for all guest devices that connect to the network.

  Which of the following would be best for the security team to perform before allowing access to corporate resources?

  A. Device ngerprinting
  B. Compliance attestation
  C. Penetration test
  D. Application vulnerability test
  B. Compliance attestation