CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 301:

  A security analyst is reviewing the source code of an application in order to identify misconfigurations and vulnerabilities.

  Which of the following kinds of analysis best describes this review?

  A. Dynamic
  B. Static
  C. Gap
  D. Impact
  B. Static

  ---

  Explanation

  Reviewing the source code of an application to identify misconfigurations and vulnerabilities is best described as static analysis. Static analysis involves examining the code without executing the program. It focuses on finding potential security issues, coding errors, and vulnerabilities by analyzing the code itself. Static analysis: Analyzes the source code or compiled code for vulnerabilities without executing the program.

  Dynamic analysis: Involves testing and evaluating the program while it is running to identify vulnerabilities.

  Gap analysis: Identifies differences between the current state and desired state, often used for compliance or process improvement. Impact analysis: Assesses the potential effects of changes in a system or process.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 4.3 - Explain various activities associated with vulnerability management (Static analysis).

• Question 302:

  Which of the following risk analysis attributes measures the chance that a vulnerability will be exploited?

  A. Exposure factor
  B. Impact
  C. Severity
  D. Likelihood
  D. Likelihood

  ---

  Explanation

  The best answer is D. Likelihood. In risk analysis, likelihood refers to the probability or chance that a threat will exploit a vulnerability. This is a core concept in risk management because risk is commonly evaluated by considering both:

  the likelihood of an event occurring, and the impact if that event occurs. Why the other options are incorrect:

  A. Exposure factorExposure factor is the percentage of asset loss that would occur if a threat event happened. It relates to the extent of damage, not the probability of exploitation.

  B. ImpactImpact refers to the magnitude of harm or damage if the vulnerability is exploited. It does not measure the chance of occurrence.

  C. SeveritySeverity is a general measure of how serious a vulnerability or issue is, often combining multiple considerations, but it is not specifically the attribute that measures the chance of exploitation. From a Security+ viewpoint, when the question asks about the chance that a vulnerability will be exploited, the correct risk attribute is likelihood.

• Question 303:

  Which of the following are the best for hardening end-user devices? (Selecttwo)

  A. Full disk encryption
  B. Group-level permissions
  C. Account lockout
  D. Endpoint protection
  E. Proxy server
  F. Segmentation
  A. Full disk encryption
  D. Endpoint protection

• Question 304:

  Which of the following is the best way to prevent an unauthorized user from plugging a laptop into an employee's phone network port and then using tools to scan for database servers?

  A. MAC filtering
  B. Segmentation
  C. Certification
  D. Isolation
  A. MAC filtering

  ---

  Explanation

  MAC filtering allows network administrators to control device access by specifying allowed MAC addresses. This prevents unauthorized devices, such as a laptop plugged into a network port, from gaining access.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 2: Threats and Vulnerabilities, Section:"Network Access Control Methods".

• Question 305:

  Which of the following can be used to mitigate attacks from high-risk regions?

  A. Obfuscation
  B. Data sovereignty
  C. IP geolocation
  D. Encryption
  C. IP geolocation

• Question 306:

  Prior to implementing a design change, the change must go through multiple steps to ensure that it does not cause any security issues.

  Which of the following is most likely to be one of those steps?

  A. Board review
  B. Service restart
  C. Backout planning
  D. Maintenance
  C. Backout planning

  ---

  Explanation

  Before implementing a design change, backout planning is crucial to ensure the organization can quickly revert to a stable state if the change causes issues, including security vulnerabilities. Backout planning involves identifying the steps and resources needed to undo the change safely and efficiently, minimizing disruptions and maintaining security.

• Question 307:

  A technician is deploying a new security camera.

  Which of the following should the technician do?

  A. Configure the correct VLAN.
  B. Perform a vulnerability scan.
  C. Disable unnecessary ports.
  D. Conduct a site survey.
  D. Conduct a site survey.

• Question 308:

  An auditor discovered multiple insecure ports on some servers. Other servers were found to have legacy protocols enabled.

  Which of the following tools did the auditor use to discover these issues?

  A. Nessus
  B. curl
  C. Wireshark
  D. netcat
  A. Nessus

• Question 309:

  The physical security team at a company receives reports that employees are not displaying their badges. The team also observes employees tailgating at controlled entrances.

  Which of the following topics will the security team most likely emphasize in upcoming security training?

  A. Social engineering
  B. Situational awareness
  C. Phishing
  D. Acceptable use policy
  A. Social engineering

  ---

  Explanation

  Social engineering attacks exploit human behavior to bypass security controls. Tailgating (following an authorized person into a restricted area without authentication) and badge non-compliance are common tactics used by attackers to gain unauthorized physical access. Training employees to recognize and prevent social engineering tactics can reduce these risks.

  Situational awareness (B) relates to general security awareness but is not specific to social engineering attacks.

  Phishing (C) targets victims via email or online deception, not physical access.

  Acceptable use policy (D) defines how employees should use IT resources but does not address physical security risks.

  References:

  CompTIA Security+ SY0-701 Official Study Guide, General Security Concepts domain.

• Question 310:

  A security analyst scans a company's public network and discovers a host is running a remote desktop that can be used to access the production network.

  Which of the following changes should the security analyst recommend?

  A. Changing the remote desktop port to a non-standard number
  B. Setting up a VPN and placing the jump server inside the firewall
  C. Using a proxy for web connections from the remote desktop server
  D. Connecting the remote server to the domain and increasing the password length
  B. Setting up a VPN and placing the jump server inside the firewall

  ---

  Explanation

  A VPN is a virtual private network that creates a secure tunnel between two or more devices over a public network. A VPN can encrypt and authenticate the data, as well as hide the IP addresses and locations of the devices. A jump server is a server that acts as an intermediary between a user and a target server, such as a production server. A jump server can provide an additional layer of security and access control, as well as logging and auditing capabilities. A firewall is a device or software that filters and blocks unwanted network traffic based on predefined rules. A firewall can protect the internal network from external threats and limit the exposure of sensitive services and ports. A security analyst should recommend setting up a VPN and placing the jump server inside the firewall to improve the security of the remote desktop access to the production network. This way, the remote desktop service will not be exposed to the public network, and only authorized users with VPN credentials can access the jump server and then the production server.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, Chapter 8: Secure Protocols and Services, page 382-383 1

  Chapter 9: Network Security, page 441-442