CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 311:

  The management team notices that new accounts that are set up manually do not always have correct access or permissions.

  Which of the following automation techniques should a systems administrator use to streamline account creation?

  A. Guard rail script
  B. Ticketing workflow
  C. Escalation script
  D. User provisioning script
  D. User provisioning script

  ---

  Explanation

  A user provisioning script is an automation technique that uses a predefined set of instructions or commands to create, modify, or delete user accounts and assign appropriate access or permissions. A user provisioning script can help to streamline account creation by reducing manual errors, ensuring consistency and compliance, and saving time and resources.

  The other options are not automation techniques that can streamline account creation: Guard rail script: This is a script that monitors and enforces the security policies and rules on a system or a network. A guard rail script can help to prevent unauthorized or malicious actions, such as changing security settings, accessing restricted resources, or installing unwanted software3. Ticketing workflow: This is a process that tracks and manages the requests, issues, or incidents that are reported by users or customers. A ticketing workflow can help to improve the communication, collaboration, and resolution of problems, but it does not automate the account creation process4. Escalation script: This is a script that triggers an alert or a notification when a certain condition or threshold is met or exceeded. An escalation script can help to inform the relevant parties or authorities of a critical situation, such as a security breach, a performance degradation, or a service outage.

  References:

  1: CompTIA Security+ SY0-701 Certification Study Guide, page 102

  2: User Provisioning -CompTIA Security+ SY0-701 -5.1, video by Professor Messer

  3: CompTIA Security+ SY0-701 Certification Study Guide, page 103

  4: CompTIA Security+ SY0-701 Certification Study Guide, page 104. : CompTIA Security+ SY0-701 Certification Study Guide, page 105.

• Question 312:

  The number of tickets the help desk has been receiving has increased recently due to numerous false-positive phishing reports.

  Which of the following would be best to help to reduce the false positives?

  A. Performing more phishing simulation campaigns
  B. Improving security awareness training
  C. Hiring more help desk staff
  D. Implementing an incident reporting web page
  B. Improving security awareness training

• Question 313:

  An engineer needs to find a solution that creates an added layer of security by preventing unauthorized access to internal company resources.

  Which of the following would be the best solution?

  A. RDP server
  B. Jump server
  C. Proxy server
  D. Hypervisor
  B. Jump server

  ---

  Explanation

  A jump server is a server that acts as an intermediary between a user and a target system. A jump server can provide an added layer of security by preventing unauthorized access to internal company resources. A user can connect to the jump server using a secure protocol, such as SSH, and then access the target system from the jump server. This way, the target system is isolated from the external network and only accessible through the jump server. A jump server can also enforce security policies, such as authentication, authorization, logging, and auditing, on the user's connection. A jump server is also known as a bastion host or a jump box.

  References:

  CompTIA Security+ Certification Exam Objectives, Domain 3.3: Given a scenario, implement secure network architecture concepts. CompTIA Security+ Study Guide (SY0-701), Chapter 3: Network Architecture and Design, page 101. Other Network Appliances -SY0-601 CompTIA Security+ : 3.3, Video 3:03. CompTIA Security+ Certification Exam SY0-701 Practice Test 1, Question2.

• Question 314:

  A security analyst attempts to start a company's database server. When the server starts, the analyst receives an error message indicating the database server did not pass authentication. After reviewing and testing the system, the analyst receives confirmation that the server has been compromised and that attackers have redirected all outgoing database traffic to a server under their control.

  Which of the following MITRE ATT&CK techniques did the attacker most likely use to redirect database traffic?

  A. Browser extension
  B. Process injection
  C. Valid accounts
  D. Escape to host
  C. Valid accounts

  ---

  Explanation

  The "Valid accounts" technique in the MITRE ATT&CK framework involves attackers using stolen or otherwise valid credentials to access and control systems. In this scenario, the attackers likely gained legitimate access to the database server using valid credentials and modified settings to redirect database traffic to their own server. This technique allows attackers to bypass certain security measures and perform actions as if they were authorized users, which aligns with the observed redirection of outgoing traffic.

• Question 315:

  A Chief Information Security Officer (CISO) wants to:

  1. Prevent employees from downloading malicious content.

  2. Establish controls based on departments and users.

  3. Map internet access for business applications to specific service accounts.

  4. Restrict content based on categorization.

  Which of the following should the CSO implement?

  A. Web application rewall
  B. Secure DNS server
  C. Jump server
  D. Next-generation rewall
  D. Next-generation rewall

• Question 316:

  A systems administrator deployed a monitoring solution that does not require installation on the endpoints that the solution is monitoring.

  Which of the following is described in this scenario?

  A. Agentless solution
  B. Client-based soon
  C. Open port
  D. File-based solution
  A. Agentless solution

• Question 317:

  Which of the following should a technician perform to verify the integrity of a file transferred from one device to another?

  A. Authentication
  B. Obfuscation
  C. Hashing
  D. Encryption
  C. Hashing

  ---

  Explanation

  Hashing is the process used to verify file integrity. When transferring a file between devices, a hash value (such as SHA-256) is generated before the transfer and then recomputed afterward. If the two hash values match, the file has not been altered, corrupted, or tampered with during transmission.

  Authentication (A) verifies identity, not file integrity. Obfuscation (B) hides meaning but does not detect modification. Encryption (D) protects confidentiality but does not guarantee integrity unless combined with hashing or digital signatures.

  CompTIA Security+ SY0-701 covers hashing under cryptographic functions used for integrity verification. Hash algorithms ensure that even a single byte change results in a completely different hash value (the avalanche effect). This makes hashing the standard method for verifying the integrity of transferred files, software downloads, backups, and system images.

• Question 318:

  An employee asks a security analyst to scan a suspicious email that contains a link to a file on a file-sharing site. The analyst determines that the file is safe after downloading and scanning the file with antivirus software. When the employee opens the file, their device is infected with ransomware.

  Which of the following steps should the analyst have taken?

  A. Review the file in a code editor.
  B. Monitor the file connections with netstat -ano.
  C. Execute the file in a sandbox.
  D. Retrieve the file hash and check with OSINT.
  C. Execute the file in a sandbox.

  ---

  Explanation

  The best answer is C. Execute the file in a sandbox. Antivirus alone may miss new, obfuscated, or modified malware, including ransomware. A sandbox provides an isolated environment where the file can be safely executed and observed for malicious behavior such as: file encryption activity process spawning registry changes network callbacks persistence attempts.

  Why the other options are incorrect:

  A. Review the file in a code editor.Many malicious files are compiled, packed, or obfuscated, so this is not a reliable analysis method.

  B. Monitor the file connections with netstat -ano.This only shows network connections and would not fully reveal ransomware behavior.

  D. Retrieve the file hash and check with OSINT.This helps only if the malware is already known. New variants may not match existing threat intelligence. From a SY0-701 perspective, dynamic analysis in a sandbox is the strongest step for safely identifying malicious file behavior.

• Question 319:

  After a security incident, a systems administrator asks the company to buy a NAC platform.

  Which of the following attack surfaces is the systems administrator trying to protect?

  A. Bluetooth
  B. Wired
  C. NFC
  D. SCADA
  B. Wired

  ---

  Explanation

  A NAC (network access control) platform is a technology that enforces security policies on devices that attempt to access a network. A NAC platform can verify the identity, role, and compliance of the devices, and grant or deny access based on predefined rules. A NAC platform can protect both wired and wireless networks, but in this scenario, the systems administrator is trying to protect the wired attack surface, which is the set of vulnerabilities that can be exploited through a physical connection to the network.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, Chapter 5, page 189

  CompTIA Security+ Certification Kit: Exam SY0-701, 7th Edition, Chapter 5, page 237.

• Question 320:

  Several users have opened tickets with the help desk. The help desk has reassigned the tickets to a secunty analyst for further review.

  The security analyst reviews the following metrics:

  

  Which of the following is MOST likely the result of the security analyst's review?

  A. The ISP is dropping outbound connections
  B. The user of the Sales-PC fell for a phishing attack
  C. Corporate PCs have been turned into a botnet
  D. An on-path attack is taking place between PCs and the router
  C. Corporate PCs have been turned into a botnet

  ---

  Explanation

  The metrics show a significant increase in both CPU utilization and network connections for all the listed PCs compared to their normal values. This could indicate that the machines are being used for unauthorized activities. The current CPU utilization of all the PCs is significantly higher than the normal CPU utilization. This indicates that the PCs are running a lot of processes, which is a common symptom of a botnet infection. The number of current network connections for all the PCs is also significantly higher than the normal number of network connections. This is another common symptom of a botnet infection. A botnet is a network of computers that have been infected with malware and controlled by a remote attacker. The attacker can use the botnet to carry out a variety of malicious activities, such as sending spam, launching DDoS attacks, or stealing data.