CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 311:

  Which of the following best protects sensitive data in transit across a geographically dispersed Infrastructure?

  A. Encryption
  B. Masking
  C. Tokenization
  D. Obfuscation
  A. Encryption

• Question 312:

  An organization would like to store customer data on a separate part of the network that is not accessible to users on the main corporate network.

  Which of the following should the administrator use to accomplish this goal?

  A. Segmentation
  B. Isolation
  C. Patching
  D. Encryption
  A. Segmentation

  ---

  Explanation

  Segmentation is a network design technique that divides the network into smaller and isolated segments based on logical or physical boundaries. Segmentation can help improve network security by limiting the scope of an attack, reducing the attack surface, and enforcing access control policies. Segmentation can also enhance network performance, scalability, and manageability. To accomplish the goal of storing customer data on a separate part of the network, the administrator can use segmentation technologies such as subnetting, VLANs, firewalls, routers, or switches.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 308-309

• Question 313:

  An organization has a new regulatory requirement to implement corrective controls on a financial system.

  Which of the following is the most likely reason for the new requirement?

  A. To defend against insider threats altering banking details
  B. To ensure that errors are not passed to other systems
  C. To allow for business insurance to be purchased
  D. To prevent unauthorized changes to financial data
  B. To ensure that errors are not passed to other systems

• Question 314:

  A systems administrator uses a key to encrypt a message being sent to a peer in a different branch office. The peer then uses the same key to decrypt the message.

  Which of the following describes this example?

  A. Symmetric
  B. Asymmetric
  C. Hashing
  D. Salting
  A. Symmetric

• Question 315:

  A business is expanding to a new country and must protect customers from accidental disclosure of specific national identity information.

  Which of the following should the security engineer update to best meet business requirements?

  A. SIEM
  B. SCAP
  C. DLP
  D. WAF
  C. DLP

  ---

  Explanation

  The requirement is to prevent the accidental disclosure of national identity information-highly sensitive personal data. The best solution is DLP (Data Loss Prevention). DLP tools monitor, detect, and block unauthorized transmission or exposure of sensitive data across: Email Cloud storage Endpoints Networks Databases

  In Security+ SY0-701, DLP is specifically recommended for ensuring compliance with privacy regulations, including those related to national identifiers (e.g., Social Security numbers, national ID numbers).

  A SIEM (A) aggregates logs but does not prevent data leakage. SCAP (B) provides standardized security configuration assessments, unrelated to data protection. A WAF (D) helps protect web applications but does not prevent sensitive data exfiltration.

  Since the requirement focuses on preventing accidental disclosure, DLP is the only technology capable of detecting, labeling, blocking, and reporting attempts to move or expose sensitive national identity data.

  Therefore, the correct answer is C.

• Question 316:

  A systems administrator wants to use a technical solution to explicitly define file permissions for the entire team.

  Which of the following should the administrator implement?

  A. ACL
  B. Monitoring
  C. Isolation
  D. HIPS
  A. ACL

• Question 317:

  SIMULATION

  A systems administrator is configuring a site-to-site VPN between two branch offices. Some of the settings have already been configured correctly. The systems administrator has been provided the following requirements as part of completing the configuration:

  1. Most secure algorithms should be selected

  2. All traffic should be encrypted over the VPN

  3. A secret password will be used to authenticate the two VPN concentrators

  INSTRUCTIONS

  Click on the two VPN Concentrators to configure the appropriate settings.

  If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

  

  

  

  A. See the Explanation part for all the Solution
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the Explanation part for all the Solution

  ---

  Explanation

  VPN Concentrator 1 (Branch Office 1) Configuration:

  Phase 1:

  Peer IP address: 5.5.5.20 (IP of VPN Concentrator 2)

  Auth method: PSK (Pre-Shared Key)

  Negotiation mode: MAIN

  Encryption algorithm: AES256

  Hash algorithm: SHA256

  DH key group: 14

  Phase 2:

  Mode: Tunnel

  Protocol: ESP (Encapsulating Security Payload)

  Encryption algorithm: AES256

  Hash algorithm: SHA256

  Local network/mask: 192.168.1.0/24

  Remote network/mask: 192.168.2.0/24

  VPN Concentrator 2 (Branch Office 2) Configuration:

  Phase 1:

  Peer IP address: 5.5.5.10 (IP of VPN Concentrator 1)

  Auth method: PSK (Pre-Shared Key)

  Negotiation mode: MAIN

  Encryption algorithm: AES256

  Hash algorithm: SHA256

  DH key group: 14

  Phase 2:

  Mode: Tunnel

  Protocol: ESP (Encapsulating Security Payload)

  Encryption algorithm: AES256

  Hash algorithm: SHA256

  Local network/mask: 192.168.2.0/24

  Remote network/mask: 192.168.1.0/24

• Question 318:

  A penetration tester visits a client's website and downloads the site's content.

  Which of the following actions is the penetration tester performing?

  A. Unknown environment testing
  B. Vulnerability scan
  C. Due diligence
  D. Passive reconnaissance
  D. Passive reconnaissance

  ---

  Explanation

  The described activity-visiting a website and downloading publicly accessible content-is a classic example of passive reconnaissance. Passive reconnaissance involves gathering information about a target without interacting with its internal systems or generating traffic that could be detected by security monitoring tools.

  According to SY0-701, passive recon uses open-source intelligence (OSINT), such as: Public websites

  DNS records

  News articles

  Metadata

  Public document repositories

  The key distinction is that passive reconnaissance does not probe the system for vulnerabilities, nor does it send active scanning traffic.

  Vulnerability scanning (B) requires active probing. Unknown environment testing (A) applies to black-box testing but still may involve active scanning. Due diligence (C) refers to risk assessment or compliance reviews, not technical reconnaissance.

  Therefore, downloading the website's content is a non-intrusive information-gathering technique, perfectly matching passive reconnaissance as defined in the exam materials under Threats, Vulnerabilities, Attack Vectors, and Pen Testing Phases.

• Question 319:

  Which of the following receives logs from various devices and services, and then presents alerts?

  A. SIEM
  B. SCADA
  C. SNMP
  D. SCAP
  A. SIEM

• Question 320:

  During a routine audit, an analyst discovers that a department at a high school uses a simul-ation program that was not properly vetted before deployment.

  Which of the following threats is this an example of?

  A. Espionage
  B. Data exfiltration
  C. Shadow IT
  D. Zero-day
  C. Shadow IT