CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 331:

  A security administrator is addressing an issue with a legacy system that communicates data using an unencrypted protocol to transfer sensitive data to a third party. No software updates that use an encrypted protocol are available, so a compensating control is needed.

  Which of the following are the most appropriate for the administrator to suggest? (Select two.)

  A. Tokenization
  B. Cryptographic downgrade
  C. SSH tunneling
  D. Segmentation
  E. Patch installation
  F. Data masking
  C. SSH tunneling
  D. Segmentation

  ---

  Explanation

  SSH tunneling can secure the unencrypted protocol by encapsulating traffic in an encrypted tunnel. Segmentation isolates the legacy system, reducing the risk of unauthorized access.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 2: Threats, Section: "Compensating Controls for Legacy Systems".

• Question 332:

  A new employee logs in to the email system for the first time and notices a message from human resources about onboarding. The employee hovers over a few of the links within the email and discovers that the links do not correspond to links associated with the company.

  Which of the following attack vectors is most likely being used?

  A. Business email
  B. Social engineering
  C. Unsecured network
  D. Default credentials
  B. Social engineering

  ---

  Explanation

  The employee notices that the links in the email do not correspond to the company's official URLs, indicating that this is likely a social engineering attack. Social engineering involves manipulating individuals into divulging confidential information or performing actions that may compromise security. Phishing emails, like the one described, often contain fraudulent links to trick the recipient into providing sensitive information or downloading malware. Business email refers to business email compromise (BEC), which typically involves impersonating a high-level executive to defraud the company. Unsecured network is unrelated to the email content. Default credentials do not apply here, as the issue is with suspicious links, not login credentials.

• Question 333:

  A network team segmented a critical, end-of-life server to a VLAN that can only be reached by specific devices but cannot be reached by the perimeter network.

  Which of the following best describe the controls the team implemented? (Choose two.)

  A. Managerial
  B. Physical
  C. Corrective
  D. Detective
  E. Compensating
  F. Technical
  G. Deterrent
  E. Compensating
  F. Technical

• Question 334:

  A company wants to minimize the chance of its outgoing marketing emails getting flagged as spam. The company decides to list the email servers on the proper DNS record.

  Which of the following protocols should the company apply next?

  A. DMARC
  B. DLP
  C. DKIM
  D. SPF
  C. DKIM

  ---

  Explanation

  After listing authorized email servers in DNS using SPF, the next protocol the company should apply is DKIM (DomainKeys Identified Mail). DKIM provides cryptographic assurance that email messages have not been altered in transit and that they were legitimately sent by the domain owner. Security+ SY0-701 explains that DKIM works by digitally signing outgoing emails using a private key, which recipient servers verify using a public key stored in DNS.

  SPF validates where an email is sent from, but it does not protect message integrity. DKIM complements SPF by ensuring the message content is authentic, which significantly improves email reputation and reduces spam filtering issues.

  DMARC (A) builds on SPF and DKIM but requires both to be in place first. DLP (B) prevents data leakage and is unrelated to email reputation. SPF (D) was already applied, as stated in the question.

  Thus, the correct next step is C: DKIM.

• Question 335:

  Which of the following outlines the configuration, maintenance, and security roles between a cloud service provider and the customer?

  A. Service-level agreement
  B. Responsibility matrix
  C. Memorandum of understanding
  D. Non-disclosure agreement
  B. Responsibility matrix

  ---

  Explanation

  A responsibility matrix, often referred to in cloud computing as the Shared Responsibility Model, defines the exact roles, duties, and expectations between a cloud service provider (CSP) and the customer. This includes who is responsible for configuration, maintenance, patching, logging, updates, identity management, network security, and data protection.

  According to the SY0-701 exam objectives, cloud models such as SaaS, PaaS, and IaaS all divide responsibilities differently. The responsibility matrix clarifies these boundaries so that neither party assumes the other is handling a critical security task. Misunderstandings in these areas can create dangerous security gaps, such as unpatched virtual machines, misconfigured storage buckets, or weak access controls. A Service-Level Agreement (A) focuses on uptime, performance, and service expectations-not shared security roles. A Memorandum of Understanding (C) describes high-level cooperation between organizations, while an NDA (D) protects confidential information. The responsibility matrix is emphasized under Security Program Management, specifically in managing third-party relationships and cloud provider governance, ensuring both parties understand their obligations and reducing the risk of misconfigurations or operational vulnerabilities.

• Question 336:

  Which of the following metrics impacts the backup schedule as part of the BIA?

  A. RTO
  B. RPO
  C. MTTR
  D. MTBF
  B. RPO

• Question 337:

  An accounting clerk sent money to an attacker's bank account after receiving fraudulent instructions to use a new account.

  Which of the following would most likely prevent this activity in the future?

  A. Standardizing security incident reporting
  B. Executing regular phishing campaigns
  C. Implementing insider threat detection measures
  D. Updating processes for sending wire transfers
  D. Updating processes for sending wire transfers

  ---

  Explanation

  Updating the processes for sending wire transfers would most likely prevent this type of activity in the future. This could include implementing additional verification steps, such as requiring multiple levels of approval, verifying new payment instructions through a separate communication channel, or implementing a callback procedure to confirm the authenticity of the instructions.

• Question 338:

  Which of the following strategies should an organization use to efficiently manage and analyze multiple types of logs?

  A. Deploy a SIEM solution
  B. Create custom scripts to aggregate and analyze logs
  C. Implement EDR technology
  D. Install a unified threat management appliance
  A. Deploy a SIEM solution

  ---

  Explanation

  Deploying a Security Information and Event Management (SIEM) solution allows for efficient log aggregation, correlation, and analysis across an organization's infrastructure, providing real-time security insights.

  References:

  Security+ SY0-701 Course Content, Security+ SY0-601 Book.

• Question 339:

  During a SQL update of a database, a temporary field used as part of the update sequence was modified by an attacker before the update completed in order to allow access to the system.

  Which of the following best describes this type of vulnerability?

  A. Race condition
  B. Memory injection
  C. Malicious update
  D. Side loading
  A. Race condition

  ---

  Explanation

  Arace conditionoccurs whentwo or more processes attempt to access and modify a shared resource simultaneously, leading to unintended behavior. In this scenario, the attacker was able to modify a temporary fieldbefore the SQL update completed, indicating atime-of-check to time-of-use (TOCTOU) vulnerability, which is a type of race condition.

  Memory injection (B)refers to inserting malicious code into a running process's memory, but that isnotwhat is happening here.

  Malicious update (C)is too broad and does not specifically describe this scenario. Side loading (D)is a technique where malicious software is loaded via a trusted application, unrelated to this case.

  References:

  CompTIA Security+ SY0-701

  Official Study Guide, Threats, Vulnerabilities, and Mitigations domain.

• Question 340:

  A security administrator is working to find a cost-effective solution to implement certificates for a large number of domains and subdomains owned by the company.

  Which of the following types of certificates should the administrator implement?

  A. Wildcard
  B. Client certificate
  C. Self-signed
  D. Code signing
  A. Wildcard