CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 341:

  An employee emailed a new systems administrator a malicious web link and convinced the administrator to change the email server's password. The employee used this access to remove the mailboxes of key personnel.

  Which of the following security awareness concepts would help prevent this threat in the future?

  A. Recognizing phishing
  B. Providing situational awareness training
  C. Using password management
  D. Reviewing email policies
  A. Recognizing phishing

  ---

  Explanation

  In this scenario, the employee used a form of social engineering by sending a malicious link and persuading the administrator to take unauthorized actions. Training employees to recognize phishing attempts and other social engineering tactics would help them identify and avoid suspicious requests, reducing the likelihood of falling victim to similar threats in the future.

• Question 342:

  A company is required to perform a risk assessment on an annual basis.

  Which of the following types of risk assessments does this requirement describe?

  A. Continuous
  B. Ad hoc
  C. Recurring
  D. One time
  C. Recurring

• Question 343:

  A security administrator receives multiple reports about the same suspicious email.

  Which of the following is the most likely reason for the malicious email's continued delivery?

  A. Employees are flagging legitimate emails as spam.
  B. Information from reported emails is not being used to tune email filtering tools.
  C. Employees are using shadow IT solutions for email.
  D. Employees are forwarding personal emails to company email addresses.
  B. Information from reported emails is not being used to tune email filtering tools.

• Question 344:

  Which of the following best explains the role of compensating controls?

  A. Reducing the attack surface by isolating vulnerable components within a segmented environment
  B. Providing an alternative security measure when standard remediation is not feasible
  C. Delaying remediation timelines by replacing affected systems in a maintenance window
  D. Remediating software flaws by modifying source code to remove insecure functions
  B. Providing an alternative security measure when standard remediation is not feasible

  ---

  Explanation

  The best answer is B. Providing an alternative security measure when standard remediation is not feasible. A compensating control is a substitute safeguard used when the preferred or required control cannot be implemented immediately or at all. It helps reduce risk in another way until proper remediation is possible, or when direct remediation is impractical. Examples include: increasing monitoring when a system cannot be patched segmenting a legacy application that cannot be upgraded restricting access to a vulnerable system that must remain in service.

  Why the other options are incorrect:

  A. Reducing the attack surface by isolating vulnerable components within a segmented environmentThis can be an example of a compensating control, but it does not define the overall role as clearly as

  B.

  C. Delaying remediation timelines by replacing affected systems in a maintenance windowThis describes scheduling or change timing, not compensating controls.

  D. Remediating software flaws by modifying source code to remove insecure functionsThis is direct remediation, not a compensating control. From the SY0-701 perspective, compensating controls are used when the ideal fix is not possible, so B is the best explanation.

• Question 345:

  Which of the following is a possible consequence of a VM escape?

  A. Malicious instructions can be inserted into memory and give the attacker elevated permissions.
  B. An attacker can access the hypervisor and compromise other VMs.
  C. Unencrypted data can be read by a user in a separate environment.
  D. Users can install software that is not on the manufacturer's approved list.
  B. An attacker can access the hypervisor and compromise other VMs.

  ---

  Explanation

  A VM escape occurs when an attacker breaks out of a virtual machine's isolation to access the hypervisor. This compromise can allow control of the hypervisor and all other VMs on the host, posing significant security risks.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 3: Security Architecture, Section: "Virtualization Risks and Mitigation".

• Question 346:

  A security analyst is reviewing logs to identify the destination of command-and-control traffic originating from a compromised device within the on-premises network.

  Which of the following is the best log to review?

  A. IDS
  B. Antivirus
  C. Firewall
  D. Application
  C. Firewall

  ---

  Explanation

  Firewall logs are ideal for identifying the destination of command-and-control (C2) traffic because they log all inbound and outbound connections, including IP addresses, ports, and protocols used. By reviewing firewall logs, a security analyst can trace where the compromised device is attempting to send data and potentially identify the external command-and-control server, aiding in the containment of the threat.

• Question 347:

  Which of the following security control types does an acceptable use policy best represent?

  A. Detective
  B. Compensating
  C. Corrective
  D. Preventive
  D. Preventive

  ---

  Explanation

  An acceptable use policy (AUP) is a set of rules that govern how users can access and use a corporate network or the internet. The AUP helps companies minimize their exposure to cyber security threats and limit other risks. The AUP also serves as a notice to users about what they are not allowed to do and protects the company against misuse of their network. Users usually have to acknowledge that they understand and agree to the rules before accessing the network. An AUP best represents a preventive security control type, because it aims to deter or stop potential security incidents from occurring in the first place. A preventive control is proactive and anticipates possible threats and vulnerabilities, and implements measures to prevent them from exploiting or harming the system or the data. A preventive control can be physical, technical, or administrative in nature.

  Some examples of preventive controls are: Locks, fences, or guards that prevent unauthorized physical access to a facility or a device Firewalls, antivirus software, or encryption that prevent unauthorized logical access to a network or a system Policies, procedures, or training that prevent unauthorized or inappropriate actions or behaviors by users or employees

  An AUP is an example of an administrative preventive control, because it defines the policies and procedures that users must follow to ensure the security and proper use of the network and the IT resources. An AUP can prevent users from engaging in activities that could compromise the security, performance, or availability of the network or the system, such as: Downloading or installing unauthorized or malicious software Accessing or sharing sensitive or confidential information without authorization or encryption Using the network or the system for personal, illegal, or unethical purposes Bypassing or disabling security controls or mechanisms Connecting unsecured or unapproved devices to the network By enforcing an AUP, a company can prevent or reduce the likelihood of security breaches, data loss, legal liability, or reputational damage caused by user actions or inactions.

  References:

  1: How to Create an Acceptable Use Policy - CoreTech,

  2: [Security Control Types: Preventive, Detective, Corrective, and Compensating],

  3: Why You Need A Corporate Acceptable Use Policy - CompTIA

• Question 348:

  A financial institution would like to store its customer data in a cloud but still allow the data to be accessed and manipulated while encrypted. Doing so would prevent the cloud service provider from being able to decipher the data due to its sensitivity. The financial institution is not concerned about computational overheads and slow speeds.

  Which of the following cryptographic techniques would best meet the requirement?

  A. Asymmetric
  B. Symmetric
  C. Homomorphic
  D. Ephemeral
  C. Homomorphic

  ---

  Explanation

  Homomorphic encryption allows data to be encrypted and manipulated without needing to decrypt it first. This cryptographic technique would allow the financial institution to store customer data securely in the cloud while still permitting operations like searching and calculations to be performed on the encrypted data. This ensures that the cloud service provider cannot decipher the sensitive data, meeting the institution's security requirements.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 03 Security Architecture. CompTIA Security+ SY0-601 Study Guide: Chapter on Cryptographic Techniques.

• Question 349:

  Employees in the research and development business unit receive extensive training to ensure they understand how to best protect company data.

  Which of the following is the type of data these employees are most likely to use in day-to-day work activities?

  A. Encrypted
  B. Intellectual property
  C. Critical
  D. Data in transit
  B. Intellectual property

  ---

  Explanation

  Intellectual property is a type of data that consists of ideas, inventions, designs, or other creative works that have commercial value and are protected by law. Employees in the research and development business unit are most likely to use intellectual property data in their day-to-day work activities, as they are involved in creating new products or services for the company. Intellectual property data needs to be protected from unauthorized use, disclosure, or theft, as it can give the company a competitive advantage in the market. Therefore, these employees receive extensive training to ensure they understand how to best protect this type of data.

  References:

  CompTIA Security+ SY0-701 Certification Study Guide, page 90

  Professor Messer's CompTIA SY0-701 Security+ Training Course, video 1.2 - Security Concepts, 7:57 - 9:03.

• Question 350:

  Which of the following options will provide the lowest RTO and RPO for a database?

  A. Snapshots
  B. On-site backups
  C. Journaling
  D. Hot site
  D. Hot site

  ---

  Explanation

  A hot site provides the lowest Recovery Time Objective (RTO) and Recovery Point Objective (RPO) because it involves a fully functional backup system that is continuously synchronized with the primary system. In the event of a failure, operations can be quickly switched over to the hot site with minimal downtime and data loss.

  RTO is the maximum allowable downtime before service must be restored, and a hot site offers near-instantaneous recovery.

  RPO is the maximum acceptable amount of data loss, and a hot site allows for nearly zero data loss since it's constantly synchronized.

  While snapshots, on-site backups, and journaling also provide valuable backup and recovery options, they generally do not offer the same level of real-time recovery as a hot site.