CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 351:

  Which of the following has been implemented when a host-based firewall on a legacy Linux system allows connections from only specific internal IP addresses?

  A. Compensating control
  B. Network segmentation
  C. Transfer of risk
  D. SNMP traps
  A. Compensating control

  ---

  Explanation

  A compensating control is a security measure that is implemented to mitigate the risk of a vulnerability or a weakness that cannot be resolved by the primary control. A compensating control does not prevent or eliminate the vulnerability or weakness, but it can reduce the likelihood or impact of an attack. A host-based firewall on a legacy Linux system that allows connections from only specific internal IP addresses is an example of a compensating control, as it can limit the exposure of the system to potential threats from external or unauthorized sources. A host-based firewall is a software application that monitors and filters the incoming and outgoing network traffic on a single host, based on a set of rules or policies. A legacy Linux system is an older version of the Linux operating system that may not be compatible with the latest security updates or patches, and may have known vulnerabilities or weaknesses that could be exploited by attackers.

  References:

  Security Controls -SY0-601 CompTIA Security+ : 5.1, Security Controls -CompTIA Security+ SY0-501 -5.7, CompTIA Security+ Study Guide with over 500 Practice Test Questions: Exam SY0-701, 9th Edition, Chapter 5, page 240. CompTIA Security+ (SY0-701) Certification Exam Objectives, Domain 5.1, page 18.

• Question 352:

  Which of the following is the most likely reason a security analyst would review SIEM logs?

  A. To check for recent password reset attempts
  B. To monitor for potential DDoS attacks
  C. To assess the scope of a privacy breach
  D. To see correlations across multiple hosts
  D. To see correlations across multiple hosts

• Question 353:

  Which of the following is the stage in an investigation when forensic images are obtained?

  A. Acquisition
  B. Preservation
  C. Reporting
  D. E-discovery
  A. Acquisition

  ---

  Explanation

  Detailed Explanation:The acquisition phase involves creating forensic images (exact replicas) of storage devices or memory to ensure data integrity for further analysis.

  References:

  CompTIA Security+ SY0-701

  Study Guide, Domain 4: Security Operations, Section: " Forensic Imaging and Chain of Custody ".

• Question 354:

  While considering the organization's cloud-adoption strategy, the Chief Information Security Officer sets a goal to outsource patching of firmware, operating systems, and applications to the chosen cloud vendor.

  Which of the following best meets this goal?

  A. Community cloud
  B. PaaS
  C. Containerization
  D. Private cloud
  E. SaaS
  F. laaS
  E. SaaS

  ---

  Explanation

  Software as a Service (SaaS) is the cloud model that best meets the goal of outsourcing the management, including patching, of firmware, operating systems, and applications to the cloud vendor. In a SaaS environment, the cloud provider is responsible for maintaining and updating the entire software stack, allowing the organization to focus on using the software rather than managing its infrastructure.

  References:

  CompTIA Security+ SY0-701 study materials, particularly the domains related to cloud security models.

• Question 355:

  Which of the following is most likely to be deployed to obtain and analyze attacker activity and techniques?

  A. Firewall
  B. IDS
  C. Honeypot
  D. Layer 3 switch
  C. Honeypot

  ---

  Explanation

  A honeypot is most likely to be deployed to obtain and analyze attacker activity and techniques. A honeypot is a decoy system set up to attract attackers, providing an opportunity to study their methods and behaviors in a controlled environment without risking actual systems.

  Honeypot: A decoy system designed to lure attackers, allowing administrators to observe and analyze attack patterns and techniques.

  Firewall: Primarily used to block unauthorized access to networks, not for observing attacker behavior.

  IDS (Intrusion Detection System): Detects and alerts on malicious activity but does not specifically engage attackers to observe their behavior. Layer 3 switch: Used for routing traffic within networks, not for analyzing attacker techniques.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 2.4 - Indicators of malicious activity (Honeypots).

• Question 356:

  Which of the following would be the best way to block unknown programs from executing?

  A. Access control list
  B. Application allow list.
  C. Host-based firewall
  D. DLP solution
  B. Application allow list.

  ---

  Explanation

  An application allow list is a security technique that specifies which applications are permitted to run on a system or a network. An application allow list can block unknown programs from executing by only allowing the execution of programs that are explicitly authorized and verified. An application allow list can prevent malware, unauthorized software, or unwanted applications from running and compromising the security of the system or the network.

  The other options are not the best ways to block unknown programs from executing: Access control list: This is a security technique that specifies which users or groups are granted or denied access to a resource or an object. An access control list can control the permissions and privileges of users or groups, but it does not directly block unknown programs from executing.

  Host-based firewall: This is a security device that monitors and filters the incoming and outgoing network traffic on a single host or system. A host-based firewall can block or allow network connections based on predefined rules, but it does not directly block unknown programs from executing.

  DLP solution: This is a security system that detects and prevents the unauthorized transmission or leakage of sensitive data. A DLP solution can protect the confidentiality and integrity of data, but it does not directly block unknown programs from executing.

  References:

  1: CompTIA Security+ SY0-701 Certification Study Guide, page 97

  2: Application Whitelisting -CompTIA Security+ SY0-701 -3.5, video by Professor Messer

  3: CompTIA Security+ SY0-701 Certification Study Guide, page 98. : CompTIA Security+ SY0-701 Certification Study Guide, page 99. : CompTIA Security+ SY0-701 Certification Study Guide, page 100.

• Question 357:

  A forensic engineer determines that the root cause of a compromise is a SQL injection attack.

  Which of the following should the engineer review to identify the command used by the threat actor?

  A. Metadata
  B. Application log
  C. System log
  D. Netflow log
  B. Application log

• Question 358:

  Which of the following techniques would identify whether data has been modified in transit?

  A. Hashing
  B. Tokenization
  C. Masking
  D. Encryption
  A. Hashing

• Question 359:

  Which of the following strategies most effectively protects sensitive data at rest in a database?

  A. Hashing
  B. Masking
  C. Tokenization
  D. Obfuscation
  C. Tokenization

  ---

  Explanation

  Tokenization is the most effective method for protecting sensitive data at rest within a database. Tokenization replaces sensitive information-such as credit card numbers, SSNs, or personal identifiers-with meaningless surrogate values (tokens). The actual data is stored securely in a separate token vault, reducing exposure if the primary database is compromised.

  Hashing (A) is one-way and protects integrity, not usability, making it inappropriate for data that must later be retrieved. Masking (B) hides data from users but does not secure stored data in the database. Obfuscation (D) makes data harder to understand but is reversible and not intended for strong security.

  Security+ SY0-701 identifies tokenization as a key control for data-at-rest protection, especially in regulated industries like finance and healthcare. It prevents attackers from accessing real data even if the database is breached, significantly reducing risk and compliance impact. This aligns with the exam's emphasis on confidentiality and data protection strategies in stored environments.

• Question 360:

  At the start of a penetration test, the tester checks OSINT resources for information about the client environment.

  Which of the following types of reconnaissance is the tester performing?

  A. Active
  B. Passive
  C. Offensive
  D. Defensive
  B. Passive