CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 361:

  In which of the following scenarios is tokenization the best privacy technique to use?

  A. Providing pseudo-anonymization for social media user accounts
  B. Serving as a second factor for authentication requests
  C. Enabling established customers to safely store credit card Information
  D. Masking personal information inside databases by segmenting data
  C. Enabling established customers to safely store credit card Information

  ---

  Explanation

  Tokenization is a process that replaces sensitive data, such as credit card information, with a non-sensitive equivalent (token) that can be used in place of the actual data. This technique is particularly useful in securely storing payment information because the token can be safely stored and transmitted without exposing the original credit card number.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 03 Security Architecture. CompTIA Security+ SY0-601 Study Guide: Chapter on Cryptography and Data Protection.

• Question 362:

  Which of the following best describes a use case for a DNS sinkhole?

  A. Attackers can see a DNS sinkhole as a highly valuable resource to identify a company's domain structure.
  B. A DNS sinkhole can be used to draw employees away from known-good websites to malicious ones owned by the attacker.
  C. A DNS sinkhole can be used to capture traffic to known-malicious domains used by attackers.
  D. A DNS sinkhole can be set up to attract potential attackers away from a company's network resources.
  C. A DNS sinkhole can be used to capture traffic to known-malicious domains used by attackers.

• Question 363:

  Which of the following would be used to detect an employee who is emailing a customer list to a personal account before leaving the company?

  A. DLP
  B. FIM
  C. IDS
  D. EDR
  A. DLP

  ---

  Explanation

  To detect an employee who is emailing a customer list to a personal account before leaving the company, a Data Loss Prevention (DLP) system would be used. DLP systems are designed to detect and prevent unauthorized transmission of sensitive data.

  DLP (Data Loss Prevention): Monitors and controls data transfers to ensure sensitive information is not sent to unauthorized recipients.

  FIM (File Integrity Monitoring): Monitors changes to files to detect unauthorized modifications.

  IDS (Intrusion Detection System): Monitors network traffic for suspicious activity but does not specifically prevent data leakage.

  EDR (Endpoint Detection and Response): Monitors and responds to threats on endpoints but is not specifically focused on data leakage.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 4.5 - Modify enterprise capabilities to enhance security (Data Loss Prevention).

• Question 364:

  Which of the following uses proprietary controls and is designed to function in harsh environments over many years with limited remote access management?

  A. ICS
  B. Microservers
  C. Containers
  D. IoT
  A. ICS

  ---

  Explanation

  Industrial Control Systems (ICS) are engineered to operate in rugged, mission-critical environments such as manufacturing floors, refineries, gas pipelines, nuclear plants, and water treatment facilities. These systems are designed to remain operational for decades, often with minimal remote-management capability and limited update cycles. ICS architectures frequently use proprietary protocols and controls, many of which were developed long before modern cybersecurity concerns existed.

  Security+ SY0-701 notes that ICS environments include SCADA systems, PLCs, actuators, sensors, and controllers that must function reliably under extreme temperature, pressure, vibration, and industrial stress conditions. Because downtime may impact safety, critical infrastructure, or national security, ICS devices avoid frequent patching and instead rely on isolation, segmentation, and compensating controls.

  Microservers (B) are small, lightweight servers-not rugged systems. Containers (C) are virtualized application environments. IoT devices (D) are consumer or commercial smart devices, not industrial-grade long-lifespan systems.

  Thus, the correct answer is A: ICS.

• Question 365:

  A security engineer is working to address the growing risks that shadow IT services are introducing to the organization. The organization has taken a cloud-first approach end does not have an on-premises IT infrastructure.

  Which of the following would best secure the organization?

  A. Upgrading to a next-generation firewall
  B. Deploying an appropriate in-line CASB solution
  C. Conducting user training on software policies
  D. Configuring double key encryption in SaaS platforms
  B. Deploying an appropriate in-line CASB solution

  ---

  Explanation

  A Cloud Access Security Broker (CASB) solution is the most suitable option for securing an organization that has adopted a cloud-first strategy and does not have an on-premises IT infrastructure. CASBs provide visibility and control over shadow IT services, enforce security policies, and protect data across cloud services.

  References:

  CompTIA Security+ SY0-701 study materials, particularly in the domain of cloud security and managing risks associated with shadow IT.

• Question 366:

  A security administrator needs to create firewall rules for the following protocols: RTP, SIP, H.323. and SRTP.

  Which of the following does this rule set support?

  A. RTOS
  B. VoIP
  C. SoC
  D. HVAC
  B. VoIP

• Question 367:

  Which of the following are the first steps an analyst should perform when developing a heat map? (Choose two.)

  A. Methodically walk around the office noting Wi-Fi signal strength.
  B. Log in to each access point and check the settings.
  C. Create or obtain a layout of the office.
  D. Measure cable lengths between access points.
  E. Review access logs to determine the most active devices.
  F. Remove possible impediments to radio transmissions.
  A. Methodically walk around the office noting Wi-Fi signal strength.
  C. Create or obtain a layout of the office.

  ---

  Explanation

  Methodically walk around the office noting Wi-Fi signal strength: This is essential for identifying areas with weak or strong signals and understanding the coverage gaps or interference points, which are crucial for developing an accurate heat map.

  Create or obtain a layout of the office: A layout is necessary to map the signal strength data against the physical environment, enabling proper visualization of signal coverage and pinpointing issues.

  These two steps provide the foundation for creating a meaningful heat map to analyze wireless network performance.

• Question 368:

  A security analyst reviews web server logs and sees the following entries:

  16.22.48.102 -- 26/April/2023 22:00:04.33 GET "http://www.databaseInfo.com/index.html/*"

  16.22.48.102 -- 26/April/2023 22:00:07.23 GET "http://www.databaseInfo.com/index.html/../" 404

  16.22.48.102 -- 26/April/2023 22:01:16.03 GET "http://www.databaseInfo.com/index.html/../images" 404

  16.22.48.102 -- 26/April/2023 22:03:10.25 GET "http://www.databaseInfo.com/index.html/../passwords" 404

  16.22.48.102 -- 26/April/2023 22:05:11.22 GET

  "http://www.databaseInfo.com/index.html/..

  /storedSQLqueries" 404 Which of the following attacks is most likely being attempted?

  A. Denial of service
  B. Password spraying
  C. SQL injection
  D. Directory traversal
  D. Directory traversal

• Question 369:

  A network administrator wants to ensure that network traffic is highly secure while in transit.

  Which of the following actions best describes the actions the network administrator should take?

  A. Ensure that NAC is enforced on all network segments, and confirm that firewalls have updated policies to block unauthorized traffic.
  B. Ensure only TLS and other encrypted protocols are selected for use on the network, and only permit authorized traffic via secure protocols.
  C. Configure the perimeter IPS to block inbound HTTPS directory traversal traffic, and verify that signatures are updated on a daily basis.
  D. Ensure the EDR software monitors for unauthorized applications that could be used by threat actors, and configure alerts for the security team.
  B. Ensure only TLS and other encrypted protocols are selected for use on the network, and only permit authorized traffic via secure protocols.

  ---

  Explanation

  Using TLS and other encrypted protocols ensures that data is securely transmitted, protecting it from interception or eavesdropping. By restricting traffic to secure protocols, the administrator can maintain high security for data in transit across the network. This approach directly addresses securing network traffic rather than focusing solely on perimeter or endpoint security.

• Question 370:

  A small business uses kiosks on the sales floor to display product information for customers. A security team discovers the kiosks use end-of-life operating systems.

  Which of the following is the security team most likely to document as a security implication of the current architecture?

  A. Patch availability
  B. Product software compatibility
  C. Ease of recovery
  D. Cost of replacement
  A. Patch availability

  ---

  Explanation

  End-of-life operating systems are those that are no longer supported by the vendor or manufacturer, meaning they do not receive any security updates or patches. This makes them vulnerable to exploits and attacks that take advantage of known or unknown flaws in the software. Patch availability is the security implication of using end-of-life operating systems, as it affects the ability to fix or prevent security issues. Other factors, such as product software compatibility, ease of recovery, or cost of replacement, are not directly related to security, but rather to functionality, availability, or budget.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 29