CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 371:

  A university uses two different cloud solutions for storing student data.

  Which of the following does this scenario represent?

  A. Load balancing
  B. Parallel processing
  C. Platform diversity
  D. Clustering
  C. Platform diversity

• Question 372:

  Which of the following prevents unauthorized modifications to internal processes, assets, and security controls?

  A. Change management
  B. Playbooks
  C. Incident response
  D. Acceptable use policy
  A. Change management

• Question 373:

  Which of the following is the first step to take when creating an anomaly detection process?

  A. Selecting events
  B. Building a baseline
  C. Selecting logging options
  D. Creating an event log
  B. Building a baseline

  ---

  Explanation

  The first step in creating an anomaly detection process is building a baseline of normal behavior within the system. This baseline serves as a reference point to identify deviations or anomalies that could indicate a security incident. By understanding what normal activity looks like, security teams can more effectively detect and respond to suspicious behavior.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 04 Security Operations. CompTIA Security+ SY0-601 Study Guide: Chapter on Monitoring and Baselines.

• Question 374:

  An attacker used XSS to compromise a web server.

  Which of the following solutions could have been used to prevent this attack?

  A. NGFW
  B. UTM
  C. WAF
  D. NAC
  C. WAF

  ---

  Explanation

  A Web Application Firewall (WAF) is designed to protect web applications from attacks such as Cross-Site Scripting (XSS) by filtering and monitoring HTTP traffic between the internet and a web application. Next-Generation Firewalls (NGFW) (A) provide advanced network security but are not specifically designed to protect web applications from XSS attacks. Unified Threat Management (UTM) (B) provides multiple security functions but lacks the specialized application-layer protection needed to mitigate XSS.

  Network Access Control (NAC) (D) controls device access to the network but does not prevent web-based attacks.

  A WAF is the best solution for protecting web servers from XSS, SQL injection, and other web-based threats.

• Question 375:

  An IT manager informs the entire help desk staff that only the IT manager and the help desk lead will have access to the administrator console of the help desk software.

  Which of the following security techniques is the IT manager setting up?

  A. Hardening
  B. Employee monitoring
  C. Configuration enforcement
  D. Least privilege
  D. Least privilege

  ---

  Explanation

  The principle of least privilege is a security concept that limits access to resources to the minimum level needed for a user, a program, or a device to perform a legitimate function. It is a cybersecurity best practice that protects high-value data and assets from compromise or insider threat. Least privilege can be applied to different abstraction layers of a computing environment, such as processes, systems, or connected devices. However, it is rarely implemented in practice. In this scenario, the IT manager is setting up the principle of least privilege by restricting access to the administrator console of the help desk software to only two authorized users: the IT manager and the help desk lead. This way, the IT manager can prevent unauthorized or accidental changes to the software configuration, data, or functionality by other help desk staff. The other help desk staff will only have access to the normal user interface of the software, which is sufficient for them to perform their job functions. The other options are not correct. Hardening is the process of securing a system by reducing its surface of vulnerability, such as by removing unnecessary software, changing default passwords, or disabling unnecessary services. Employee monitoring is the surveillance of workers' activity, such as by tracking web browsing, application use, keystrokes, or screenshots. Configuration enforcement is the process of ensuring that a system adheres to a predefined set of security settings, such as by applying a patch, a policy, or a template.

  References:

  https://en.wikipedia.org/wiki/Principle_of_least_privilege

  https://en.wikipedia.org/wiki/Principle_of_least_privilege

• Question 376:

  Which of the following is die most important security concern when using legacy systems to provide production service?

  A. Instability
  B. Lack of vendor support
  C. Loss of availability
  D. Use of insecure protocols
  B. Lack of vendor support

  ---

  Explanation

  The most important security concern when using legacy systems is the lack of vendor support. Without support from the vendor, systems may not receive critical security patches and updates, leaving them vulnerable to exploitation. This lack of support can result in increased risk of security breaches, as vulnerabilities discovered in the software may never be addressed.

  References:

  CompTIA Security+ SY0-701 study materials, particularly in the context of risk management and the challenges posed by legacy systems.

• Question 377:

  A security analyst estimates that a small security incident will cost $10,000 and will occur twice per year. The analyst recommends a budget of $20,000 for next year.

  Which of the following does the $10,000 represent?

  A. ARO
  B. SLE
  C. ALE
  D. RPO
  B. SLE

  ---

  Explanation

  The $10,000 is the estimated cost per incident (per single occurrence). In quantitative risk analysis, that value is the Single Loss Expectancy (SLE)-the financial impact expected each time a risk event occurs. The Study Guide defines these terms and calculations clearly: "The single loss expectancy (SLE) is the amount of financial damage expected each time a risk materializes." It also explains how annual impact is derived: "The annualized loss expectancy (ALE) is the amount of damage expected from a risk each year. It is calculated by multiplying the SLE and the ARO."

  Here, the event occurs twice per year, so the Annualized Rate of Occurrence (ARO) is 2.0, and the annual expected loss (ALE) would be SLE x ARO = $10,000 x 2 = $20,000, which matches the recommended budget. That confirms $10,000 is not ARO (a frequency), not ALE (annual total), and not RPO (a disaster recovery metric about acceptable data loss window).

  References:

  Quantitative risk terms and formulas (SLE definition

  ALE = SLE x ARO).

• Question 378:

  Which of the following best explains a core principle of a Zero Trust security model?

  A. Devices connected to the internal network are automatically trusted after initial authentication.
  B. Access to resources is granted only after strict identity verification and continuous monitoring.
  C. Security policies require multifactor authentication for remote access to sensitive data.
  D. Network access is limited by role, and access controls are reviewed on a regular schedule.
  B. Access to resources is granted only after strict identity verification and continuous monitoring.

  ---

  Explanation

  Zero Trust is based on the principle of "never trust, always verify."

  Option B is correct because access is granted only after strong identity verification, policy evaluation, and continuous monitoring. Zero Trust rejects the old perimeter assumption that users or devices inside the internal network should automatically be trusted. Access decisions should consider identity, device posture, location, sensitivity of the resource, session risk, and ongoing behavior. MFA is commonly used in Zero Trust, but option C is too narrow because Zero Trust applies beyond remote access and beyond MFA alone. Role-based limitations and periodic reviews are useful, but

  option D does not capture continuous verification.

  Option A is the opposite of Zero Trust because it assumes internal trust after initial authentication.

• Question 379:

  An IT administrator needs to ensure data retention standards are implemented on an enterprise application.

  Which of the following describes the administrator's role?

  A. Processor
  B. Custodian
  C. Privacy officer
  D. Owner
  B. Custodian

  ---

  Explanation

  A custodian is responsible for the implementation and enforcement of data management policies, including data retention standards, on systems and applications. Custodians manage the technical aspects of data storage and maintenance according to the organization's policies and standards, supporting the data owner's requirements.

• Question 380:

  A penetration test has demonstrated that domain administrator accounts were vulnerable to pass-the-hash attacks.

  Which of the following would have been the best strategy to prevent the threat actor from using domain administrator accounts?

  A. Audit each domain administrator account weekly for password compliance.
  B. Implement a privileged access management solution.
  C. Create IDS policies to monitor domain controller access.
  D. Use Group Policy to enforce password expiration.
  B. Implement a privileged access management solution.

  ---

  Explanation

  Privileged access management (PAM) solutions effectively mitigate pass-the-hash attacks by enforcing least privilege and session management for administrative accounts. These tools restrict how and when credentials can be accessed, thereby reducing attack surfaces.

  References:

  CompTIA Security+ SY0- 701 Study Guide, Domain 2: Vulnerabilities, Section: "Mitigation Techniques".