CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 381:

  A security manager created new documentation to use in response to various types of security incidents.

  Which of the following is the next step the manager should take?

  A. Set the maximum data retention policy.
  B. Securely store the documents on an air-gapped network.
  C. Review the documents' data classification policy.
  D. Conduct a tabletop exercise with the team.
  D. Conduct a tabletop exercise with the team.

  ---

  Explanation

  A tabletop exercise is a simulated scenario that tests the effectiveness of a security incident response plan. It involves gathering the relevant stakeholders and walking through the steps of the plan, identifying any gaps or issues that need to be addressed. A tabletop exercise is a good way to validate the documentation created by the security manager and ensure that the team is prepared for various types of security incidents.

  References:

  6: Risk Management, page 2841. CompTIA Security+ Certification Kit: Exam SY0-701, 7th Edition, Chapter

  6: Risk Management, page 2842.

• Question 382:

  Easy-to-guess passwords led to an account compromise. The current password policy requires at least 12 alphanumeric characters, one uppercase character, one lowercase character, a password history of two passwords, a minimum password age of one day, and a maximum password age of 90 days.

  Which of the following would reduce the risk of this incident from happening again? (Choose two.)

  A. Increasing the minimum password length to 14 characters.
  B. Upgrading the password hashing algorithm from MD5 to SHA-512.
  C. Increasing the maximum password age to 120 days.
  D. Reducing the minimum password length to ten characters.
  E. Reducing the minimum password age to zero days.
  F. Including a requirement for at least one special character.
  A. Increasing the minimum password length to 14 characters.
  F. Including a requirement for at least one special character.

• Question 383:

  Which of the following is the most important security concern when using legacy systems to provide production service?

  A. Instability
  B. Lack of vendor support
  C. Loss of availability
  D. Use of insecure protocols
  B. Lack of vendor support

  ---

  Explanation

  The most important security concern when using legacy systems is the lack of vendor support. Without support from the vendor, systems may not receive critical security patches and updates, leaving them vulnerable to exploitation. This lack of support can result in increased risk of security breaches, as vulnerabilities discovered in the software may never be addressed.

  References:

  CompTIA Security+ SY0-701 study materials, particularly in the context of risk management and the challenges posed by legacy systems.

• Question 384:

  An employee who was working remotely lost a mobile device containing company data.

  Which of the following provides the best solution to prevent future data loss?

  A. MDM
  B. DLP
  C. FDE
  D. EDR
  A. MDM

  ---

  Explanation

  MDM allows an organization to remotely manage, monitor, and secure mobile devices used by employees, especially when they contain company data. With MDM, administrators can enforce security policies, remotely lock or wipe lost or stolen devices, and ensure compliance with data protection policies, thereby mitigating the risk of data loss.

• Question 385:

  Which of the following is used to calculate the impact to an organization per cybersecurity incident?

  A. SLE
  B. ALE
  C. ARO
  D. SLA
  A. SLE

  ---

  Explanation

  Single Loss Expectancy (SLE) represents the monetary loss an organization expects from a single cybersecurity incident, helping quantify the financial impact of individual events.

• Question 386:

  Which of the following is a security benefit of an effective IT asset tracking system?

  A. Helping identify unauthorized or unmanaged devices connected to the network
  B. Preventing prohibited data exfiltration from endpoints on the network
  C. Assisting with automated root cause analysis for all security incidents on the network
  D. Ensuring proper data backup and recovery procedures are in place
  A. Helping identify unauthorized or unmanaged devices connected to the network

  ---

  Explanation

  The best answer is A. Helping identify unauthorized or unmanaged devices connected to the network.

  An effective IT asset tracking system maintains visibility into the hardware, software, and devices that are authorized to exist in the environment. One major security benefit is that it helps identify systems that are: unauthorized unmanaged

  missing required security controls

  unknown to administrators

  This improves inventory control and helps security teams detect rogue or noncompliant devices.

  Why the other options are incorrect:

  B. Preventing prohibited data exfiltration from endpoints on the networkPreventing exfiltration is more directly the role of DLP and related controls, not asset tracking alone.

  C. Assisting with automated root cause analysis for all security incidents on the networkAsset tracking can support investigations, but it does not automatically perform root cause analysis for all incidents.

  D. Ensuring proper data backup and recovery procedures are in placeBackup and recovery are separate operational processes, not a direct benefit of asset tracking itself. From the SY0-701 perspective, maintaining an accurate asset inventory is foundational for identifying unauthorized or unmanaged devices, so A is the correct answer.

• Question 387:

  An attacker posing as the Chief Executive Officer calls an employee and instructs the employee to buy gift cards.

  Which of the following techniques is the attacker using?

  A. Smishing
  B. Disinformation
  C. Impersonating
  D. Whaling
  C. Impersonating

  ---

  Explanation

  Impersonating is the best answer because the attacker is pretending to be the Chief Executive Officer in order to pressure the employee into taking action. The defining technique in the scenario is the false claim of identity.

  Whaling is the weaker choice because whaling refers to a phishing attack aimed at high-profile targets such as executives. In this case, the executive is not the victim; the attacker is pretending to be the executive in order to deceive an employee. The attack may resemble CEO fraud in a broader sense, but the specific technique shown here is impersonation.

  Smishing involves SMS messages, and disinformation involves spreading false information broadly rather than directly deceiving a specific employee into making a purchase.

• Question 388:

  Which of the following teams combines both offensive and defensive testing techniques to protect an organization's critical systems?

  A. Red
  B. Blue
  C. Purple
  D. Yellow
  C. Purple

  ---

  Explanation

  Purple is the team that combines both offensive and defensive testing techniques to protect an organization's critical systems. Purple is not a separate team, but rather a collaboration between the red team and the blue team. The red team is the offensive team that simulates attacks and exploits vulnerabilities in the organization's systems. The blue team is the defensive team that monitors and protects the organization's systems from real and simulated threats. The purple team exists to ensure and maximize the effectiveness of the red and blue teams by integrating the defensive tactics and controls from the blue team with the threats and vulnerabilities found by the red team into a single narrative that improves the overall security posture of the organization. Red, blue, and yellow are other types of teams involved in security testing, but they do not combine both offensive and defensive techniques. The yellow team is the team that builds software solutions, scripts, and other programs that the blue team uses in the security testing.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 1331

  Penetration Testing: Understanding Red, Blue, & Purple Teams3

• Question 389:

  Employees located off-site must have access to company resources in order to complete their assigned tasks. These employees utilize a solution that allows remote access without interception concerns.

  Which of the following best describes this solution?

  A. Proxy server
  B. NGFW
  C. VPN
  D. Security zone
  C. VPN

  ---

  Explanation

  A Virtual Private Network (VPN) is the best solution to allow remote employees secure access to company resources without interception concerns. A VPN establishes an encrypted tunnel over the internet, ensuring that data transferred between remote employees and the company is secure from eavesdropping. Proxy server helps with web content filtering and anonymization but does not provide encrypted access.

  NGFW (Next-Generation Firewall) enhances security but is not the primary tool for enabling remote access.

  Security zone is a network segmentation technique but does not provide remote access capabilities.

• Question 390:

  The Chief Information Security Officer (CISO) asks a security analyst to install an OS update to a production VM that has a 99% uptime SLA. The CISO tells the analyst the installation must be done as quickly as possible.

  Which of the following courses of action should the security analyst take first?

  A. Log in to the server and perform a health check on the VM.
  B. Install the patch Immediately.
  C. Confirm that the backup service is running.
  D. Take a snapshot of the VM.
  D. Take a snapshot of the VM.

  ---

  Explanation

  Before applying any updates or patches to a production VM, especially one with a 99% uptime SLA, it is crucial to first take a snapshot of the VM. This snapshot serves as a backup that can be quickly restored in case the update causes any issues, ensuring that the system can be returned to its previous state without violating the SLA. This step mitigates risk and is a standard best practice in change management for critical systems.

  References:

  CompTIA Security+ SY0-701 study materials, focusing on change management and backup strategies.