CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 31:

  Which of the following is the main consideration when a legacy system that is a critical part of a company's infrastructure cannot be replaced?

  A. Resource provisioning
  B. Cost
  C. Single point of failure
  D. Complexity
  C. Single point of failure

  ---

  Explanation

  When a legacy system that is critical to a company's infrastructure cannot be replaced, the primary consideration is that it may become a single point of failure. This is because legacy systems are often difficult to support, lack redundancy, and may no longer receive updates, making them vulnerable. Ensuring that this critical system is protected from failure is essential to maintain continuity and reduce the risk of operational disruptions.

• Question 32:

  A software development team asked a security administrator to recommend techniques that should be used to reduce the chances of the software being reverse engineered.

  Which of the following should the security administrator recommend?

  A. Digitally signing the software
  B. Performing code obfuscation
  C. Limiting the use of third-party libraries
  D. Using compile flags
  B. Performing code obfuscation

• Question 33:

  A security analyst and the management team are reviewing the organizational performance of a recent phishing campaign. The user click-through rate exceeded the acceptable risk threshold, and the management team wants to reduce the impact when a user clicks on a link in a phishing message.

  Which of the following should the analyst do?

  A. Place posters around the office to raise awareness of common phishing activities.
  B. Implement email security filters to prevent phishing emails from being delivered
  C. Update the EDR policies to block automatic execution of downloaded programs.
  D. Create additional training for users to recognize the signs of phishing attempts.
  C. Update the EDR policies to block automatic execution of downloaded programs.

  ---

  Explanation

  An endpoint detection and response (EDR) system is a security tool that monitors and analyzes the activities and behaviors of endpoints, such as computers, laptops, mobile devices, and servers. An EDR system can detect, prevent, and respond to various types of threats, such as malware, ransomware, phishing, and advanced persistent threats (APTs). One of the features of an EDR system is to block the automatic execution of downloaded programs, which can prevent malicious code from running on the endpoint when a user clicks on a link in a phishing message. This can reduce the impact of a phishing attack and protect the endpoint from compromise. Updating the EDR policies to block automatic execution of downloaded programs is a technical control that can mitigate the risk of phishing, regardless of the user's awareness or behavior. Therefore, this is the best answer among the given options. The other options are not as effective as updating the EDR policies, because they rely on administrative or physical controls that may not be sufficient to prevent or stop a phishing attack. Placing posters around the office to raise awareness of common phishing activities is a physical control that can increase the user's knowledge of phishing, but it may not change their behavior or prevent them from clicking on a link in a phishing message. Implementing email security filters to prevent phishing emails from being delivered is an administrative control that can reduce the exposure to phishing, but it may not be able to block all phishing emails, especially if they are crafted to bypass the filters. Creating additional training for users to recognize the signs of phishing attempts is an administrative control that can improve the user's skills of phishing detection, but it may not guarantee that they will always be vigilant or cautious when receiving an email.

  Therefore, these options are not the best answer for this question.

  References:

  Endpoint Detection and Response -CompTIA Security+ SY0-701 -2.2, video at 5:30

  CompTIA Security+ SY0- 701 Certification Study Guide, page 163.

• Question 34:

  A systems administrator needs to encrypt all data on employee laptops.

  Which of the following encryption levels should be implemented?

  A. Volume
  B. Partition
  C. Full disk
  D. File
  C. Full disk

• Question 35:

  A security analyst wants to better understand the behavior of users and devices in order to gain visibility into potential malicious activities. The analyst needs a control to detect when actions deviate from a common baseline.

  Which of the following should the analyst use?

  A. Intrusion prevention system
  B. Sandbox
  C. Endpoint detection and response
  D. Antivirus
  C. Endpoint detection and response

  ---

  Explanation

  Endpoint Detection and Response (EDR) solutions provide visibility into the behavior of users and devices, monitoring for deviations from established baselines. EDR tools are designed to detect suspicious activities by continuously analyzing endpoint behaviors, which helps identify potential threats, including malicious activities, that may otherwise go unnoticed. This is particularly useful for spotting deviations from normal patterns and enhancing security response.

• Question 36:

  A retail company receives a request to remove a customer's data.

  Which of the following is the retail company considered under GDPR legislation?

  A. Data processor
  B. Data controller
  C. Data subject
  D. Data custodian
  B. Data controller

  ---

  Explanation

  Under GDPR, the data controller determines the purposes and means of processing personal data. The retail company, which collects and manages customer data, is responsible for complying with data deletion requests and thus acts as the data controller.

• Question 37:

  A program manager wants to ensure contract employees can only use the company's computers Monday through Friday from 9 a.m. to 5 p.m.

  Which of the following would best enforce this access control?

  A. Creating a GPO for all contract employees and setting time-of-day log-in restrictions
  B. Creating a discretionary access policy and setting rule-based access for contract employees
  C. Implementing an OAuth server and then setting least privilege for contract employees
  D. Implementing SAML with federation to the contract employees' authentication server
  A. Creating a GPO for all contract employees and setting time-of-day log-in restrictions

• Question 38:

  A security analyst is reviewing a secure website that is generating TLS certificate errors. The analyst determines that the browser is unable to receive a response from the OCSP for the certificate.

  Which of the following actions would most likely resolve the issue?

  A. Run a traceroute on the OCSP domain to find where the domain is failing.
  B. Create an exclusion for the OCSP domain in the content filter
  C. Unblock the OCSP protocol in the host-based firewall
  D. Add the root certificate to the trusted sites on the workstation with the issue.
  C. Unblock the OCSP protocol in the host-based firewall

• Question 39:

  During a risk treatment exercise, an administrator discovers a risk that cannot be mitigated.

  Which of the following best describes this situation?

  A. Residual risk
  B. Risk appetite
  C. Reviewed risk
  D. Risk register
  A. Residual risk

  ---

  Explanation

  The correct answer is A. Residual risk.

  Residual risk is the risk that remains after safeguards, controls, or mitigation strategies have been applied. In some cases, a risk cannot be fully eliminated or mitigated. The organization must then decide whether to accept, transfer, avoid, or further manage the remaining risk.

  This aligns with CompTIA Security+ SY0-701 risk management concepts, especially risk treatment, risk acceptance, risk tolerance, and residual risk.

  Why the other options are incorrect:

  B. Risk appetite Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its objectives. It does not specifically describe a risk that remains after mitigation attempts.

  C. Reviewed risk This is not the best formal risk management term for a risk that cannot be mitigated.

  D. Risk register A risk register is a document or system used to track identified risks, risk owners, likelihood, impact, treatment plans, and status. It does not describe the remaining risk itself. Therefore, a risk that cannot be fully mitigated is best described as residual risk.

• Question 40:

  During a recent breach, employee credentials were compromised when a service desk employee issued an MFA bypass code to an attacker who called and posed as an employee.

  Which of the following should be used to prevent this type of incident in the future?

  A. Hardware token MFA
  B. Biometrics
  C. Identity proofing
  D. Least privilege
  C. Identity proofing

  ---

  Explanation

  To prevent the issuance of an MFA bypass code to an attacker posing as an employee, implementing identity proofing would be most effective. Identity proofing involves verifying the identity of individuals before granting access or providing sensitive information.

  Identity proofing: Ensures that the person requesting the MFA bypass is who they claim to be, thereby preventing social engineering attacks where attackers pose as legitimate employees.

  Hardware token MFA: Provides an additional factor for authentication but does not address verifying the requester's identity.

  Biometrics: Offers strong authentication based on physical characteristics but is not related to the process of issuing MFA bypass codes. Least privilege: Limits access rights for users to the bare minimum necessary to perform their work but does not prevent social engineering attacks targeting the service desk.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 4.6 - Implement and maintain identity and access management (Identity proofing).