CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 401:

  Which of the following best represents how frequently an incident is expected to happen each year?

  A. RTO
  B. ALE
  C. SLE
  D. ARO
  D. ARO

  ---

  Explanation

  The best answer is D. ARO. ARO (Annualized Rate of Occurrence) measures how often a specific incident or event is expected to happen in a single year. This is the risk analysis attribute that directly represents yearly frequency. Why the other options are incorrect:

  A. RTORecovery Time Objective is the target time to restore operations after a disruption. It does not measure incident frequency.

  B. ALEAnnualized Loss Expectancy estimates the expected yearly financial loss from a risk. It is calculated using other values and reflects cost, not frequency alone.

  C. SLESingle Loss Expectancy is the monetary loss expected from one occurrence of an incident. It does not represent how often the event happens. From the SY0-701 perspective, risk calculations often use:ALE = SLE x ARO Since the question asks how frequently an incident is expected to happen each year, the correct answer is ARO.

• Question 402:

  Due to a cyberattack, a company's IT systems were not operational for an extended period of time. The company wants to measure how quickly the systems must be restored in order to minimize business disruption.

  Which of the following would the company most likely use?

  A. Recovery point objective
  B. Risk appetite
  C. Risk tolerance
  D. Recovery time objective
  E. Mean time between failure
  D. Recovery time objective

  ---

  Explanation

  The Recovery Time Objective (RTO) refers to the maximum acceptable amount of time that an IT system can be down after an incident before causing significant disruption to the business. This metric is used to set restoration goals and minimize business impact. RTO helps the company define how quickly the systems need to be restored to resume normal operations.

• Question 403:

  A government worker secretly copies classified files that contain defense tactics information to an external drive. The government worker then gives the external drive to a corrupt organization.

  Which of the following best describes the motivation of the worker?

  A. Espionage
  B. Data exfiltration
  C. Financial gain
  D. Blackmail
  A. Espionage

• Question 404:

  Which of the following data states applies to data that is being actively processed by a database server?

  A. In use
  B. At rest
  C. In transit
  D. Being hashed
  A. In use

  ---

  Explanation

  Data "in use" refers to data actively being accessed, processed, or modified by an application or system, such as a database server. This is distinct from data "at rest," which is stored but not actively accessed, and data "in transit," which is being transmitted over a network.

• Question 405:

  Which of the following is a benefit of launching a bug bounty program? (Select two)

  A. Transference of risk to a third party
  B. Reduction in the number of zero-day vulnerabilities
  C. Increased security awareness for the workforce
  D. Reduced cost of managing the program
  E. Quicker discovery of vulnerabilities
  F. Improved patch management process
  B. Reduction in the number of zero-day vulnerabilities
  E. Quicker discovery of vulnerabilities

  ---

  Explanation

  Bug bounty programs invite vetted external researchers to report software vulnerabilities in exchange for rewards. According to Security+ SY0-701, two major benefits are:

  (1) Reduction in the number of zero-day vulnerabilities (B) - Ethical hackers can discover unknown vulnerabilities before malicious attackers do. These vulnerabilities are often zero-days because they are unknown to vendors at the time of discovery. Bug bounty programs surface these issues early, helping organizations mitigate severe risks proactively.

  (2) Quicker discovery of vulnerabilities (E) - A distributed network of global security researchers can identify vulnerabilities far faster than an internal team alone. This accelerates detection, increases coverage, and lowers attacker dwell time.

  Option A (Transference of risk) is incorrect because bug bounties do not transfer risk-they help identify vulnerabilities. C (Security awareness) relates to internal training, not bug bounties. D (Reduced cost) is misleading; bug bounties can be expensive depending on payout structure. F (Patch management) does not directly improve through bug bounty programs.

  Therefore, the correct benefits are B and E.

• Question 406:

  Which of the following is the final step of the modern response process?

  A. Lessons learned
  B. Eradication
  C. Containment
  D. Recovery
  A. Lessons learned

  ---

  Explanation

  The final step in the incident response process is "Lessons learned." This step involves reviewing and analyzing the incident to understand what happened, how it was handled, and what could be improved. The goal is to improve future response efforts and prevent similar incidents from occurring. It's essential for refining the incident response plan and enhancing overall security posture.

  References:

  CompTIA Security+ SY0-701 study materials, particularly in the domain of incident response and recovery.

• Question 407:

  Which of the following security controls is used to isolate externally accessible resources from the internal corporate network in order to reduce the attack surface?

  A. Faraday cages
  B. Demilitarized zone (DMZ)
  C. Vaulting
  D. Proximity readers
  B. Demilitarized zone (DMZ)

  ---

  Explanation

  A demilitarized zone (DMZ) is a network segment that separates public-facing services from the internal network. It allows external access to services such as web or email servers while preventing direct access to internal systems, thereby reducing the attack surface.

• Question 408:

  Which of the following is a qualitative approach to risk analysis?

  A. Including the MTTR and MTBF as part of the risk assessment
  B. Tracking and documenting network risks using a risk register
  C. Assigning a level of high, medium, or low to the risk rating
  D. Using ALE and ARO to help determine whether a risk should be mitigated
  C. Assigning a level of high, medium, or low to the risk rating

• Question 409:

  An external vendor recently visited a company's headquarters tor a presentation. Following the visit a member of the hosting team found a file that the external vendor left behind on a server. The file contained detailed architecture information and code snippets.

  Which of the following data types best describes this file?

  A. Government
  B. Public
  C. Proprietary
  D. Critical
  C. Proprietary

  ---

  Explanation

  The file left by the external vendor, containing detailed architecture information and code snippets, is best described as proprietary data. Proprietary data is information that is owned by a company and is essential to its competitive advantage.

  It includes sensitive business information such as trade secrets, intellectual property, and confidential data that should be protected from unauthorized access.

  References:

  CompTIA Security+ SY0-701 study materials, particularly in the domain of data classification and protection.

• Question 410:

  After performing an assessment, an analyst wants to provide a risk rating for the findings.

  Which of the following concepts should most likely be considered when calculating the ratings?

  A. Owners and thresholds
  B. Impact and likelihood
  C. Appetite and tolerance
  D. Probability and exposure factor
  B. Impact and likelihood

  ---

  Explanation

  When calculating risk ratings, the concepts of impact and likelihood are most likely to be considered. Risk assessment typically involves evaluating the potential impact of a threat (how severe the consequences would be if the threat materialized) and the likelihood of the threat occurring (how probable it is that the threat will occur).

  Impact: Measures the severity of the consequences if a particular threat exploits a vulnerability. It considers factors such as financial loss, reputational damage, and operational disruption.

  Likelihood: Measures the probability of a threat exploiting a vulnerability. This can be based on historical data, current threat landscape, and expert judgment.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 5.2 - Risk management process (Risk assessment: impact and likelihood).