CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 411:

  Which of the following is a known security risk associated with data archives that contain financial information?

  A. Data can become a liability if archived longer than required by regulatory guidance
  B. Data must be archived off-site to avoid breaches and meet business requirements
  C. Companies are prohibited from providing archived data to e-discovery requests
  D. Unencrypted archives should be preserved as long as possible and encrypted
  A. Data can become a liability if archived longer than required by regulatory guidance

  ---

  Explanation

  Data minimization has to be done to decrease liability

• Question 412:

  A business provides long-term cold storage services to banks that are required to follow regulator-imposed data retention guidelines. Banks that use these services require that data is disposed of in a specific manner at the conclusion of the regulatory threshold for data retention.

  Which of the following aspects of data management is the most important to the bank in the destruction of this data?

  A. Encryption
  B. Classification
  C. Certification
  D. Procurement
  B. Classification

• Question 413:

  A security analyst is reviewing alerts in the SIEM related to potential malicious network traffic coming from an employee's corporate laptop. The security analyst has determined that additional data about the executable running on the machine is necessary to continue the investigation.

  Which of the following logs should the analyst use as a data source?

  A. Application
  B. IPS/IDS
  C. Network
  D. Endpoint
  D. Endpoint

  ---

  Explanation

  An endpoint log is a file that contains information about the activities and events that occur on an end-user device, such as a laptop, desktop, tablet, or smartphone. Endpoint logs can provide valuable data for security analysts, such as the processes running on the device, the network connections established, the files accessed or modified, the user actions performed, and the applications installed or updated. Endpoint logs can also record the details of any executable files running on the device, such as the name, path, size, hash, signature, and permissions of the executable. An application log is a file that contains information about the events that occur within a software application, such as errors, warnings, transactions, or performance metrics. Application logs can help developers and administrators troubleshoot issues, optimize performance, and monitor user behavior. However, application logs may not provide enough information about the executable files running on the device, especially if they are malicious or unknown.

  An IPS/IDS log is a file that contains information about the network traffic that is monitored and analyzed by an intrusion prevention system (IPS) or an intrusion detection system (IDS). IPS/IDS logs can help security analysts identify and block potential attacks, such as exploit attempts, denial-of-service (DoS) attacks, or malicious scans. However, IPS/IDS logs may not provide enough information about the executable files running on the device, especially if they are encrypted, obfuscated, or use legitimate protocols. A network log is a file that contains information about the network activity and communication that occurs between devices, such as IP addresses, ports, protocols, packets, or bytes. Network logs can help security analysts understand the network topology, traffic patterns, and bandwidth usage. However, network logs may not provide enough information about the executable files running on the device, especially if they are hidden, spoofed, or use proxy servers.

  Therefore, the best log type to use as a data source for additional information about the executable running on the machine is the endpoint log, as it can provide the most relevant and detailed data about the executable file and its behavior.

  References:

  https://www.crowdstrike.com/cybersecurity-101/observability/application-log/

  https://owasp.org/www-project-proactive-controls/v3/en/c9-security-logging

• Question 414:

  Which of the following is most likely in a responsibility matrix in a cloud computing environment?

  A. The customer is responsible for information and data regardless of the cloud model used.
  B. The cloud provider is responsible for account and identity management for connected devices.
  C. The customer and the cloud provider share responsibility for the physical network infrastructure.
  D. The cloud provider is responsible for the security of endpoints connected to the infrastructure.
  A. The customer is responsible for information and data regardless of the cloud model used.

  ---

  Explanation

  The best answer is A. The customer is responsible for information and data regardless of the cloud model In cloud environments, a shared responsibility model defines which security duties belong to the cloud provider and which remain with the customer. While the exact split depends on whether the service is IaaS, PaaS, or SaaS, one responsibility that almost always remains with the customer is accountability for their information and data. The provider secures the cloud infrastructure, but the customer remains responsible for how their data is classified, handled, protected, and governed. Why the other options are incorrect:

  B. The cloud provider is responsible for account and identity management for connected devices. Identity and access management is typically at least partly the customer's responsibility, and often primarily so.

  C. The customer and the cloud provider share responsibility for the physical network infrastructure. Physical infrastructure is usually the cloud provider's responsibility, not shared in the way stated here.

  D. The cloud provider is responsible for the security of endpoints connected to the infrastructure. Endpoint security is normally the customer's responsibility. From the SY0-701 perspective, a responsibility matrix in cloud computing reflects the shared responsibility model, and the most consistently true statement here is A.

• Question 415:

  Which of the following is an example of a false negative vulnerability detection in a scan report?

  A. A vulnerability that does not actually exist
  B. A vulnerability that has already been remediated
  C. A result that shows no known vulnerability
  D. A zero-day vulnerability with a known remediation
  C. A result that shows no known vulnerability

  ---

  Explanation

  A false negative occurs when a security control or scanning tool fails to detect a vulnerability that actually exists. In vulnerability scanning, this means the scan reports a system as secure even though it is vulnerable. Therefore, a result that shows no known vulnerability is an example of a false negative if a vulnerability is present but undetected.

  CompTIA Security+ SY0-701 explains that false negatives are particularly dangerous because they provide a false sense of security, potentially leaving systems exposed to exploitation. Causes of false negatives include outdated vulnerability signatures, misconfigured scanners, credentialed scan failures, or unsupported legacy systems.

  Option A describes a false positive, where a vulnerability is reported but does not exist.

  Option B may indicate an outdated scan result, not necessarily a false negative.

  Option D is incorrect because zero-day vulnerabilities do not have known remediations and are typically not detected by signature-based scanners.

  Thus, the correct example of a false negative is C: A result that shows no known vulnerability.

• Question 416:

  An employee decides to collect PII data from the company's system for personal use. The employee compresses the data into a single encrypted file before sending the file to their personal email. The security department becomes aware of the attempted misuse and blocks the attachment from leaving the corporate environment.

  Which of the following types of employee training would most likely reduce the occurrence of this type of issue?

  A. Privacy legislation
  B. Social engineering
  C. Risk management
  D. Company compliance
  E. Phishing
  F. Remote work
  A. Privacy legislation
  D. Company compliance

• Question 417:

  Which of the following security concepts is being followed when implementing a product that offers protection against DDoS attacks?

  A. Availability
  B. Non-repudiation
  C. Integrity
  D. Confidentiality
  A. Availability

  ---

  Explanation

  When implementing a product that offers protection against Distributed Denial of Service (DDoS) attacks, the security concept being followed is availability. DDoS protection ensures that systems and services remain accessible to legitimate users even under attack, maintaining the availability of network resources.

  Availability: Ensures that systems and services are accessible when needed, which is directly addressed by DDoS protection.

  Non-repudiation: Ensures that actions or transactions cannot be denied by the involved parties, typically achieved through logging and digital signatures.

  Integrity: Ensures that data is accurate and has not been tampered with.

  Confidentiality: Ensures that information is accessible only to authorized individuals.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 1.2 - Summarize fundamental security concepts (Availability).

• Question 418:

  A user sends an email that includes a digital signature for validation.

  Which of the following security concepts would ensure that a user cannot deny that they sent the email?

  A. Non-repudiation
  B. Confidentiality
  C. Integrity
  D. Authentication
  A. Non-repudiation

  ---

  Explanation

  Comprehensive and Detailed Explanation From Exact Extract:

  Non-repudiation ensures that a sender cannot deny sending a message. Digital signatures provide non-repudiation because they use the sender's private key, which only the legitimate owner possesses. When the email recipient verifies the digital signature using the sender's public key, it proves the email was sent by the true owner of the private key and has not been altered.

  Confidentiality (B) ensures information is protected from unauthorized access and is usually achieved through encryption. Integrity (C) ensures data has not been modified, while authentication (D) verifies the identity of a user. Although digital signatures also support integrity and authentication, the specific property that prevents denial of sending the email is non-repudiation.

  Security+ SY0-701 highlights digital signatures as a cryptographic mechanism used for authentication, integrity, and non-repudiation, especially in email security, PKI systems, and secure messaging.

  Thus, the correct answer is Non-repudiation.

• Question 419:

  An organization plans to expand its operations internationally and needs to keep data at the new location secure. The organization wants to use the most secure architecture model possible.

  Which of the following models offers the highest level of security?

  A. Cloud-based
  B. Peer-to-peer
  C. On-premises
  D. Hybrid
  C. On-premises

  ---

  Explanation

  Cloud-based models provide strong security with features like encryption, redundancy, and disaster recovery, making it a secure choice for international operations.

• Question 420:

  Which of the following is the most likely benefit of conducting an internal audit?

  A. Findings are reported to shareholders.
  B. Reports are not formal and can be reassigned.
  C. Control gaps are identified for remediation.
  D. The need for external audits is eliminated.
  C. Control gaps are identified for remediation.