CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 431:

  An administrator is creating a secure method for a contractor to access a test environment.

  Which of the following would provide the contractor with the best access to the test environment?

  A. Application server
  B. Jump server
  C. RDP server
  D. Proxy server
  B. Jump server

• Question 432:

  A systems administrator notices that a testing system is down. While investigating, the systems administrator finds that the servers are online and accessible from any device on the server network. The administrator reviews the following information from the monitoring system:

  

  Which of the following is the most likely cause of the outage?

  A. Denial of service
  B. ARP poisoning
  C. Jamming
  D. Kerberoasting
  D. Kerberoasting

• Question 433:

  Which of the following best describes the practice of researching laws and regulations related to information security operations within a specific industry?

  A. Compliance reporting
  B. GDPR
  C. Due diligence
  D. Attestation
  C. Due diligence

  ---

  Explanation

  Due diligence refers to the process of researching and understanding the laws, regulations, and best practices that govern information security within a specific industry. Organizations are required to conduct due diligence to ensure compliance with legal and regulatory requirements, which helps mitigate risks and avoid penalties. Compliance reporting involves generating reports to demonstrate adherence to legal or regulatory standards.

  GDPR is a specific regulation governing data privacy in the EU, not a general practice of researching laws.

  Attestation is a formal declaration that an organization is compliant with a set of standards but is not the act of researching the laws.

• Question 434:

  A user's workstation becomes unresponsive and displays a ransom note demanding payment to decrypt files. Before the attack, the user opened a resume they received in a message, browsed the company's website, and installed OS updates.

  Which of the following is the most likely vector of this attack?

  A. Spear-phishing attachment
  B. Watering hole
  C. Infected website
  D. Typosquatting
  A. Spear-phishing attachment

  ---

  Explanation

  The most likely vector of this attack is a spear-phishing attachment. The user opened a resume received in a message, which is a common method used in spear-phishing attacks. These attacks often involve sending a specifically crafted attachment (like a resume) to the targeted user. Once the attachment is opened, it could trigger malware, such as ransomware, which encrypts files on the system and displays a ransom note. This attack vector aligns with the described symptoms, as the user interacted with the malicious attachment before experiencing the ransomware infection.

• Question 435:

  Which of the following is the most relevant reason a DPO would develop a data inventory?

  A. To manage data storage requirements better
  B. To determine the impact in the event of a breach
  C. To extend the length of time data can be retained
  D. To automate the reduction of duplicated data
  B. To determine the impact in the event of a breach

  ---

  Explanation

  A data inventory provides a comprehensive overview of what data the organization holds, where it is stored, and its sensitivity. This information is crucial for assessing the potential impact of a data breach, as it allows the DPO to identify which data would be affected and the associated risks. Additionally, it aids in compliance with data protection regulations by ensuring that sensitive data is adequately managed and protected.

• Question 436:

  SIMULATION

  An organization has learned that its data is being exchanged on the dark web. The CIO

  has requested that you investigate and implement the most secure solution to protect employee accounts.

  INSTRUCTIONS

  Review the data to identify weak security practices and provide the most appropriate

  security solution to meet the CIO's requirements.

  

  A. See the Explanation part for all the Solution
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the Explanation part for all the Solution

  ---

  Explanation

  Step 1: Analyze the Data and Question

  Scenario:

  Company data (directory, compensation report, user data) is found on the dark web.

  CIO asks you to investigate and implement the most secure protection for employee accounts.

  Task:

  Identify weak password practices.

  Choose the best containment step that keeps evidence on the host uncompromised.

  Step 2: Identify Weak Password Practices

  Prompt: Select all weak password practices from the list:

  Age

  Reuse

  Length

  Expiration

  Complexity

  Let's analyze each:

  Age: If passwords are used for a long time without change, it's a weak practice (passwords become easier to compromise over time).

  Reuse: Reusing passwords across accounts is a serious weak practice (if one gets leaked, all accounts are at risk).

  Length: Short passwords are weak; password length matters. If passwords are too short, that's a weak practice.

  Expiration: Forcing frequent expiration can lead to weaker passwords (users pick simple ones), but not expiring passwords at all is also risky. (For most exams, "expiration" by itself isn't usually called a weak practice unless the policy is poorly set.)

  Complexity: Lack of complexity (not requiring numbers, symbols, etc.) is a weak practice.

  So, select all that are truly weak practices:

  Answer for weak password practices (check all that apply):

  Age

  Reuse

  Length

  Complexity

  (Expiration is more controversial; on the exam, the main focus is usually on Age, Reuse, Length, and Complexity.)

  Step 3: Choose the Best Containment Step

  Prompt:

  Select the containment step that will leave potential evidence on the host uncompromised:

  PIN code

  FIDO security key

  SMS authentication

  OTP token

  Containment step means "what security solution can you implement to protect employee accounts going forward, while preserving digital evidence on potentially compromised systems?"

  The most secure solution for account protection among these, that also doesn't interfere with host evidence, is FIDO security key.

  Why?

  PIN code: Not strong enough; also may be stored locally.

  SMS authentication: Can be intercepted; often leaves traces on the host (like SMS logs).

  OTP token: Similar risks, some implementations might log to the host.

  FIDO security key: Hardware-based, phishing-resistant, no codes sent to the host, and doesn't alter host evidence-authentication happens off the device.

  So, the best answer is:

  FIDO security key

  Step 4: Solution Recap and Justification

  Detailed Solution Recap:

  Identify weak password practices:

  Weaknesses: passwords are reused, not long enough, lack complexity, and used for a long time.

  Select the best security solution: Implement FIDO security keys for employees.

  Most secure among listed options.

  Hardware-based; resistant to phishing, interception, and does not leave evidence on the compromised host (which is important for forensics).

• Question 437:

  While analyzing SIEM alerts for a company ' s WAF, an incident response analyst observes the following:

  https://corporate-A.com/loadimage?filename=/etc/ https://corporate-A.com/loadimage?filename=../../etc/passwd https://corporate-A.com/loadimage?filename=.

  /etc/passwd Which of the following best describes the observed behavior?

  A. Credential replay
  B. Directory traversal
  C. Brute-force attack
  D. Resource exhaustion
  B. Directory traversal

  ---

  Explanation

  The best answer is B. Directory traversal. The URLs show attempts to manipulate the filename parameter in order to access sensitive files and directories on the server, especially: /etc/../../etc/passwd./etc/passwd.

  This is a classic directory traversal attack, also known as path traversal. The attacker is trying to move outside the intended directory structure and access protected operating system files. The reference to /etc/passwd is a common indicator of an attempt to read sensitive files on Unix/Linux systems. Why the other options are incorrect:

  A. Credential replayCredential replay involves reusing captured authentication credentials, which is not what these requests show.

  C. Brute-force attackA brute-force attack involves repeated guessing, usually of passwords, keys, or codes. That is not the behavior shown here.

  D. Resource exhaustionResource exhaustion involves overwhelming a system with requests or usage to reduce availability. These examples instead show attempts to access files through manipulated paths. From a Security+ standpoint, attacks using../ to escape directories are a well-known example of directory traversal, so B is the correct answer.

• Question 438:

  Which of the following should a systems administrator set up to increase the resilience of an application by splitting the traffic between two identical sites?

  A. Load balancing
  B. Geographic disruption
  C. Failover
  D. Parallel processing
  A. Load balancing

  ---

  Explanation

  To increase the resilience of an application by splitting the traffic between two identical sites, a systems administrator should set up load balancing. Load balancing distributes network or application traffic across multiple servers or sites, ensuring no single server becomes overwhelmed and enhancing the availability and reliability of applications. Load balancing: Distributes traffic across multiple servers to ensure high availability and reliability. It helps in managing the load efficiently and can prevent server overloads.

  Geographic disruption: Not a standard term related to resilience. This might imply the use of geographically distributed sites but isn't the precise solution described.

  Failover: Refers to switching to a standby server or system when the primary one fails. It doesn't inherently split traffic but rather takes over when a failure occurs. Parallel processing: Refers to the simultaneous processing of tasks, not specifically related to load balancing web traffic.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 4.4 - Security operations (Enhancing security capabilities: load balancing).

• Question 439:

  The Chief Information Security Officer wants to prevent exfiltration of sensitive information from employee cell phones when using public USB power charging stations.

  Which of the following would be the BEST solution to Implement?

  A. DLP
  B. USB data blocker
  C. USB OTG
  D. Disabling USB ports
  B. USB data blocker

  ---

  Explanation

  The best solution to prevent exfiltration of sensitive information from employee cell phones when using public USB power charging stations would be to use a USB data blocker. A USB data blocker is a device that can be used to physically block the data pins on a USB cable, preventing data transfer while still allowing the device to be charged. This would prevent employees from accidentally or maliciously transferring sensitive data from their cell phones to the public charging station. Options A, C, and D would not be effective in preventing this type of data exfiltration

• Question 440:

  An organization designs an inbound firewall with a fail-open configuration while implementing a website.

  Which of the following would the organization consider to be the highest priority?

  A. Confidentiality
  B. Non-repudiation
  C. Availability
  D. Integrity
  C. Availability

  ---

  Explanation

  A fail-open configuration prioritizes availability, ensuring that services remain accessible even if the firewall encounters an issue. This approach minimizes downtime for critical resources, such as a website, but may temporarily compromise other aspects of security like confidentiality or integrity. This configuration is often chosen when maintaining access is of utmost importance.