CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 451:

  A company needs to determine whether authentication weaknesses in a customer-facing web application exist.

  Which of the following is the best technique to use?

  A. Static analysis
  B. Packet capture
  C. Agent-based scanning
  D. Dynamic analysis
  E. Network-based scanning
  D. Dynamic analysis

  ---

  Explanation

  To identify authentication weaknesses in a customer-facing web application, the best method is dynamic analysis, also known as Dynamic Application Security Testing (DAST). Dynamic analysis evaluates an application while it is running, allowing testers to observe real-world interactions, session handling, login mechanisms, credential validation, access control failures, and runtime vulnerabilities such as brute-force weaknesses or authentication bypass conditions.

  Security+ SY0-701 outlines DAST as the preferred approach for testing live web applications because it uncovers:

  Weak session management

  Broken authentication flows

  Input validation failures

  Misconfigurations in login portals

  Runtime vulnerabilities that static code review cannot detect

  Static analysis (A) only analyzes source code and may overlook logic flaws in authentication. Packet capture (B) inspects network traffic but cannot evaluate internal authentication logic. Agent-based scanning (C) is used for hosts, not web applications. Network-based scanning (E) finds port-level vulnerabilities but cannot assess application authentication mechanisms.

  Therefore, dynamic analysis (D) is the most effective and accurate technique for discovering authentication weaknesses in live web applications.

• Question 452:

  Which of the following threat vectors is most commonly utilized by insider threat actors attempting data exfiltration?

  A. Unidentified removable devices
  B. Default network device credentials
  C. Spear phishing emails
  D. Impersonation of business units through typosquatting
  A. Unidentified removable devices

  ---

  Explanation

  Unidentified removable devices, such as USB drives, are a common threat vector for insider threat actors attempting data exfiltration. Insiders can easily use these devices to transfer sensitive data out of the organization undetected, making it one of the most commonly utilized methods for data theft.

  Default network device credentials are a security vulnerability but not typically used for data exfiltration.

  Spear phishing emails are used for external attacks, not insider data exfiltration. Impersonation through typosquatting is typically used by external actors for phishing or fraud.

• Question 453:

  A customer has a contract with a CSP and wants to identify which controls should be implemented in the IaaS enclave.

  Which of the following is most likely to contain this information?

  A. Statement of work
  B. Responsibility matrix
  C. Service-level agreement
  D. Master service agreement
  B. Responsibility matrix

  ---

  Explanation

  A responsibility matrix clarifies the division of responsibilities between the cloud service provider (CSP) and the customer, ensuring that each party understands and implements their respective security controls.

  References:

  Security+ SY0-701 Course Content.

• Question 454:

  Which of the following would be the greatest concern for a company that is aware of the consequences of non-compliance with government regulations?

  A. Right to be forgotten
  B. Sanctions
  C. External compliance reporting
  D. Attestation
  B. Sanctions

  ---

  Explanation

  Sanctions imposed for non-compliance can include fines, legal actions, and loss of business licenses. These pose a significant financial and reputational risk to organizations.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 5: Security Program Management, Section: "Regulatory Compliance Risks".

• Question 455:

  A security analyst reviews logs and finds a large number of malicious requests that have caused performance issues on the company ' s site.

  Which of the following would have most likely prevented this attack?

  A. IPSec
  B. TLS
  C. SDN
  D. WAF
  D. WAF

  ---

  Explanation

  The best answer is D. WAF.

  A WAF (Web Application Firewall) is designed to inspect and filter malicious HTTP and HTTPS traffic aimed at a web application. If a site is receiving a large number of malicious requests that are causing performance problems, a WAF is the best control among these options because it can detect and block harmful web requests before they impact the application.

  This can help mitigate attacks such as: malicious web requests application-layer abuse some denial-of-service style request floods common web exploits

  Why the other options are incorrect:

  A. IPSecIPSec secures network-layer communications, not malicious web request filtering.

  B. TLSTLS encrypts data in transit, but it does not stop malicious requests.

  C. SDNSoftware-defined networking helps manage network architecture, but it is not the most direct preventive control for malicious web traffic. From a Security+ standpoint, malicious requests against a web application are best mitigated by a WAF, so D is correct.

• Question 456:

  Several universities are participating in a collaborative research project and need to share compute and storage resources.

  Which of the following cloud deployment strategies would BEST meet this need?

  A. Community
  B. Private
  C. Public
  D. Hybrid
  A. Community

  ---

  Explanation

  Community cloud storage is a variation of the private cloud storage model, which offers cloud solutions for specific businesses or communities. In this model, cloud storage providers offer their cloud architecture, software and other development tools to meet the requirements of the community. A community cloud in computing is a collaborative effort in which infrastructure is shared between several organizations from a specific community with common concerns (security, compliance, jurisdiction, etc.), whether managed internally or by a third-party and hosted internally or externally.

• Question 457:

  Visitors to a secured facility are required to check in with a photo ID and enter the facility through an access control vestibule.

  Which of the following but describes this form of security control?

  A. Physical
  B. Managerial
  C. Technical
  D. Operational
  A. Physical

  ---

  Explanation

  A physical security control is a device or mechanism that prevents unauthorized access to a physical location or asset. An access control vestibule, also known as a mantrap, is a physical security control that consists of a small space with two sets of interlocking doors, such that the first set of doors must close before the second set opens. This prevents unauthorized individuals from following authorized individuals into the facility, a practice known as piggybacking or tailgating. A photo ID check is another form of physical security control that verifies the identity of visitors. Managerial, technical, and operational security controls are not directly related to physical access, but rather to policies, procedures, systems, and processes that support security objectives.

  References:

  CompTIA Security+ Study Guide: Exam SY0- 701, 9th Edition, page 341

  Mantrap (access control) - Wikipedia

• Question 458:

  A systems administrator receives a text message from an unknown number claiming to be the Chief Executive Officer of the company. The message states an emergency situation requires a password reset.

  Which of the following threat vectors is being used?

  A. Typosquatting
  B. Smishing
  C. Pretexting
  D. Impersonation
  B. Smishing

  ---

  Explanation

  Smishing is a type of phishing attack that uses SMS text messages to deceive recipients into taking actions such as revealing sensitive information. The urgency in the text indicates this vector.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 2: Threats, Section: "Social Engineering Techniques".

• Question 459:

  Which of the following is the best way to provide secure remote access for employees while minimizing the exposure of a company's internal network?

  A. VPN
  B. LDAP
  C. FTP
  D. RADIUS
  A. VPN

  ---

  Explanation

  A VPN (Virtual Private Network) is a secure method to provide employees with remote access to a company's network. It encrypts data, protecting it from interception and ensuring secure communication between the user and the internal network.

  References:

  Security+ SY0-701 Course Content, Security+ SY0-601 Book.

• Question 460:

  A security team created a document that details the order in which critical systems should be through back online after a major outage.

  Which of the following documents did the team create?

  A. Communication plan
  B. Incident response plan
  C. Data retention policy
  D. Disaster recovery plan
  D. Disaster recovery plan

  ---

  Explanation

  The document described in the question is a Disaster Recovery Plan (DRP). A DRP outlines the process and procedures for restoring critical systems and operations after a major disruption or outage. It includes the order in which systems should be brought back online to ensure minimal impact on business operations, prioritizing the most critical systems to recover first.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 5: Security Program Management and Oversight, which discusses the development and implementation of disaster recovery plans.