CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 451:

  An employee who was working remotely lost a mobile device containing company data.

  Which of the following provides the best solution to prevent future data loss?

  A. MDM
  B. DLP
  C. FDE
  D. EDR
  A. MDM

  ---

  Explanation

  MDM allows an organization to remotely manage, monitor, and secure mobile devices used by employees, especially when they contain company data. With MDM, administrators can enforce security policies, remotely lock or wipe lost or stolen devices, and ensure compliance with data protection policies, thereby mitigating the risk of data loss.

• Question 452:

  A new corporate policy requires all staff to use multifactor authentication to access company resources.

  Which of the following can be utilized to set up this form of identity and access management? (Choose two.)

  A. Authentication tokens
  B. Least privilege
  C. Biometrics
  D. LDAP
  E. Password vaulting
  F. SAML
  A. Authentication tokens
  C. Biometrics

  ---

  Explanation

  Authentication tokens: Tokens, such as hardware or software-based one-time password (OTP) generators, are commonly used as one factor in multifactor authentication (MFA). They provide an additional layer of security beyond just a password.

  Biometrics: Biometric factors, such as fingerprint scans or facial recognition, are another common component of MFA, providing a "something you are" factor for identity verification.

  These factors, when combined with something the user knows (e.g., a password), fulfill the requirements for MFA by incorporating multiple layers of authentication.

• Question 453:

  Which of the following is used to quantitatively measure the criticality of a vulnerability?

  A. CVE
  B. CVSS
  C. CIA
  D. CERT
  B. CVSS

  ---

  Explanation

  CVSS stands for Common Vulnerability Scoring System, which is a framework that provides a standardized way to assess and communicate the severity and risk of vulnerabilities. CVSS uses a set of metrics and formulas to calculate a numerical score ranging from 0 to 10, where higher scores indicate higher criticality. CVSS can help organizations prioritize remediation efforts and compare vulnerabilities across different systems and vendors. The other options are not used to measure the criticality of a vulnerability, but rather to identify, classify, or report them.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 39

• Question 454:

  Which of the following is used to conceal credit card information in a database log file?

  A. Tokenization
  B. Masking
  C. Hashing
  D. Obfuscation
  B. Masking

• Question 455:

  A company's legal department drafted sensitive documents in a SaaS application and wants to ensure the documents cannot be accessed by individuals in high-risk countries.

  Which of the following is the most effective way to limit this access?

  A. Data masking
  B. Encryption
  C. Geolocation policy
  D. Data sovereignty regulation
  C. Geolocation policy

  ---

  Explanation

  A geolocation policy is a policy that restricts or allows access to data or resources based on the geographic location of the user or device. A geolocation policy can be implemented using various methods, such as IP address filtering, GPS tracking, or geofencing. A geolocation policy can help the company's legal department to prevent unauthorized access to sensitive documents from individuals in high-risk countries. The other options are not effective ways to limit access

  based on location:

  Data masking: This is a technique of obscuring or replacing sensitive data with fictitious or anonymized data. Data masking can protect the privacy and confidentiality of data, but it does not prevent access to data based on location.

  Encryption: This is a process of transforming data into an unreadable format using a secret key or algorithm. Encryption can protect the integrity and confidentiality of data, but it does not prevent access to data based on location. Encryption can also be bypassed by attackers who have the decryption key or method. Data sovereignty regulation: This is a set of laws or rules that govern the storage, processing, and transfer of data within a specific jurisdiction or country. Data sovereignty regulation can affect the availability and compliance of data, but it does not prevent access to data based on location. Data sovereignty regulation can also vary depending on the country or region.

  References:

  1: CompTIA Security+ SY0-701 Certification Study Guide, page 97

  2: Account Policies -SY0-601 CompTIA Security+ : 3.7, video by Professor Messer

  3: CompTIA Security+ SY0-701 Certification Study Guide, page 100

  4: CompTIA Security+ SY0-701 Certification Study Guide, page 101. : CompTIA Security+ SY0-701 Certification Study Guide, page 102.

• Question 456:

  An administrator is reviewing a single server's security logs and discovers the following:

  

  Which of the following best describes the action captured in this log file?

  A. Brute-force attack
  B. Privilege escalation
  C. Failed password audit
  D. Forgotten password by the user
  A. Brute-force attack

  ---

  Explanation

  A brute-force attack is a type of attack that involves systematically trying all possible combinations of passwords or keys until the correct one is found. The log file shows multiple failed login attempts in a short amount of time, which is a characteristic of a brute-force attack. The attacker is trying to guess the password of the Administrator account on the server. The log file also shows the event ID 4625, which indicates a failed logon attempt, and the status code 0xC000006A, which means the user name is correct but the password is wrong. These are indicators of compromise (IoC) that suggest a brute-force attack is taking place.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 215-216 and 223

• Question 457:

  Which of the following can best contribute to prioritizing patch applications?

  A. CVSS
  B. SCAP
  C. OSINT
  D. CVE
  A. CVSS

• Question 458:

  A security analyst must recover files from a USB drive associated with a ransomware attack.

  Which of the following tools will help the analyst securely retrieve the files?

  A. Sandboxing environment
  B. Intrusion prevention system
  C. File integrity management tool
  D. Static code analysis tool
  A. Sandboxing environment

  ---

  Explanation

  The best answer is A. Sandboxing environment. A USB drive associated with a ransomware attack should be treated as highly suspicious. To securely retrieve files without risking infection of production systems, the analyst should use a sandboxing environment. A sandbox provides an isolated environment where files can be opened, examined, and extracted while containing any malicious behavior. This is the safest option because ransomware may execute automatically or contain hidden malicious payloads. Why the other options are incorrect:

  B. Intrusion prevention systemAn IPS monitors and blocks malicious network traffic. It does not provide a secure environment for opening files from a suspicious USB drive.

  C. File integrity management toolFile integrity monitoring detects changes to files, but it is not designed to safely retrieve files from potentially malicious media.

  D. Static code analysis toolStatic code analysis is used to inspect source code for vulnerabilities. It is not intended for safely interacting with suspicious files on removable media. From the SY0-701 perspective, suspicious files and removable media should be handled in an isolated sandbox to reduce the risk of malware execution. Therefore, A is the correct answer.

• Question 459:

  The security operations center is researching an event concerning a suspicious IP address. A security analyst looks at the following event logs and discovers that a significant portion of the user accounts have experienced faded log-In attempts when authenticating from the same IP address:

  

  Which of the following most likely describes attack that took place?

  A. Spraying
  B. Brute-force
  C. Dictionary
  D. Rainbow table
  A. Spraying

  ---

  Explanation

  Password spraying is a type of attack where an attacker tries a small number of commonly used passwords across a large number of accounts. The event logs showing failed login attempts for many user accounts from the same IP address are indicative of a password spraying attack, where the attacker is attempting to gain access by guessing common passwords.

  References:

  CompTIA Security+ SY0-701 study materials, particularly in the domain of identity and access management and common attack vectors like password spraying.

• Question 460:

  A software developer would like to ensure the source code cannot be reverse engineered or debugged.

  Which of the following should the developer consider?

  A. Version control
  B. Obfuscation toolkit
  C. Code reuse
  D. Continuous integration
  E. Stored procedures
  B. Obfuscation toolkit

  ---

  Explanation

  An obfuscation toolkit is used by developers to make source code difficult to understand and reverse engineer. This technique involves altering the code's structure and naming conventions without changing its functionality, making it much harder for attackers to decipher the code or use debugging tools to analyze it. Obfuscation is an important practice in protecting proprietary software and intellectual property from reverse engineering.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 03 Security Architecture. CompTIA Security+ SY0-601 Study Guide: Chapter on Secure Coding Practices.