CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 461:

  Which of the following best describes a method for ongoing vendor monitoring in third-party risk management?

  A. Requiring a new MSA for each project
  B. Accepting vendor self-attestation without further verification
  C. Conducting assessments to verify compliance with security requirements
  D. Reviewing SLAs at the start of the contract
  C. Conducting assessments to verify compliance with security requirements

  ---

  Explanation

  Ongoing vendor monitoring is a critical component of third-party risk management (TPRM) and focuses on continuously validating that vendors maintain required security controls throughout the lifecycle of the relationship. According to CompTIA Security+ SY0-701, the most effective ongoing monitoring method is conducting assessments to verify compliance with security requirements. These assessments may include periodic security questionnaires, audits, penetration test results, SOC reports, or compliance attestations that are independently validated.

  Option A, requiring a new MSA for each project, is a contractual activity, not a monitoring mechanism. Option B-accepting self-attestation without verification-introduces risk and is specifically discouraged in SY0-701 because it lacks assurance. Option D, reviewing SLAs at contract start, is a one-time activity and does not provide continuous oversight.

  Ongoing assessments allow organizations to detect control drift, identify new risks, and ensure vendors remain compliant with evolving regulatory and security expectations. This proactive approach is essential for managing supply chain risk and protecting organizational data.

  Therefore, the correct answer is C: Conducting assessments to verify compliance with security requirements.

• Question 462:

  A company uses multiple providers to send its marketing, internal, and support emails. Many of the emails are marked as spam.

  Which of the following changes should the company make to ensure legitimate emails are validated?

  A. Disable DKIM to avoid signature conflicts.
  B. Implement DMARC with a " reject " policy to enforce sender validation.
  C. Replace the domain ' s MX record with the marketing provider ' s services.
  D. Update the SPF record to include all authorized sending sources.
  D. Update the SPF record to include all authorized sending sources.

  ---

  Explanation

  The best answer is D. Update the SPF record to include all authorized sending sources. SPF (Sender Policy Framework) is used to identify which mail servers and third-party services are authorized to send email on behalf of a domain. In this scenario, the company uses multiple providers for marketing, internal, and support emails. If all of those sending sources are not properly listed in the domain's SPF record, receiving mail servers may treat some valid messages as suspicious or spam. Updating the SPF record to include all legitimate sending providers helps recipient systems validate that the email came from an approved source. This directly addresses the problem of legitimate emails being flagged. Why the other options are incorrect:

  A. Disable DKIM to avoid signature conflicts.This is incorrect because DKIM helps validate message authenticity by using digital signatures. Disabling it would weaken email validation rather than improve it.

  B. Implement DMARC with a " reject " policy to enforce sender validation.DMARC is important, but a reject policy can cause legitimate messages to fail if SPF and DKIM are not configured correctly first. DMARC builds on SPF and DKIM; it does not replace the need to authorize all sending sources.

  C. Replace the domain ' s MX record with the marketing provider ' s services.MX records control where incoming email is received, not which systems are authorized to send email. This would not solve the validation issue for outbound messages. From a Security+ perspective, this question focuses on email security controls and proper configuration of SPF, DKIM, and DMARC. The most direct fix for multiple legitimate senders is to ensure the SPF record includes every authorized provider.

• Question 463:

  A company receives an alert that a network device vendor, which is widely used in the enterprise, has been banned by the government.

  Which of the following will the company's general counsel most likely be concerned with during a hardware refresh of these devices?

  A. Sanctions
  B. Data sovereignty
  C. Cost of replacement
  D. Loss of license
  A. Sanctions

  ---

  Explanation

  When the government bans a vendor, the primary concern for the company's general counsel is sanctions, which are legal restrictions that prohibit the purchase, use, import, or continued operation of products associated with restricted entities. Security+ SY0-701 stresses that compliance with government regulations and legal mandates is a critical oversight responsibility. Failure to comply may result in severe penalties, including fines, loss of contracting eligibility, and reputational damage.

  During a hardware refresh, general counsel will ensure the organization is not violating federal trade sanctions, procurement laws, or export/import restrictions. Even if devices are already purchased, continued use may still violate the sanctions, creating legal liability.

  Data sovereignty (B) relates to storage location requirements, not vendor bans. Cost of replacement (C) is an operational and financial concern, not a legal one. Loss of license (D) typically applies to software but is not the primary legal concern tied to a government-issued vendor ban. Therefore, sanctions are the general counsel's primary focus.

• Question 464:

  Which of the following methods can be used to detect attackers who have successfully infiltrated a network? (Choose two.)

  A. Tokenization
  B. CI/CD
  C. Honeypots
  D. Threat modeling
  E. DNS sinkhole
  F. Data obfuscation
  C. Honeypots
  E. DNS sinkhole

• Question 465:

  Which of the following should a company use to provide proof of external network security testing?

  A. Business impact analysis
  B. Supply chain analysis
  C. Vulnerability assessment
  D. Third-party attestation
  D. Third-party attestation

  ---

  Explanation

  Third-party attestation involves an external, independent party performing a network security assessment and providing documented proof, ensuring objectivity and compliance with regulatory or client requirements.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 5: Security Program Management, Section: "Compliance and Security Audits".

• Question 466:

  An analyst is reviewing an incident in which a user clicked on a link in a phishing email.

  Which of the following log sources would the analyst utilize to determine whether the connection was successful?

  A. Network
  B. System
  C. Application
  D. Authentication
  A. Network

  ---

  Explanation

  To determine whether the connection was successful after a user clicked on a link in a phishing email, the most relevant log source to analyze would be the network logs. These logs would provide information on outbound and inbound traffic, allowing the analyst to see if the user's system connected to the remote server specified in the phishing link. Network logs can include details such as IP addresses, domains accessed, and the success or failure of connections, which are crucial for understanding the impact of the phishing attempt.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 04 Security Operations. CompTIA Security+ SY0-601 Study Guide: Chapter on Incident Response.

• Question 467:

  The private key for a website was stolen, and a new certificate has been issued.

  Which of the following needs to be updated next?

  A. SCEP
  B. CRL
  C. OCSP
  D. CSR
  B. CRL

  ---

  Explanation

  The Certificate Revocation List (CRL) should be updated when a private key is compromised. The CRL is a list of certificates that have been revoked by the issuing Certificate Authority (CA) and are no longer trusted. Updating the CRL ensures that clients and systems know the previous certificate is no longer valid, preventing it from being trusted even if the key has been compromised.

• Question 468:

  A company hired a consultant to perform an offensive security assessment covering penetration testing and social engineering.

  Which of the following teams will conduct this assessment activity?

  A. White
  B. Purple
  C. Blue
  D. Red
  D. Red

  ---

  Explanation

  A red team is a group of security professionals who perform offensive security assessments covering penetration testing and social engineering. A red team simulates real-world attacks and exploits the vulnerabilities of a target organization, system, or network. A red team aims to test the effectiveness of the security controls, policies, and procedures of the target, as well as the awareness and response of the staff and the blue team. A red team can be hired as an external consultant or formed internally within the organization.

  References:

  18. CompTIA Security+ (SY0-701) Certification Exam Objectives, Domain 1.8, page

  4. Security Teams -SY0- 601

  CompTIA Security+ : 1.8

• Question 469:

  A company makes a change during the appropriate change window, but the unsuccessful change extends beyond the scheduled time and impacts customers.

  Which of the following would prevent this from reoccurring?

  A. User notification
  B. Change approval
  C. Risk analysis
  D. Backout plan
  D. Backout plan

• Question 470:

  A company discovered its data was advertised for sale on the dark web. During the initial investigation, the company determined the data was proprietary data.

  Which of the following is the next step the company should take?

  A. Identify the attacker's entry methods.
  B. Report the breach to the local authorities.
  C. Notify the applicable parties of the breach.
  D. Implement vulnerability scanning of the company's systems.
  A. Identify the attacker's entry methods.

  ---

  Explanation

  The next step after discovering proprietary data on the dark web is to identify the attacker's entry methods. Understanding how the attacker gained access to the data is critical for closing any security gaps and preventing further breaches.

  This step involves investigating vulnerabilities or misconfigurations that allowed the data to be accessed and exfiltrated, which will inform subsequent remediation actions.