CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 471:

  A penetration tester begins an engagement by performing port and service scans against the client environment according to the rules of engagement.

  Which of the following reconnaissance types is the tester performing?

  A. Active
  B. Passive
  C. Defensive
  D. Offensive
  A. Active

  ---

  Explanation

  Active reconnaissance is a type of reconnaissance that involves sending packets or requests to a target and analyzing the responses. Active reconnaissance can reveal information such as open ports, services, operating systems, and vulnerabilities. However, active reconnaissance is also more likely to be detected by the target or its security devices, such as firewalls or intrusion detection systems. Port and service scans are examples of active reconnaissance techniques, as they involve probing the target for specific information.

  References:

  CompTIA Security+ Certification Exam Objectives, Domain 1.1: Given a scenario, conduct reconnaissance using appropriate techniques and tools. CompTIA Security+ Study Guide (SY0-701), Chapter 2: Reconnaissance and Intelligence Gathering, page 47. CompTIA Security+ Certification Exam SY0-701 Practice Test

• Question 472:

  Which of the following best describes configuring devices to log to an off-site location for possible future reference?

  A. Log aggregation
  B. DLP
  C. Archiving
  D. SCAP
  A. Log aggregation

  ---

  Explanation

  Configuring devices to log to an off-site location for possible future reference is best described as log aggregation. Log aggregation involves collecting logs from multiple sources and storing them in a centralized location, often off-site, to ensure they are preserved and can be analyzed in the future.

  Log aggregation: Centralizes log data from multiple devices, making it easier to analyze and ensuring logs are available for future reference.

  DLP (Data Loss Prevention): Focuses on preventing unauthorized data transfer and ensuring data security.

  Archiving: Involves storing data for long-term retention, which could be part of log aggregation but is broader in scope.

  SCAP (Security Content Automation Protocol): A standard for automating vulnerability management and policy compliance.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 4.4 - Explain security alerting and monitoring concepts and tools (Log aggregation).

• Question 473:

  Which of the the stage in an investigationthe stage in an investigationthe stage in an investigation are obtained?

  A. Acquisition
  B. Preservation
  C. Reporting
  D. E-discovery
  A. Acquisition

  ---

  Explanation

  The acquisition phase involves creating forensic images (exact replicas) of storage devices or memory to ensure data integrity for further analysis.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 4: Security Operations, Section: "Forensic Imaging and Chain of Custody".

• Question 474:

  A penetration tester enters an office building at the same time as a group of employees despite not having an access badge.

  Which of the following attack types is the penetration tester performing?

  A. Tailgating
  B. Shoulder surfing
  C. RFID cloning
  D. Forgery
  A. Tailgating

  ---

  Explanation

  Tailgating is a social engineering technique where an unauthorized person gains access to a restricted area by following closely behind authorized individuals without their knowledge or consent. In this scenario, the penetration tester enters the office building at the same time as a group of employees despite not having an access badge, which exemplifies tailgating.

• Question 475:

  Which of the following should a systems administrator use to decrease the company's hardware attack surface?

  A. Replication
  B. Isolation
  C. Centralization
  D. Virtualization
  B. Isolation

• Question 476:

  Which of the following is a type of vulnerability that involves inserting scripts into web-based applications in order to take control of the client's web browser?

  A. SQL injection
  B. Cross-site scripting
  C. Zero-day exploit
  D. On-path attack
  B. Cross-site scripting

  ---

  Explanation

  Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into a website, which are then executed in the user's web browser, potentially leading to data theft or session hijacking.

  References:

  Security+ SY0-701 Course Content, Security+ SY0-601 Book.

• Question 477:

  An MSSP manages firewalls for hundreds of clients.

  Which of the following tools would be most helpful to create a standard configuration template in order to improve the efficiency of firewall changes?

  A. SNMP
  B. Benchmarks
  C. Netflow
  D. SCAP
  B. Benchmarks

• Question 478:

  An organization has too many variations of a single operating system and needs to standardize the arrangement prior to pushing the system image to users.

  Which of the following should the organization implement first?

  A. Standard naming convention
  B. Mashing
  C. Network diagrams
  D. Baseline configuration
  D. Baseline configuration

  ---

  Explanation

  Baseline configuration is the process of standardizing the configuration settings for a system or network. In this scenario, the organization needs to standardize the operating system configurations before deploying them across the network.

  Establishing a baseline configuration ensures that all systems adhere to the organization's security policies and operational requirements.

  References:

  CompTIA Security+ SY0-701 study materials, particularly in the domain of system hardening and configuration management.

• Question 479:

  An analyst discovers a suspicious item in the SQL Server logs.

  Which of the following could be evidence of an attempted SQL injection?

  A. cat /etc/shadow
  B. dig 25.36.99.11
  C. cd .. / .. / .. /
  D. UserId = 10 OR 1=1;
  D. UserId = 10 OR 1=1;

• Question 480:

  Which of the following is most likely to be used as a just-in-time reference document within a security operations center?

  A. Change management policy
  B. Risk profile
  C. Playbook
  D. SIEM profile
  C. Playbook

  ---

  Explanation

  A playbook provides step-by-step procedures for responding to specific types of security incidents, making it an essential just-in-time reference during active incidents. SOC analysts rely on playbooks to quickly access instructions and guidance for consistent and effective response actions.