CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 481:

  The security team has been asked to only enable host A (10.2.2.7) and host B (10.3.9.9) to the new isolated network segment (10.9.8.14) that provides access to legacy devices.

  Access from all other hosts should be blocked.

  Which of the following entries would need to be added on the firewall?

  

  A. Option A
  B. Option B
  C. Option C
  D. Option D
  C. Option C

  ---

  Explanation

  Permit 10.2.2.7/32 to 10.9.8.14/27: This rule allows host A (10.2.2.7) specific access to the isolated network (10.9.8.14/27). Permit 10.3.9.9/32 to 10.9.8.14/27: This rule allows host B (10.3.9.9) specific access to the isolated network

  (10.9.8.14/27).

  Deny 0.0.0.0/0 to 10.9.8.14/27: This rule blocks access from all other IPs to the isolated network (10.9.8.14/27).

• Question 482:

  A security administrator protects passwords by using hashing.

  Which of the following best describes what the administrator is doing?

  A. Adding extra characters at the end to increase password length
  B. Generating a token to make the passwords temporal
  C. Using mathematical algorithms to make passwords unique
  D. Creating a rainbow table to protect passwords in a list
  C. Using mathematical algorithms to make passwords unique

• Question 483:

  While a school district is performing state testing, a security analyst notices all internet services are unavailable. The analyst discovers that ARP poisoning is occurring on the network and then terminates access for the host.

  Which of the following is most likely responsible for this malicious activity?

  A. Unskilled attacker
  B. Shadow IT
  C. Insider threat
  D. Nation-state
  C. Insider threat

• Question 484:

  A security analyst notices unusual behavior on the network. The IDS on the network was not able to detect the activities.

  Which of the following should the security analyst use to help the IDS detect such attacks in the future?

  A. Signatures
  B. Trends
  C. Honeypot
  D. Reputation
  A. Signatures

• Question 485:

  Which of the following is the best reason to perform a tabletop exercise?

  A. To address audit findings
  B. To collect remediation response times
  C. To update the IRP
  D. To calculate the ROI
  C. To update the IRP

  ---

  Explanation

  The primary reason to perform a tabletop exercise is to test and validate the Incident Response Plan (IRP) in a simulated environment. This helps identify gaps, refine procedures, and ensure that the plan is up-to-date and effective in addressing current threats and scenarios. Regular tabletop exercises improve organizational preparedness for real-world incidents.

• Question 486:

  Which of the following is the primary purpose of a service that tracks log-ins and time spent using the service?

  A. Availability
  B. Accounting
  C. Authentication
  D. Authorization
  B. Accounting

  ---

  Explanation

  Accounting logs user activities such as log-ins and usage duration, which is part of the AAA framework (Authentication, Authorization, and Accounting).

• Question 487:

  An enterprise has been experiencing attacks focused on exploiting vulnerabilities in older browser versions with well-known exploits.

  Which of the following security solutions should be configured to best provide the ability to monitor and block these known signature-based attacks?

  A. ACL
  B. DLP
  C. IDS
  D. IPS
  D. IPS

  ---

  Explanation

  An intrusion prevention system (IPS) is a security device that monitors network traffic and blocks or modifies malicious packets based on predefined rules or signatures. An IPS can prevent attacks that exploit known vulnerabilities in older browser versions by detecting and dropping the malicious packets before they reach the target system. An IPS can also perform other functions, such as rate limiting, encryption, or redirection.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, Chapter 3: Securing Networks, page 132.

• Question 488:

  A security analyst is reviewing the logs on an organization's DNS server and notices the following unusual snippet:

  

  Which of the following attack techniques was most likely used?

  A. Determining the organization's ISP-assigned address space
  B. Bypassing the organization's DNS sinkholing
  C. Footprinting the internal network
  D. Attempting to achieve initial access to the DNS server
  E. Exfiltrating data from fshare.int.complia.org
  C. Footprinting the internal network

• Question 489:

  A visitor plugs a laptop into a network jack in the lobby and is able to connect to the company's network.

  Which of the following should be configured on the existing network infrastructure to best prevent this activity?

  A. Port security
  B. Web application firewall
  C. Transport layer security
  D. Virtual private network
  A. Port security

• Question 490:

  A security analyst learns that an attack vector, used as part of a recent incident, was a well-known IoT device exploit. The analyst needs to review logs to identify the time of the initial exploit.

  Which of the following logs should the analyst review first?

  A. Endpoint
  B. Application
  C. Firewall
  D. NAC
  C. Firewall

  ---

  Explanation

  Firewall logs provide details of all network traffic, including connections to and from IoT devices. They are typically the first source of evidence for identifying the time of an exploit.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 4: Security Operations, Section: "Log Analysis for Incident Response".