CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 41:

  An administrator is reviewing a single server's security logs and discovers the following;

  

  Which of the following best describes the action captured in this log file?

  A. Brute-force attack
  B. Privilege escalation
  C. Failed password audit
  D. Forgotten password by the user
  A. Brute-force attack

  ---

  Explanation

  A brute-force attack is a type of attack that involves systematically trying all possible combinations of passwords or keys until the correct one is found. The log file shows multiple failed login attempts in a short amount of time, which is a characteristic of a brute-force attack. The attacker is trying to guess the password of the Administrator account on the server. The log file also shows the event ID 4625, which indicates a failed logon attempt, and the status code 0xC000006A, which means the user name is correct but the password is wrong. These are indicators of compromise (IoC) that suggest a brute-force attack is taking place.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 215-216 and 223

• Question 42:

  A company would like to provide employees with computers that do not have access to the internet in order to prevent information from being leaked to an online forum.

  Which of the following would be best for the systems administrator to implement?

  A. Air gap
  B. Jump server
  C. Logical segmentation
  D. Virtualization
  A. Air gap

  ---

  Explanation

  To provide employees with computers that do not have access to the internet and prevent information leaks to an online forum, implementing an air gap would be the best solution. An air gap physically isolates the computer or network from any outside connections, including the internet, ensuring that data cannot be transferred to or from the system.

  Air gap: A security measure that isolates a computer or network from the internet or other networks, preventing any form of electronic communication with external systems. Jump server: A secure server used to access and manage devices in a different security zone, but it does not provide isolation from the internet. Logical segmentation: Segregates networks using software or network configurations, but it does not guarantee complete isolation from the internet.

  Virtualization: Creates virtual instances of systems, which can be isolated, but does not inherently prevent internet access without additional configurations.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 2.5 - Explain the purpose of mitigation techniques used to secure the enterprise (Air gap).

• Question 43:

  Which of the following data types relates to data sovereignty?

  A. Data classified as public in other countries
  B. Personally Identifiable data while traveling
  C. Health data shared between doctors in other nations
  D. Data at rest outside of a country's borders
  D. Data at rest outside of a country's borders

• Question 44:

  An organization is adopting cloud services at a rapid pace and now has multiple SaaS applications in use. Each application has a separate log-in, so the security team wants to reduce the number of credentials each employee must maintain.

  Which of the following is the first step the security team should take?

  A. Enable SAML
  B. Create OAuth tokens.
  C. Use password vaulting.
  D. Select an IdP
  D. Select an IdP

  ---

  Explanation

  The first step in reducing the number of credentials each employee must maintain when using multiple SaaS applications is to select an Identity Provider (IdP). An IdP provides a centralized authentication service that supports Single Sign-On (SSO), enabling users to access multiple applications with a single set of credentials. Enabling SAML would be part of the technical implementation but comes after selecting an IdP.

  OAuth tokens are used for authorization, but selecting an IdP is the first step in managing authentication.

  Password vaulting stores multiple passwords securely but doesn't reduce the need for separate logins.

• Question 45:

  Which of the following security concepts is accomplished when granting access after an individual has logged into a computer network?

  A. Authorization
  B. Identification
  C. Non-repudiation
  D. Authentication
  A. Authorization

  ---

  Explanation

  Authorization refers to the process of granting or denying specific rights to a user after verifying their identity through authentication.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 1: General Security Concepts, Section:"Authentication, Authorization, and Accounting (AAA)".

• Question 46:

  A security team is reviewing the findings in a report that was delivered after a third party performed a penetration test. One of the findings indicated that a web application form field is vulnerable to cross-site scripting.

  Which of the following application security techniques should the security analyst recommend the developer implement to prevent this vulnerability?

  A. Secure cookies
  B. Version control
  C. Input validation
  D. Code signing
  C. Input validation

  ---

  Explanation

  Input validation is a technique that checks the user input for any malicious or unexpected data before processing it by the web application. Input validation can prevent cross-site scripting (XSS) attacks, which exploit the vulnerability of a web application to execute malicious scripts in the browser of a victim. XSS attacks can compromise the confidentiality, integrity, and availability of the web application and its users. Input validation can be implemented on both the client-side and the server-side, but server-side validation is more reliable and secure. Input validation can use various methods, such as whitelisting, blacklisting, filtering, escaping, encoding, and sanitizing the input data.

  References:

  70. CompTIA Security+ (SY0-701) Certification Exam Objectives, Domain 3.2, page

  11. Application Security - SY0-601

  CompTIA Security+ : 3.2

• Question 47:

  A security report shows that during a two-week test period, 80% of employees unwittingly disclosed their SSO credentials when accessing an external website. The organization purposely created the website to simulate a cost-free password complexity test.

  Which of the following would best help reduce the number of visits to similar websites in the future?

  A. Block all outbound traffic from the intranet.
  B. Introduce a campaign to recognize phishing attempts.
  C. Restrict internet access for the employees who disclosed credentials.
  D. Implement a deny list of websites.
  B. Introduce a campaign to recognize phishing attempts.

• Question 48:

  A company asks a vendor to help its internal red team with a penetration test without providing too much detail about the infrastructure.

  Which of the following penetration testing methods does this scenario describe?

  A. Passive reconnaissance
  B. Partially-known environment
  C. Integrated testing
  D. Defensive testing
  B. Partially-known environment

  ---

  Explanation

  This scenario describes a partially-known environment penetration test. In CompTIA Security+ SY0-701, penetration testing approaches are commonly categorized as black box (unknown), white box (fully known), and gray box (partially known). A partially-known environment means the tester is given limited information-enough to be realistic and efficient, but not complete details about the infrastructure.

  Here, the vendor is assisting an internal red team and is intentionally not provided with extensive infrastructure details, which mirrors a gray-box testing approach. This method balances realism and efficiency by simulating an attacker who has some knowledge (such as credentials, architecture diagrams, or application details) but not full access or documentation.

  Passive reconnaissance (A) is an activity within testing, not a testing methodology. Integrated testing (C) refers to coordinated testing involving multiple teams (e.g., red and blue teams) with full cooperation. Defensive testing (D) focuses on validating defensive controls rather than simulating an attacker's perspective.

  Therefore, the correct answer is B: Partially-known environment.

• Question 49:

  An organization that handles sensitive information wants to protect the information by using a reversible technology.

  Which of the following best satisfies this requirement?

  A. Hardware security module
  B. Hashing algorithm
  C. Tokenization
  D. Steganography
  C. Tokenization

  ---

  Explanation

  Tokenization is a reversible technology that replaces sensitive information (such as credit card numbers or personal data) with a non-sensitive placeholder (a token). The original data can be retrieved from the token through a secure process, making tokenization ideal for situations where sensitive data needs to be protected but still be recoverable in a controlled manner. Unlike hashing, which is irreversible, tokenization provides a way to securely protect and retrieve sensitive information when necessary.

• Question 50:

  The management team reports employees are missing features on company-provided tablets, causing productivity issues. The team directs IT to resolve the issue within 48 hours.

  Which of the following is the best solution?

  A. EDR
  B. COPE
  C. MDM
  D. FDE
  C. MDM

  ---

  Explanation

  The best solution is Mobile Device Management (MDM), which allows IT administrators to centrally configure, update, and push applications or settings to company-owned devices. When employees report missing features or misconfigurations, MDM platforms enable rapid remote remediation, policy enforcement, patch distribution, and application deployment-all of which can be completed within the 48-hour requirement.

  Security+ SY0-701 emphasizes MDM as the primary tool for ensuring consistent configuration baselines, enforcing security restrictions, deploying apps, and preventing unauthorized changes on mobile devices.

  EDR (A) provides threat detection, not configuration restoration. COPE (B) is a device ownership model (Corporate Owned, Personally Enabled); it does not solve configuration issues.

  FDE (D) encrypts storage, unrelated to missing features.

  Therefore, C: MDM is the correct answer.