CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 491:

  A cybersecurity incident response team at a large company receives notification that malware is present on several corporate desktops. No known Indicators of compromise have been found on the network.

  Which of the following should the team do first to secure the environment?

  A. Contain the Impacted hosts
  B. Add the malware to the application blocklist.
  C. Segment the core database server.
  D. Implement firewall rules to block outbound beaconing
  A. Contain the Impacted hosts

  ---

  Explanation

  The first step in responding to a cybersecurity incident, particularly when malware is detected, is to contain the impacted hosts. This action prevents the spread of malware to other parts of the network, limiting the potential damage while further investigation and remediation actions are planned.

  References:

  CompTIA Security+ SY0-701 study materials, particularly on incident response procedures and the importance of containment in managing security incidents.

• Question 492:

  Various company stakeholders meet to discuss roles and responsibilities in the event of a security breach affecting offshore offices.

  Which of the following is this an example of?

  A. Tabletop exercise
  B. Penetration test
  C. Geographic dispersion
  D. Incident response
  A. Tabletop exercise

  ---

  Explanation

  A tabletop exercise is a discussion-based activity where stakeholders simulate a security breach scenario to identify gaps in response plans and clarify roles and responsibilities.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 5: Security Program Management, Section: "Incident Response Planning and Exercises".

• Question 493:

  Which of the following most accurately describes the order in which a security engineer should implement secure baselines?

  A. Deploy, maintain, establish
  B. Establish, maintain, deploy
  C. Establish, deploy, maintain
  D. Deploy, establish, maintain
  C. Establish, deploy, maintain

  ---

  Explanation

  The correct sequence is to first establish secure baselines by determining the required configurations, deploy those configurations across systems, and finally maintain the configurations through regular updates and auditing.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 4: Security Operations, Section: "Secure Baseline Development".

• Question 494:

  Which of the following would best ensure a controlled version release of a new software application?

  A. Business continuity planning
  B. Quantified risk analysis
  C. Static code analysis
  D. Change management procedures
  D. Change management procedures

• Question 495:

  A business is expanding to a new country and must protect customers from accidental disclosure of specific national identity information.

  Which of the following should the security engineer update to best meet business requirements?

  A. SIEM
  B. SCAP
  C. DLP
  D. WAF
  C. DLP

  ---

  Explanation

  The requirement is to prevent the accidental disclosure of national identity information-highly sensitive personal data. The best solution is DLP (Data Loss Prevention). DLP tools monitor, detect, and block unauthorized transmission or exposure of sensitive data across: Email Cloud storage Endpoints Networks Databases

  In Security+ SY0-701, DLP is specifically recommended for ensuring compliance with privacy regulations, including those related to national identifiers (e.g., Social Security numbers, national ID numbers).

  A SIEM (A) aggregates logs but does not prevent data leakage. SCAP (B) provides standardized security configuration assessments, unrelated to data protection. A WAF (D) helps protect web applications but does not prevent sensitive data exfiltration.

  Since the requirement focuses on preventing accidental disclosure, DLP is the only technology capable of detecting, labeling, blocking, and reporting attempts to move or expose sensitive national identity data.

  Therefore, the correct answer is C.

• Question 496:

  A security administrator observed the following in a web server log while investigating an incident:

  "GET ../../../../etc/passwd"

  Which of the following attacks did the security administrator most likely see?

  A. Privilege escalation
  B. Credential replay
  C. Brute force
  D. Directory traversal
  D. Directory traversal

  ---

  Explanation

  The log entry GET ../../../../etc/passwd indicates a directory traversal attack. Directory traversal is an attack technique that attempts to access files and directories outside the web server's root directory by using sequences like ../ to move up the directory tree. In this case, the attacker is attempting to reach the /etc/passwd file, which typically contains user account information on Unix-based systems. This type of attack can allow unauthorized access to sensitive files on the server.

• Question 497:

  An accounting employee recently used software that was not approved by the company.

  Which of the following risks does this most likely represent?

  A. Unskilled attacker
  B. Hacktivist
  C. Shadow IT
  D. Supply chain
  C. Shadow IT

• Question 498:

  A security analyst is reviewing the following logs about a suspicious activity alert for a user ' s VPN log-ins.

  Which of the following malicious activity indicators triggered the alert? #Log Summary: User logs in fromChicago, ILmultiple times, then suddenly a successful login appears fromRome, Italy, followed again by Chicago logins - all within ashort time span.

  A. Impossible travel
  B. Account lockout
  C. Blocked content
  D. Concurrent session usage
  A. Impossible travel

  ---

  Explanation

  Impossible travel (A)refers to logins fromgeographically distant locations within a time period that makes travel between them physically impossible. In this case, a user logging in fromChicago and Rome within a short timeframetriggers this anomaly.

  This is a strong indicator of acompromised accountorstolen credentialsbeing used elsewhere.

  References:

  CompTIA Security+ SY0-701

  Objectives, Domain 2.1 - "Indicators of malicious activity: Impossible travel (geolocation anomalies)."

• Question 499:

  Which of the following explains how to determine the global regulations that data is subject to regardless of the country where the data is stored?

  A. Geographic dispersion
  B. Data sovereignty
  C. Geographic restrictions
  D. Data segmentation
  B. Data sovereignty

  ---

  Explanation

  Data sovereignty refers to the principle that data is subject to the laws and regulations of the country where it originated, regardless of where it is stored. This concept ensures that data complies with the legal requirements of its country of origin, even when stored or processed across borders.

• Question 500:

  A systems administrator is working on a solution with the following requirements:

  1. Provide a secure zone.

  2. Enforce a company-wide access control policy.

  3. Reduce the scope of threats.

  Which of the following is the systems administrator setting up?

  A. Zero Trust
  B. AAA
  C. Non-repudiation
  D. CIA
  A. Zero Trust

  ---

  Explanation

  Zero Trust is a security model that assumes no trust for any entity inside or outside the network perimeter and requires continuous verification of identity and permissions. Zero Trust canprovide a secure zone by isolating and protecting sensitive data and resources from unauthorized access. Zero Trust can also enforce a company-wide access control policy by applying the principle of least privilege and granular segmentation for users, devices, and applications. Zero Trust can reduce the scope of threats by preventing lateral movement and minimizing the attack surface.

  References:

  5: This source explains the concept and benefits of Zero Trust security and how it differs from traditional security models.

  8: This source provides an overview of Zero Trust identity security and how it can help verify the identity and integrity of users and devices.