CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 501:

  Which of the following is a benefit of vendor diversity?

  A. Patch availability
  B. Zero-day resiliency
  C. Secure configuration guide applicability
  D. Load balancing
  B. Zero-day resiliency

  ---

  Explanation

  Vendor diversity can help mitigate the impact of zero-day vulnerabilities. By using multiple vendors for similar services or components, organizations reduce the likelihood that a single vulnerability affecting one vendor's products will compromise the entire system. This diversity creates resilience against attacks exploiting unknown vulnerabilities in any single vendor's software.

• Question 502:

  A user downloads a patch from an unknown repository. FIM alerts indicate OS file hashes have changed.

  Which attack most likely occurred?

  A. Logic bomb
  B. Keylogger
  C. Ransomware
  D. Rootkit
  D. Rootkit

  ---

  Explanation

  The scenario indicates that a user downloaded an unofficial patch and applied it. Afterward, system files changed, which was detected by FIM. This strongly suggests the presence of a rootkit, which is designed to embed itself deeply into the operating system, altering core system files, modifying kernels, and hiding its presence.

  Rootkits commonly replace or modify OS-level files, which results in changed file hashes--exactly what FIM is detecting. Rootkits often gain privileged, persistent control and are frequently disguised as legitimate updates or patches.

  A logic bomb (A) is triggered by an event but does not typically modify OS files. A keylogger (B) captures keystrokes but generally does not modify system files broadly. Ransomware (C) encrypts files rather than silently altering system components.

  Thus, the best match is D: Rootkit.

• Question 503:

  A company is changing its mobile device policy. The company has the following requirements:

  1. Company-owned devices

  2. Ability to harden the devices

  3. Reduced security risk

  4. Compatibility with company resources

  Which of the following would best meet these requirements?

  A. BYOD
  B. CYOD
  C. COPE
  D. COBO
  C. COPE

  ---

  Explanation

  COPE (Corporate-Owned, Personally Enabled) devices allow companies to manage and harden company-owned devices while still enabling limited personal use, reducing security risks while maintaining compatibility with corporate resources.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 3: Security Architecture, Section: "Mobile Device Deployment Models".

• Question 504:

  A client asked a security company to provide a document outlining the project, the cost, and the completion time frame.

  Which of the following documents should the company provide to the client?

  A. MSA
  B. SLA
  C. BPA
  D. SOW
  D. SOW

  ---

  Explanation

  An ISOW is a document that outlines the project, the cost, and the completion time frame for a security company to provide a service to a client. ISOW stands for Information Security Operations Work, and it is a type of contract that specifies the scope, deliverables, milestones, and payment terms of a security project. An ISOW is usually used for one-time or short-term projects that have a clear and defined objective and outcome. For example, an ISOW can be used for a security assessment, a penetration test, a security audit, or a security training.

  The other options are not correct because they are not documents that outline the project, the cost, and the completion time frame for a security company to provide a service to a client. A MSA is a master service agreement, which is a type of contract that establishes the general terms and conditions for a long-term or ongoing relationship between a security company and a client. A MSA does not specify the details of each individual project, but rather sets the framework for future projects that will be governed by separate statements of work (SOWs). A SLA is a service level agreement, which is a type of contract that defines the quality and performance standards for a security service provided by a security company to a client. A SLA usually includes the metrics, targets, responsibilities, and penalties for measuring and ensuring the service level. A BPA is a business partnership agreement, which is a type of contract that establishes the roles and expectations for a strategic alliance between two or more security companies that collaborate to provide a joint service to a client. A BPA usually covers the objectives, benefits, risks, and obligations of the partnership.

  References:

  CompTIA Security+ Study Guide (SY0-701), Chapter 8: Governance, Risk, and Compliance, page 387. Professor Messer's CompTIA SY0-701 Security+ Training Course, Section 8.2: Compliance and Controls, video: Contracts and Agreements (5:12).

• Question 505:

  Which of the following describes the procedures a penetration tester must follow while conducting a test?

  A. Rules of engagement
  B. Rules of acceptance
  C. Rules of understanding
  D. Rules of execution
  A. Rules of engagement

  ---

  Explanation

  Rules of engagement specify the agreed-upon boundaries, scope, and procedures for a penetration test to ensure compliance and avoid disruption to the environment.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 4: Security Operations, Section: "Penetration Testing Procedures".

• Question 506:

  In order to cut costs, a company decides to implement a bring-your-own-device policy. The security team wants a solution that will reduce risk to company data, especially in cases in which devices are lost or stolen.

  Which of the following tools is best to address this concern?

  A. Mobile device management
  B. Endpoint detection and response
  C. Host-based intrusion detection system
  D. Data loss prevention
  A. Mobile device management

  ---

  Explanation

  The correct answer is A. Mobile device management.

  Mobile device management, or MDM, is the best solution for managing BYOD devices and protecting company data if a device is lost or stolen. MDM can enforce security policies such as screen locks, device encryption, remote wipe, containerization, application control, device compliance checks, and location tracking.

  This is especially important in a BYOD environment because employees own the devices, but the organization still needs to protect corporate data stored or accessed on those devices.

  Why the other options are incorrect:

  B. Endpoint detection and response EDR is used to detect, investigate, and respond to endpoint threats such as malware, suspicious behavior, and compromise. It is not the best tool for managing lost or stolen mobile devices.

  C. Host-based intrusion detection system A HIDS monitors activity on a host to detect suspicious behavior. It does not provide the mobile management features needed for BYOD risk reduction.

  D. Data loss prevention DLP helps prevent sensitive data from being leaked or transferred inappropriately, but MDM is the better answer for lost or stolen BYOD devices because it can enforce mobile security controls and perform remote wipe. Therefore, the best tool is mobile device management.

• Question 507:

  An organization recently started hosting a new service that customers access through a web portal. A security engineer needs to add to the existing security devices a new solution to protect this new service.

  Which of the following is the engineer most likely to deploy?

  A. Layer 4 firewall
  B. NGFW
  C. WAF
  D. UTM
  C. WAF

  ---

  Explanation

  The security engineer is likely to deploy a Web Application Firewall (WAF) to protect the new web portal service. A WAF specifically protects web applications by filtering, monitoring, and blocking HTTP requests based on a set of rules. This is crucial for preventing common attacks such as SQL injection, cross-site scripting (XSS), and other web-based attacks that could compromise the web service. Layer 4 firewall operates primarily at the transport layer, focusing on IP address and port filtering, making it unsuitable for web application-specific threats. NGFW (Next-Generation Firewall) provides more advanced filtering than traditional firewalls, including layer 7 inspection, but the WAF is tailored specifically for web traffic.

  UTM (Unified Threat Management) offers a suite of security tools in one package (like antivirus, firewall, and content filtering), but for web application-specific protection, a WAF is the best fit.

• Question 508:

  A security manager is implementing MFA and patch management.

  Which of the following would best describe the control type and category?

  (Select two).

  A. Physical
  B. Managerial
  C. Detective
  D. Administrator
  E. Preventative
  F. Technical
  E. Preventative
  F. Technical

  ---

  Explanation

  Multi-Factor Authentication (MFA) and patch management are both examples of preventative and technical controls. MFA prevents unauthorized access by requiring multiple forms of verification, and patch management ensures that systems are protected against vulnerabilities by applying updates. Both of these controls are implemented using technical methods, and they work to prevent security incidents before they occur.

  References:

  1: General Security Concepts, and Domain

  4: Identity and Access Management, which cover the implementation of preventative and technical controls.

• Question 509:

  A company discovers suspicious transactions that were entered into the company's database and attached to a user account that was created as a trap for malicious activity.

  Which of the following is the user account an example of?

  A. Honeytoken
  B. Honeynet
  C. Honeypot
  D. Honeyfile
  A. Honeytoken

• Question 510:

  An organization needs to determine how many employees are accessing the building each day in order to configure the proper access controls.

  Which of the following control types best meets this requirement?

  A. Detective
  B. Preventive
  C. Corrective
  D. Directive
  A. Detective

  ---

  Explanation

  A detective control is used to identify and record events or actions after they occur. In this case, tracking the number of employees accessing the building each day is a detective control, as it involves monitoring and logging access to gather data for configuring appropriate access controls. This helps the organization assess usage patterns to adjust security measures accordingly.