CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 511:

  An organization needs to monitor its users' activities to prevent insider threats.

  Which of the following solutions would help the organization achieve this goal?

  A. Behavioral analytics
  B. Access control lists
  C. Identity and access management
  D. Network intrusion detection system
  A. Behavioral analytics

  ---

  Explanation

  Behavioral analytics tools monitor user actions and detect anomalies that may indicate insider threats, such as unauthorized access or unusual data exfiltration activities. These tools establish baselines for normal behavior and flag deviations.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 4: Security Operations, Section: "Behavioral Analytics and Monitoring".

• Question 512:

  Which of the following would an organization most likely use to minimize the loss of data on a file server in the event data needs to be restored?

  A. Snapshots
  B. Journaling
  C. Obfuscation
  D. Tokenization
  A. Snapshots

  ---

  Explanation

  Snapshots capture the state of a file server at a specific point in time, allowing for quick recovery of lost or corrupted data. They provide an efficient way to restore files without relying solely on full backups, minimizing data loss and downtime.

  This makes snapshots an ideal solution for data recovery and protection on a file server.

• Question 513:

  Which of the following is a type of vulnerability that may result from outdated algorithms or keys?

  A. Hash collision
  B. Cryptographic
  C. Buffer overflow
  D. Input validation
  B. Cryptographic

  ---

  Explanation

  Cryptographic vulnerabilities occur when outdated algorithms or weak encryption keys are used, making systems susceptible to attacks such as brute force or cryptanalysis. These issues undermine the confidentiality and integrity of encrypted data.

• Question 514:

  An organization is preparing to export proprietary software to a customer.

  Which of the following would be the best way to prevent the loss of intellectual property?

  A. Code signing
  B. Obfuscation
  C. Tokenization
  D. Blockchain
  B. Obfuscation

  ---

  Explanation

  Obfuscation is the process of making software code intentionally difficult to understand or reverse-engineer. By obfuscating the proprietary software before exporting it, the organization can protect its intellectual property from being analyzed, copied, or exploited by unauthorized parties. This method is commonly used to safeguard the core logic and algorithms of the software.

• Question 515:

  A security company informs its customers of a new vulnerability that affects web applications. The vulnerability does not have an available patch at the moment.

  Which of the following best describes this vulnerability?

  A. Zero-day
  B. XSS
  C. SQLi
  D. Buffer overflow
  A. Zero-day

  ---

  Explanation

  The best answer is A. Zero-day. A zero-day vulnerability is a newly discovered vulnerability for which no patch or official fix is yet available. Because defenders have had zero days to fully remediate it, attackers may be able to exploit it before a vendor releases a patch. The question specifically states that the vulnerability is new and does not have an available patch, which is the defining clue. Why the other options are incorrect:

  B. XSSCross-site scripting is a specific web application attack type, not a description of whether a patch exists.

  C. SQLiSQL injection is also a specific attack type, not the broader vulnerability status being asked about.

  D. Buffer overflowBuffer overflow is a type of coding flaw, but again it does not specifically describe the condition of having no patch available. From a Security+ perspective, when a vulnerability is newly identified and lacks a vendor fix, it is best described as a zero-day.

• Question 516:

  A company is discarding a classified storage array and hires an outside vendor to complete the disposal.

  Which of the following should the company request from the vendor?

  A. Certification
  B. Inventory list
  C. Classification
  D. Proof of ownership
  A. Certification

  ---

  Explanation

  The company should request a certification from the vendor that confirms the storage array has been disposed of securely and in compliance with the company's policies and standards. A certification provides evidence that the vendor has followed the proper procedures and methods to destroy the classified data and prevent unauthorized access or recovery. A certification may also include details such as the date, time, location, and method of disposal, as well as the names and signatures of the personnel involved.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, Chapter 3, page 1441

• Question 517:

  Which of the following are the best security controls for controlling on-premises access? (Select two.)

  A. Swipe card
  B. Picture ID
  C. Phone authentication application
  D. Biometric scanner
  E. Camera
  F. Memorable
  A. Swipe card
  D. Biometric scanner

  ---

  Explanation

  Swipe cards and biometric scanners are commonly used to control on-premises access due to their reliability and ability to restrict unauthorized entry. Swipe cards provide physical access control, while biometric scanners ensure identity verification.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 1: General Security Concepts, Section: "Physical Security Controls".

• Question 518:

  Which of the following best explains the use of a policy engine in a Zero Trust environment?

  A. It is used by a central server to apply default permissions across a range of network and computing resources.
  B. It is used to make access control decisions without inheriting permission decisions from prior events.
  C. It is used to dynamically assign user permissions based on a user ' s identity and previous activity.
  D. It is used when user roles are unknown and the organization wants to leverage ML to control access.
  B. It is used to make access control decisions without inheriting permission decisions from prior events.

  ---

  Explanation

  The best answer is B. It is used to make access control decisions without inheriting permission decisions from prior events. In a Zero Trust environment, the core principle is never trust, always verify. A policy engine evaluates each access request using current context and defined security policies. Access is not automatically granted simply because a user or device was previously authenticated or allowed access earlier. This means decisions are made continuously and based on factors such as: user identity device posture location requested resource risk level session context.

  The phrase "without inheriting permission decisions from prior events" best reflects the Zero Trust concept that trust is not assumed or permanently granted. Why the other options are incorrect:

  A. It is used by a central server to apply default permissions across a range of network and computing resources.This sounds more like centralized administration, but it does not capture the dynamic, context-based access decision-making of a Zero Trust policy engine.

  C. It is used to dynamically assign user permissions based on a user ' s identity and previous activity. This is close, but the wording emphasizes previous activity, whereas Zero Trust focuses on real-time evaluation of current conditions rather than inherited trust.

  D. It is used when user roles are unknown and the organization wants to leverage ML to control access. Machine learning may support analytics, but this is not the main purpose of a Zero Trust policy engine. From the SY0-701 perspective, a policy engine is central to making explicit, context-aware access decisions for every request, which is best captured by B.

• Question 519:

  An organization completed a project to deploy SSO across all business applications last year. Recently, the finance department selected a new cloud-based accounting software vendor.

  Which of the following should most likely be configured during the new software deployment?

  A. RADIUS
  B. SAML
  C. EAP
  D. OpenID
  B. SAML

• Question 520:

  A company wants to get alerts when others are researching and doing reconnaissance on the company. One approach would be to host a part of the Infrastructure online with known vulnerabilities that would appear to be company assets.

  Which of the following describes this approach?

  A. Watering hole
  B. Bug bounty
  C. DNS sinkhole
  D. Honeypot
  D. Honeypot

  ---

  Explanation

  A honeypot is a security mechanism set up to attract and detect potential attackers by simulating vulnerable assets. By hosting a part of the infrastructure online with known vulnerabilities that appear to be company assets, the company can observe and analyze the behavior of attackers conducting reconnaissance. This approach allows the company to get alerts and gather intelligence on potential threats.

  References:

  CompTIA Security+ SY0-701 study materials, particularly on threat detection techniques such as honeypots.