CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 521:

  While performing digital forensics, which of the following is considered the most volatile and should have the contents collected first?

  A. Hard drive
  B. RAM
  C. SSD
  D. Temporary files
  B. RAM

• Question 522:

  Which of the following is a use of CVSS?

  A. To determine the cost associated with patching systems
  B. To identify unused ports and services that should be closed
  C. To analyze code for defects that could be exploited
  D. To prioritize the remediation of vulnerabilities
  D. To prioritize the remediation of vulnerabilities

• Question 523:

  Attackers created a new domain name that looks similar to a popular file-sharing website.

  Which of the following threat vectors is being used?

  A. Watering-hole attack
  B. Brand impersonation
  C. Phishing
  D. Typosquatting
  D. Typosquatting

  ---

  Explanation

  The scenario describes attackers registering a similar-looking domain to trick users into visiting a malicious site. This matches the definition of typosquatting, also known as URL hijacking or domain spoofing. Typosquatting relies on users mistyping legitimate URLs or failing to notice slight visual differences (e.g., "dropbx.com" instead of "dropbox.com"). Attackers use these domains to distribute malware, steal credentials, or redirect users to phishing pages. Watering-hole attacks (A) infect legitimate websites frequented by a specific target group, which does not match this scenario. Brand impersonation (B) involves mimicking a company's identity-often combined with email phishing-but the question specifically mentions creating a similar-looking domain, which is characteristic of typosquatting. Phishing (C) may use these malicious domains, but phishing is a broader social-engineering attack, whereas typosquatting precisely describes the domain manipulation technique.

  Security+ SY0-701 emphasizes typosquatting under Social Engineering & Web-based Threats, highlighting how attackers exploit user errors to redirect traffic to malicious destinations. Reducing this risk involves user training, DNS filtering, domain monitoring, and certificate validation.

• Question 524:

  After reviewing the following vulnerability scanning report:

  

  A security analyst performs the following test:

  

  Which of the following would the security analyst conclude for this reported vulnerability?

  A. It is a false positive.
  B. A rescan is required.
  C. It is considered noise.
  D. Compensating controls exist.
  A. It is a false positive.

  ---

  Explanation

  A false positive is a result that indicates a vulnerability or a problem when there is none. In this case, the vulnerability scanning report shows that the telnet service on port 23 is open and uses an insecure network protocol. However, the security analyst performs a test using nmap and a script that checks for telnet encryption support. The result shows that the telnet server supports encryption, which means that the data transmitted between the client and the server can be protected from eavesdropping. Therefore, the reported vulnerability is a false positive and does not reflect the actual security posture of the server. The security analyst should verify the encryption settings of the telnet server and client and ensure that they are configured properly.

  References:

  3: Telnet Protocol - Can You Encrypt Telnet?

• Question 525:

  Which of the following considerations is the most important for an organization to evaluate as it establishes and maintains a data privacy program?

  A. Reporting structure for the data privacy officer
  B. Request process for data subject access
  C. Role as controller or processor
  D. Physical location of the company
  C. Role as controller or processor

  ---

  Explanation

  The most important consideration when establishing a data privacy program is defining the organization's role as a controller or processor. These roles, as outlined in privacy regulations such as the General Data Protection Regulation (GDPR), determine the responsibilities regarding the handling of personal data. A controller is responsible for determining the purpose and means of data processing, while a processor acts on behalf of the controller. This distinction is crucial for compliance with data privacy laws. Reporting structure for the data privacy officer is important, but it is a secondary consideration compared to legal roles. Request process for data subject access is essential for compliance but still depends on the organization's role as controller or processor. Physical location of the company can affect jurisdiction, but the role as controller or processor has a broader and more immediate impact.

• Question 526:

  Which of the following can be best used to discover a company's publicly available breach information?

  A. OSINT
  B. SIEM
  C. CVE
  D. CVSS
  A. OSINT

• Question 527:

  Which of the following is the most likely outcome if a large bank fails an internal PCI DSS compliance assessment?

  A. Fines
  B. Audit findings
  C. Sanctions
  D. Reputation damage
  B. Audit findings

  ---

  Explanation

  If a large bank fails an internal PCI DSS compliance assessment, the most likely immediate outcome is audit findings. An internal assessment typically identifies gaps, deficiencies, or noncompliance issues that must be documented and remediated. Fines and sanctions are more likely after external regulatory enforcement or continued failure to correct issues, while reputation damage is a possible secondary effect, not the most direct outcome.

• Question 528:

  An organization has issues with deleted network share data and improper permissions.

  Which solution helps track and remediate these?

  A. DLP
  B. EDR
  C. FIM
  D. ACL
  C. FIM

  ---

  Explanation

  File Integrity Monitoring (FIM) detects unauthorized changes to files, including deletions, modifications, and permission alterations. When protecting shared data, FIM creates baseline hashes of files and monitors them for unexpected changes. Any deviation triggers alerts, enabling rapid investigation and remediation.

  Security+ SY0-701 identifies FIM as a crucial tool for: Integrity monitoring

  Detecting unauthorized file deletion

  Identifying malicious or accidental permission changes

  Supporting compliance (PCI-DSS, HIPAA, etc.)

  DLP (A) protects against data leakage but does not detect permission misconfiguration or deleted files. EDR (B) monitors endpoint activity but is not optimized for shared file integrity. ACL (D) defines permissions but does not track changes.

  Thus, C (FIM) is the correct solution.

• Question 529:

  Which of the following data roles is responsible for identifying risks and appropriate access to data?

  A. Owner
  B. Custodian
  C. Steward
  D. Controller
  A. Owner

  ---

  Explanation

  The data owner is the role responsible for identifying risks to data and determining who should have access to that data. The owner has the authority to make decisions about the protection and usage of the data, including setting access controls and ensuring that appropriate security measures are in place.

  References:

  CompTIA Security+ SY0-701 study materials, particularly in the domain of data governance and the roles and responsibilities associated with data management.

• Question 530:

  While troubleshooting a firewall configuration, a technician determines that a "deny any" policy should be added to the bottom of the ACL. The technician updates the policy, but the new policy causes several company servers to become unreachable.

  Which of the following actions would prevent this issue?

  A. Documenting the new policy in a change request and submitting the request to change management
  B. Testing the policy in a non-production environment before enabling the policy in the production network
  C. Disabling any intrusion prevention signatures on the "deny any" policy prior to enabling the new policy
  D. Including an "allow any" policy above the "deny any" policy
  B. Testing the policy in a non-production environment before enabling the policy in the production network

  ---

  Explanation

  A firewall policy is a set of rules that defines what traffic is allowed or denied on a network. A firewall policy should be carefully designed and tested before being implemented, as a misconfigured policy can cause network disruptions or security breaches. A common best practice is to test the policy in a non-production environment, such as a lab or a simulation, before enabling the policy in the production network. This way, the technician can verify the functionality and

  performance of the policy, and identify and resolve any issues or conflicts, without affecting the live network. Testing the policy in a non-production environment would prevent the issue of the `deny any' policy causing several company servers to become unreachable, as the technician would be able to detect and correct the problem before applying the policy to the production network. Documenting the new policy in a change request and submitting the request to change management is a good practice, but it would not prevent the issue by itself. Change management is a process that ensures that any changes to the network are authorized, documented, and communicated, but it does not guarantee that the

  changes are error-free or functional. The technician still needs to test the policy before implementing it. Disabling any intrusion prevention signatures on the `deny any' policy prior to enabling the new policy would not prevent the issue, and it could reduce the security of the network. Intrusion prevention signatures are patterns that identify malicious or unwanted traffic, and allow the firewall to block or alert on such traffic. Disabling these signatures would make the firewall less effective in detecting and preventing attacks, and it would not affect the reachability of the company servers.

  Including an `allow any' policy above the `deny any' policy would not prevent the issue, and it would render the `deny any' policy useless. A firewall policy is processed from top to bottom, and the first matching rule is applied. An `allow any' policy would match any traffic and allow it to pass through the firewall, regardless of the source, destination, or protocol. This would negate the purpose of the `deny any' policy, which is to block any traffic that does not match any of the

  previous rules. Moreover, an `allow any' policy would create a security risk, as it would allow any unauthorized or malicious traffic to enter or exit the network.

  References:

  CompTIA Security+ SY0-701 Certification Study Guide, page 204- 205

  Professor Messer's CompTIA SY0-701 Security+ Training Course, video 2.1 - Network Security Devices, 8:00 - 10:00.