CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 531:

  A software developer would like to ensure the source code cannot be reverse engineered or debugged.

  Which of the following should the developer consider?

  A. Version control
  B. Obfuscation toolkit
  C. Code reuse
  D. Continuous integration
  E. Stored procedures
  B. Obfuscation toolkit

  ---

  Explanation

  An obfuscation toolkit is used by developers to make source code difficult to understand and reverse engineer. This technique involves altering the code's structure and naming conventions without changing its functionality, making it much harder for attackers to decipher the code or use debugging tools to analyze it. Obfuscation is an important practice in protecting proprietary software and intellectual property from reverse engineering.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 03 Security Architecture. CompTIA Security+ SY0-601 Study Guide: Chapter on Secure Coding Practices.

• Question 532:

  A company is performing a risk assessment on new software the company plans to use.

  Which of the following should the company assess during this process?

  A. Software vulnerabilities
  B. Cost-bene t analysis
  C. Ongoing monitoring strategies
  D. Network infrastructure compatibility
  A. Software vulnerabilities

• Question 533:

  Which of the following would enable a data center to remain operational through a multiday power outage?

  A. Generator
  B. Uninterruptible power supply
  C. Replication
  D. Parallel processing
  A. Generator

  ---

  Explanation

  A generator can provide continuous power for extended periods during a power outage, as long as it has sufficient fuel. Unlike an Uninterruptible Power Supply (UPS), which is typically used to bridge short power interruptions, a generator is designed to sustain operations over longer durations, making it ideal for keeping a data center functional during a multiday outage.

• Question 534:

  A university employee logged on to the academic server and attempted to guess the system administrators' log-in credentials.

  Which of the following security measures should the university have implemented to detect the employee's attempts to gain access to the administrators' accounts?

  A. Two-factor authentication
  B. Firewall
  C. Intrusion prevention system
  D. User activity logs
  D. User activity logs

  ---

  Explanation

  User activity logs record user actions, including failed login attempts, account access patterns, and unusual behaviors. By reviewing these logs, security teams can detect unauthorized access attempts, such as an employee attempting to guess administrator credentials.

• Question 535:

  Which of the following activities should be performed first to compile a list of vulnerabilities in an environment?

  A. Automated scanning
  B. Penetration testing
  C. Threat hunting
  D. Log aggregation
  E. Adversarial emulation
  A. Automated scanning

  ---

  Explanation

  Automated vulnerability scanning is the first step in identifying system weaknesses. These scans systematically check for outdated software, misconfigurations, and known vulnerabilities in a network.

  Penetration testing (B) is conducted after vulnerabilities are identified.

  Threat hunting (C) focuses on detecting unknown threats, not listing vulnerabilities.

  References:

  CompTIA Security+ SY0-701 Official Study Guide, Security Operations domain.

• Question 536:

  A systems administrator needs to ensure the secure communication of sensitive data within the organization's private cloud.

  Which of the following is the best choice for the administrator to implement?

  A. IPSec
  B. SHA-1
  C. RSA
  D. TGT
  A. IPSec

  ---

  Explanation

  IPSec (Internet Protocol Security) is a suite of protocols designed to secure IP communications by authenticating and encrypting each IP packet in a communication session. It is widely used for securing data transfer in networks, including private clouds, by providing confidentiality, integrity, and authenticity of data.

• Question 537:

  Which of the following is prevented by proper data sanitization?

  A. Hackers' ability to obtain data from used hard drives
  B. Devices reaching end-of-life and losing support
  C. Disclosure of sensitive data through incorrect classification
  D. Incorrect inventory data leading to a laptop shortage
  A. Hackers' ability to obtain data from used hard drives

  ---

  Explanation

  Proper data sanitization ensures that sensitive data is securely erased from storage devices, preventing unauthorized access or recovery when the devices are disposed of or reused.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 5: Security Program Management, Section: "Data Sanitization and Disposal Methods".

• Question 538:

  A company's antivirus solution is effective in blocking malware but often has false positives. The security team has spent a significant amount of time on investigations but cannot determine a root cause. The company is looking for a heuristic solution.

  Which of the following should replace the antivirus solution?

  A. SIEM
  B. EDR
  C. DLP
  D. IDS
  B. EDR

  ---

  Explanation

  Endpoint Detection and Response (EDR) platforms use behavioral analytics, machine learning, heuristics, and anomaly detection to identify malware and suspicious activity more accurately than traditional signature-based antivirus. EDR solutions also provide rich telemetry, process tracking, sandboxing, and automated investigation capabilities.

  The SY0-701 exam emphasizes EDR as a replacement for legacy antivirus in modern threat environments. EDR can significantly reduce false positives by establishing behavioral baselines and analyzing file, process, and memory activity rather than relying solely on signatures. The scenario states the company wants a heuristic solution, which directly aligns with EDR's advanced detection approach.

  SIEM (A) is for log aggregation and correlation-not endpoint protection. DLP (C) prevents data exfiltration but does not detect malware. IDS (D) analyzes network traffic, not endpoint behavior.

  Thus, EDR is the correct solution to reduce false positives and improve malware-detection accuracy.

• Question 539:

  Which of the following can a security director use to prioritize vulnerability patching within a company's IT environment?

  A. SOAR
  B. CVSS
  C. SIEM
  D. CVE
  B. CVSS

  ---

  Explanation

  The Common Vulnerability Scoring System (CVSS) is a standardized framework for assessing the severity of security vulnerabilities. It helps organizations prioritize vulnerability patching by providing a numerical score that reflects the potential impact and exploitability of a vulnerability. CVSS scores are used to gauge the urgency of patching vulnerabilities within a company's IT environment.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 05 Security Program Management and Oversight.

  CompTIA Security+ SY0-601 Study Guide: Chapter on Vulnerability Management.

• Question 540:

  Several employees received a fraudulent text message from someone claiming to be the Chief Executive Officer (CEO). The message stated: "I'm in an airport right now with no access to email. I need you to buy gift cards for employee recognition awards. Please send the gift cards to following email address."

  Which of the following are the best responses to this situation?

  (Choose two).

  A. Cancel current employee recognition gift cards.
  B. Add a smishing exercise to the annual company training.
  C. Issue a general email warning to the company.
  D. Have the CEO change phone numbers.
  E. Conduct a forensic investigation on the CEO's phone.
  F. Implement mobile device management.
  B. Add a smishing exercise to the annual company training.
  C. Issue a general email warning to the company.

  ---

  Explanation

  This situation is an example of smishing, which is a type of phishing that uses text messages (SMS) to entice individuals into providing personal or sensitive information to cybercriminals. The best responses to this situation are to add a smishing exercise to the annual company training and to issue a general email warning to the company. A smishing exercise can help raise awareness and educate employees on how to recognize and avoid smishing attacks. An email warning can alert employees to the fraudulent text message and remind them to verify the identity and legitimacy of any requests for information or money.

  References:

  What Is Phishing | Cybersecurity | CompTIA, Phishing -SY0-601 CompTIA Security+ : 1.1 - Professor Messer IT Certification Training Courses