CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 541:

  A website user is locked out of an account after clicking an email link and visiting a different website. Web server logs show the user's password was changed, even though the user did not change the password.

  Which of the following is the most likely cause?

  A. Cross-sue request forgery
  B. Directory traversal
  C. ARP poisoning
  D. SQL injection
  A. Cross-sue request forgery

  ---

  Explanation

  The scenario describes a situation where a user unknowingly triggers an unwanted action, such as changing their password, by clicking a malicious link. This is indicative of a Cross-Site Request Forgery (CSRF) attack, where an attacker tricks the user into executing actions they did not intend to perform on a web application in which they are authenticated.

  References:

  CompTIA Security+ SY0-701 study materials, particularly in the domain of web application security and common attack vectors like CSRF.

• Question 542:

  An important patch for a critical application has just been released, and a systems administrator is identifying all of the systems requiring the patch.

  Which of the following must be maintained in order to ensure that all systems requiring the patch are updated?

  A. Asset inventory
  B. Network enumeration
  C. Data certification
  D. Procurement process
  A. Asset inventory

  ---

  Explanation

  To ensure that all systems requiring the patch are updated, the systems administrator must maintain an accurate asset inventory. This inventory lists all hardware and software assets within the organization, allowing the administrator to identify which systems are affected by the patch and ensuring that none are missed during the update process.

  Network enumeration is used to discover devices on a network but doesn't track software that requires patching.

  Data certification and procurement process are unrelated to tracking systems for patching purposes.

• Question 543:

  Which of the following is a feature of a next-generation SIEM system?

  A. Virus signatures
  B. Automated response actions
  C. Automated response actions
  D. Vulnerability scanning
  B. Automated response actions

• Question 544:

  Which of the following describes the reason for using an MDM solution to prevent jailbreaking?

  A. To secure end-of-life devices from incompatible firmware updates
  B. To avoid hypervisor attacks through VM escape
  C. To eliminate buffer overflows at the application layer
  D. To prevent users from changing the OS of mobile devices
  D. To prevent users from changing the OS of mobile devices

• Question 545:

  After multiple phishing simulations, the Chief Security Officer announces a new program that incentivizes employees to not click phishing links in the upcoming quarter.

  Which of the following security awareness execution techniques does this represent?

  A. Computer-based training
  B. Insider threat awareness
  C. SOAR playbook
  D. Gamification
  D. Gamification

  ---

  Explanation

  Gamification refers to the use of game elements such as points, rewards, competitions, and incentives to motivate users and enhance engagement in activities such as security awareness training. Incentivizing employees to avoid clicking phishing links by rewarding positive behavior is a classic example of gamification. Computer-based training (A) is traditional online training without game elements. Insider threat awareness (B) focuses on educating about internal threats.

  SOAR playbook (C) refers to automated incident response workflows, unrelated to employee training methods. Gamification is recognized in the Security Program Management domain as an effective technique to improve user engagement and security behavior.

• Question 546:

  A security analyst is examining a penetration test report and notices that the tester pivoted to critical internal systems with the same local user ID and password.

  Which of the following would help prevent this in the future?

  A. Implement centralized authentication with proper password policies
  B. Add password complexity rules and increase password history limits
  C. Connect the systems to an external authentication server
  D. Limit the ability of user accounts to change passwords
  A. Implement centralized authentication with proper password policies

• Question 547:

  Which of the following activities would involve members of the incident response team and other stakeholders simulating an event?

  A. Lessons learned
  B. Digital forensics
  C. Tabletop exercise
  D. Root cause analysis
  C. Tabletop exercise

• Question 548:

  Several customers want an organization to verify its security controls are operating effectively and have requested an independent opinion.

  Which of the following is the most efficient way to address these requests?

  A. Hire a vendor to perform a penetration test
  B. Perform an annual self-assessment.
  C. Allow each client the right to audit
  D. Provide a third-party attestation report
  D. Provide a third-party attestation report

  ---

  Explanation

  A third-party attestation report, such as a SOC 2 report, is an independent assessment of the organization's security controls conducted by an external auditor. This report provides clients with the assurance they need without requiring each client to conduct their own audit or the organization to perform separate assessments, making it both efficient and credible.

• Question 549:

  A company is developing a critical system for the government and storing project information on a fileshare.

  Which of the following describes how this data will most likely be classified?

  (Select two).

  A. Private
  B. Confidential
  C. Public
  D. Operational
  E. Urgent
  F. Restricted
  B. Confidential
  F. Restricted

  ---

  Explanation

  Data classification is the process of assigning labels to data based on its sensitivity and business impact. Different organizations and sectors may have different data classification schemes, but a common one is the following:

  Public: Data that can be freely disclosed to anyone without any harm or risk.

  Private: Data that is intended for internal use only and may cause some harm or risk if disclosed.

  Confidential: Data that is intended for authorized use only and may cause significant harm or risk if disclosed.

  Restricted: Data that is intended for very limited use only and may cause severe harm or risk if disclosed.

  In this scenario, the company is developing a critical system for the government and storing project information on a fileshare. This data is likely to be classified as confidential and restricted, because it is not meant for public or private use, and it may cause serious damage to national security or public safety if disclosed. The government may also have specific requirements or regulations for handling such data, such as encryption, access control, and auditing.

  References:

  1: CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 16-17

  2: Data Classification Practices: Final Project Description Released

• Question 550:

  Which of the following is classified as high availability in a cloud environment?

  A. Access broker
  B. Cloud HSM
  C. WAF
  D. Load balancer
  D. Load balancer

  ---

  Explanation

  In a cloud environment, high availability is typically ensured through the use of a load balancer. A load balancer distributes network or application traffic across multiple servers, ensuring that no single server becomes overwhelmed and that services remain available even if one or more servers fail. This setup enhances the reliability and availability of applications. Load balancer: Ensures high availability by distributing traffic across multiple servers or instances, preventing overload and ensuring continuous availability. Access broker: Typically refers to a service that facilitates secure access to resources, not directly related to high availability.

  Cloud HSM (Hardware Security Module): Provides secure key management in the cloud but does not specifically ensure high availability.

  WAF (Web Application Firewall): Protects web applications by filtering and monitoring HTTP traffic but is not primarily focused on ensuring high availability.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 4.4 - Security operations (Load balancing for high availability).