CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 551:

  A company has begun labeling all laptops with asset inventory stickers and associating them with employee IDs.

  Which of the following security benefits do these actions provide? (Choose two.)

  A. If a security incident occurs on the device, the correct employee can be notified.
  B. The security team will be able to send user awareness training to the appropriate device.
  C. Users can be mapped to their devices when configuring software MFA tokens.
  D. User-based firewall policies can be correctly targeted to the appropriate laptops.
  E. When conducting penetration testing, the security team will be able to target the desired laptops.
  F. Company data can be accounted for when the employee leaves the organization.
  A. If a security incident occurs on the device, the correct employee can be notified.
  F. Company data can be accounted for when the employee leaves the organization.

  ---

  Explanation

  Labeling all laptops with asset inventory stickers and associating them with employee IDs can provide several security benefits for a company. Two of these benefits are:

  A. If a security incident occurs on the device, the correct employee can be notified. An asset inventory sticker is a label that contains a unique identifier for a laptop, such as a serial number, a barcode, or a QR code. By associating this identifier with an employee ID, the security team can easily track and locate the owner of the laptop in case of a security incident, such as a malware infection, a data breach, or a theft. This way, the security team can notify the correct employee about the incident, and provide them with the necessary instructions or actions to take, such as changing passwords, scanning for viruses, or reporting the loss. This can help to contain the incident, minimize the damage, and prevent further escalation.

  F. Company data can be accounted for when the employee leaves the organization. When an employee leaves the organization, the company needs to ensure that all the company data and assets are returned or deleted from the employee's laptop. By labeling the laptop with an asset inventory sticker and associating it with an employee ID, the company can easily identify and verify the laptop that belongs to the departing employee, and perform the appropriate data backup, wipe, or transfer procedures. This can help to protect the company data from unauthorized access, disclosure, or misuse by the former employee or any other party. The other options are not correct because they are not related to the security benefits of labeling laptops with asset inventory stickers and associating them with employee IDs.

  B. The security team will be able to send user awareness training to the appropriate device. User awareness training is a type of security education that aims to improve the knowledge and behavior of users regarding security threats and best practices. The security team can send user awareness training to the appropriate device by using the email address, username, or IP address of the device, not the asset inventory sticker or the employee ID.

  C. Users can be mapped to their devices when configuring software MFA tokens. Software MFA tokens are a type of multi-factor authentication that uses a software application to generate a one-time password or a push notification for verifying the identity of a user. Users can be mapped to their devices when configuring software MFA tokens by using the device ID, phone number, or email address of the device, not the asset inventory sticker or the employee ID.

  D. User-based firewall policies can be correctly targeted to the appropriate laptops. User-based firewall policies are a type of firewall rules that apply to specific users or groups of users, regardless of the device or location they use to access the network. User-based firewall policies can be correctly targeted to the appropriate laptops by using the username, domain, or certificate of the user, not the asset inventory sticker or the employee ID.

  E. When conducting penetration testing, the security team will be able to target the desired laptops. Penetration testing is a type of security assessment that simulates a real-world attack on a network or system to identify and exploit vulnerabilities. When conducting penetration testing, the security team will be able to target the desired laptops by using the IP address, hostname, or MAC address of the laptop, not the asset inventory sticker or the employee ID.

  References:

  CompTIA Security+ Study Guide (SY0-701), Chapter 1: General Security Concepts, page 17. Professor Messer's CompTIA SY0-701 Security+ Training Course, Section 1.4: Asset Management, video: Asset Inventory (6:12).

• Question 552:

  Which of the following is a social engineering attack in which a bad actor impersonates a web URL?

  A. Pretexting
  B. Misinformation
  C. Typosquatting
  D. Watering-hole
  C. Typosquatting

• Question 553:

  A penetration tester visits a client's website and downloads the site's content.

  Which of the following actions is the penetration tester performing?

  A. Unknown environment testing
  B. Vulnerability scan
  C. Due diligence
  D. Passive reconnaissance
  D. Passive reconnaissance

  ---

  Explanation

  The described activity-visiting a website and downloading publicly accessible content-is a classic example of passive reconnaissance. Passive reconnaissance involves gathering information about a target without interacting with its internal systems or generating traffic that could be detected by security monitoring tools.

  According to SY0-701, passive recon uses open-source intelligence (OSINT), such as: Public websites

  DNS records

  News articles

  Metadata

  Public document repositories

  The key distinction is that passive reconnaissance does not probe the system for vulnerabilities, nor does it send active scanning traffic.

  Vulnerability scanning (B) requires active probing. Unknown environment testing (A) applies to black-box testing but still may involve active scanning. Due diligence (C) refers to risk assessment or compliance reviews, not technical reconnaissance.

  Therefore, downloading the website's content is a non-intrusive information-gathering technique, perfectly matching passive reconnaissance as defined in the exam materials under Threats, Vulnerabilities, Attack Vectors, and Pen Testing Phases.

• Question 554:

  Which of the following most securely protects data at rest?

  A. TLS 1.2
  B. AES-256
  C. Masking
  D. Salting
  B. AES-256

• Question 555:

  A coffee shop owner wants to restrict internet access to only paying customers by prompting them for a receipt number.

  Which of the following is the best method to use given this requirement?

  A. WPA3
  B. Captive portal
  C. PSK
  D. IEEE 802.1X
  B. Captive portal

  ---

  Explanation

• Question 556:

  Which of the following automation use cases would best enhance the security posture of an organization by rapidly updating permissions when employees leave a company?

  A. Provisioning resources
  B. Disabling access
  C. Reviewing change approvals
  D. Escalating permission requests
  B. Disabling access

  ---

  Explanation

  Disabling access is an automation use case that would best enhance the security posture of an organization by rapidly updating permissions when employees leave a company. Disabling access is the process of revoking or suspending the access rights of a user account, such as login credentials, email, VPN, cloud services, etc. Disabling access can prevent unauthorized or malicious use of the account by former employees or attackers who may have compromised the account. Disabling access can also reduce the attack surface and the risk of data breaches or leaks. Disabling access can be automated by using scripts, tools, or workflows that can trigger the action based on predefined events, such as employee termination, resignation, or transfer. Automation can ensure that the access is disabled in a timely, consistent, and efficient manner, without relying on manual intervention or human error.

  References:

  5: Identity and Access Management, page 2131. CompTIA Security+ Certification Kit: Exam SY0-701, 7th Edition, Chapter

  5: Identity and Access Management, page 2132.

• Question 557:

  A company's website is www.company.com. Attackers purchased the domain www.company.com.

  Which of the following types of attacks describes this example?

  A. Typosquatting
  B. Brand impersonation
  C. On-path
  D. Watering-hole
  A. Typosquatting

• Question 558:

  A security administrator would like to protect data on employees' laptops.

  Which of the following encryption techniques should the security administrator use?

  A. Partition
  B. Asymmetric
  C. Full disk
  D. Database
  C. Full disk

  ---

  Explanation

  Full disk encryption (FDE) is a technique that encrypts all the data on a hard drive, including the operating system, applications, and files. FDE protects the data from unauthorized access in case the laptop is lost, stolen, or disposed of without proper sanitization. FDE requires the user to enter a password, a PIN, a smart card, or a biometric factor to unlock the drive and boot the system. FDE can be implemented by using software solutions, such as BitLocker, FileVault, or VeraCrypt, or by using hardware solutions, such as self-encrypting drives (SEDs) or Trusted Platform Modules (TPMs). FDE is a recommended encryption technique for laptops and other mobile devices that store sensitive data. Partition encryption is a technique that encrypts only a specific partition or volume on a hard drive, leaving the rest of the drive unencrypted. Partition encryption is less secure than FDE, as it does not protect the entire drive and may leave traces of data on unencrypted areas. Partition encryption is also less convenient than FDE, as it requires the user to mount and unmount the encrypted partition manually. Asymmetric encryption is a technique that uses a pair of keys, one public and one private, to encrypt and decrypt data. Asymmetric encryption is mainly used for securing communication, such as email, web, or VPN, rather than for encrypting data at rest. Asymmetric encryption is also slower and more computationally intensive than symmetric encryption, which is the type of encryption used by FDE and partition encryption. Database encryption is a technique that encrypts data stored in a database, such as tables, columns, rows, or cells. Database encryption can be done at the application level, the database level, or the file system level. Database encryption is useful for protecting data from unauthorized access by database administrators, hackers, or malware, but it does not protect the data from physical theft or loss of the device that hosts the database.

  References:

  Data Encryption -CompTIA Security+ SY0-401: 4.4, CompTIA Security+ Cheat Sheet and PDF | Zero To Mastery, CompTIA Security+ SY0-601 Certification Course - Cybr, Application Hardening -SY0-601 CompTIA Security+ :3.2.

• Question 559:

  The Chief Information Security Officer wants to put security measures in place to protect PlI. The organization needs to use its existing labeling and classification system to accomplish this goal.

  Which of the following would most likely be configured to meet the requirements?

  A. Tokenization
  B. S/MIME
  C. DLP
  D. MFA
  C. DLP

  ---

  Explanation

  Data Loss Prevention (DLP) systems are typically configured to protect sensitive data such as Personally Identifiable Information (PII) within an organization. DLP tools enforce policies that monitor, detect, and block the unauthorized transmission of sensitive data. By leveraging the organization's existing labeling and classification system, DLP solutions can identify and protect data based on its classification, ensuring that PII is appropriately secured according to organizational policies.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 03 Security Architecture. CompTIA Security+ SY0-601 Study Guide: Chapter on Network Security and DLP.

• Question 560:

  A systems administrator discovers a system that is no longer receiving support from the vendor. However, this system and its environment are critical to running the business, cannot be modified, and must stay online.

  Which of the following risk treatments is the most appropriate in this situation?

  A. Reject
  B. Accept
  C. Transfer
  D. Avoid
  B. Accept

  ---

  Explanation

  accept the risk. This decision acknowledges the potential vulnerabilities but continues.

  When a system is critical, cannot be modified, and must stay online despite no longer receiving vendor support, the most appropriate risk treatment is to operation due to the system's importance. Additional compensating controls, such as network isolation, monitoring, and backup procedures, may be implemented to help mitigate associated risks while accepting them as part of the business necessity.