CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 561:

  A company needs to provide administrative access to internal resources while minimizing the traffic allowed through the security boundary.

  Which of the following methods is most secure?

  A. Implementing a bastion host
  B. Deploying a perimeter network
  C. Installing a WAF
  D. Utilizing single sign-on
  A. Implementing a bastion host

  ---

  Explanation

  A bastion host is a special-purpose server that is designed to withstand attacks and provide secure access to internal resources. A bastion host is usually placed on the edge of a network, acting as a gateway or proxy to the internal network.

  A bastion host can be configured to allow only certain types of traffic, such as SSH or HTTP, and block all other traffic. A bastion host can also run security software such as firewalls, intrusion detection systems, and antivirus programs to monitor and filter incoming and outgoing traffic. A bastion host can provide administrative access to internal resources by requiring strong authentication and encryption, and by logging all activities for auditing purposes. A bastion host is the most secure method among the given options because it minimizes the traffic allowed through the security boundary and provides a single point of control and defense. A bastion host can also isolate the internal network from direct exposure to the internet or other untrusted networks, reducing the attack surface and the risk of compromise.

  Deploying a perimeter network is not the correct answer, because a perimeter network is a network segment that separates the internal network from the external network. A perimeter network usually hosts public-facing services such as web servers, email servers, or DNS servers that need to be accessible from the internet. A perimeter network does not provide administrative access to internal resources, but rather protects them from unauthorized access. A perimeter network can also increase the complexity and cost of network management and security.

  Installing a WAF is not the correct answer, because a WAF is a security tool that protects web applications from common web-based attacks by monitoring, filtering, and blocking HTTP traffic. A WAF can prevent attacks such as cross-site scripting, SQL injection, or file inclusion, among others. A WAF does not provide administrative access to internal resources, but rather protects them from web application vulnerabilities. A WAF is also not a comprehensive solution for network security, as it only operates at the application layer and does not protect against other types of attacks or threats. Utilizing single sign-on is not the correct answer, because single sign-on is a method of authentication that allows users to access multiple sites, services, or applications with one username and password. Single sign-on can simplify the sign-in process for users and reduce the number of passwords they have to remember and manage. Single sign-on does not provide administrative access to internal resources, but rather enables access to various resources that the user is authorized to use. Single sign-on can also introduce security risks if the user's credentials are compromised or if the single sign-on provider is breached.

  References:

  1: Bastion host - Wikipedia,

  2: 14 Best Practices to Secure SSH Bastion Host - goteleport.com,

  3: The Importance Of Bastion Hosts In Network Security,

  4: What is the network perimeter? | Cloudflare,

  5: What is a WAF? | Web Application Firewall explained,

  6: [What is single sign-on (SSO)? - Definition from WhatIs.com]

• Question 562:

  Which of the following security threats aims to compromise a website that multiple employees frequently visit?

  A. Supply chain
  B. Typosquatting
  C. Watering hole
  D. Impersonation
  C. Watering hole

  ---

  Explanation

  The best answer is C. Watering hole. A watering hole attack occurs when an attacker compromises a website that a targeted group of users commonly visits. The attacker chooses that site because they know the intended victims are likely to access it during normal work activities. Once the site is compromised, the attacker can deliver malware, steal credentials, or exploit browser vulnerabilities. This exactly matches the scenario in the question: a website that multiple employees frequently visit is targeted for compromise.

  Why the other options are incorrect:

  A. Supply chainA supply chain attack targets vendors, software providers, or service providers in order to affect downstream customers. That is different from compromising a commonly visited website for a specific group of users.

  B.

  TyposquattingTyposquatting involves creating a fraudulent website with a name similar to a legitimate one so users accidentally visit it. The question describes compromising an existing site people already visit, not creating a lookalike domain.

  D. ImpersonationImpersonation involves pretending to be a trusted person or entity. It does not specifically describe compromising a frequently visited website. From a Security+ perspective, a compromised site used to target a specific population is a classic watering hole attack, so C is correct.

• Question 563:

  A security administrator is reissuing a former employee's laptop.

  Which of the following is the best combination of data handling activities for the administrator to perform? (Choose two.)

  A. Data retention
  B. Certification
  C. Destruction
  D. Classification
  E. Sanitization
  F. Enumeration
  B. Certification
  E. Sanitization

• Question 564:

  According to various privacy rules and regulations, users have the power to request that all data pertaining to them is deleted. This is known as:

  A. Right to be forgotten
  B. Attestation and acknowledgement
  C. Data retention
  D. Information deletion
  A. Right to be forgotten

• Question 565:

  A recent penetration test identified that an attacker could flood the MAC address table of network switches.

  Which of the following would best mitigate this type of attack?

  A. Load balancer
  B. Port security
  C. IPS
  D. NGFW
  B. Port security

  ---

  Explanation

  Port security is the best mitigation technique for preventing an attacker from flooding the MAC address table of network switches. Port security can limit the number of MAC addresses learned on a port, preventing an attacker from overwhelming the switch's MAC table (a form of MAC flooding attack). When the allowed number of MAC addresses is exceeded, port security can block additional devices or trigger alerts. Load balancer distributes network traffic but does not address MAC flooding attacks.

  IPS (Intrusion Prevention System) detects and prevents attacks but isn't specifically designed for MAC flooding mitigation. NGFW (Next-Generation Firewall) offers advanced traffic inspection but is not directly involved in MAC table security.

• Question 566:

  Which of the following actions must an organization take to comply with a person's request for the right to be forgotten?

  A. Purge all personally identifiable attributes.
  B. Encrypt all of the data.
  C. Remove all of the person's data.
  D. Obfuscate all of the person's data.
  C. Remove all of the person's data.

  ---

  Explanation

  The right to be forgotten, as outlined in regulations such as the General Data Protection Regulation (GDPR), requires organizations to permanently delete an individual's personal data upon request, unless there is a legal or contractual obligation to retain it.

  Purging personally identifiable attributes (Option A) removes some identifying data but does not fully satisfy the request.

  Encrypting the data (Option B) does not remove it, and the data is still accessible with the decryption key.

  Obfuscating data (Option D) makes data unreadable but does not permanently remove it. To comply with the right to be forgotten, organizations must remove all of the person's data unless an exception applies.

• Question 567:

  A company is in the process of cutting jobs to manage costs. The Chief Information Security Officer is concerned about the increased risk of an insider threat.

  Which of the following would most likely help the security awareness team address this potential threat?

  A. Immediately disable the accounts of staff who are likely to be terminated.
  B. Train supervisors to identify and manage disgruntled employees.
  C. Configure DLP to monitor staff who will be terminated.
  D. Raise awareness for business leaders on social engineering techniques.
  B. Train supervisors to identify and manage disgruntled employees.

• Question 568:

  An administrator has identified and fingerprinted specific files that will generate an alert if an attempt is made to email these files outside of the organization.

  Which of the following best describes the tool the administrator is using?

  A. DLP
  B. SNMP traps
  C. SCAP
  D. IPS
  A. DLP

• Question 569:

  Which of the following should an organization use to protect its environment from external attacks conducted by an unauthorized hacker?

  A. ACL
  B. IDS
  C. HIDS
  D. NIPS
  D. NIPS

  ---

  Explanation

  A Network Intrusion Prevention System (NIPS) actively monitors network traffic and can detect and block malicious activities in real-time, helping to prevent external attacks. Unlike IDS, which only detects intrusions, NIPS can take immediate action to stop threats, making it a strong defensive measure against unauthorized external attacks.

• Question 570:

  A security analyst is evaluating a SaaS application that the human resources department would like to implement. The analyst requests a SOC 2 report from the SaaS vendor.

  Which of the following processes is the analyst most likely conducting?

  A. Internal audit
  B. Penetration testing
  C. Attestation
  D. Due diligence
  D. Due diligence