CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 571:

  While updating the security awareness training, a security analyst wants to address issues created if vendors' email accounts are compromised.

  Which of the following recommendations should the security analyst include in the training?

  A. Refrain from clicking on images included in emails from new vendors
  B. Delete emails from unknown service provider partners.
  C. Require that invoices be sent as attachments
  D. Be alert to unexpected requests from familiar email addresses
  D. Be alert to unexpected requests from familiar email addresses

  ---

  Explanation

  Compromised vendor email accounts can be used to send phishing emails or fraudulent requests that appear legitimate. Employees should be trained to recognize and scrutinize unexpected requests even when they come from familiar email addresses, as this is a common tactic in phishing and business email compromise (BEC) attacks. This recommendation directly addresses the risk posed by compromised vendor accounts.

• Question 572:

  An organization conducts a self-evaluation with a phishing campaign that requests login credentials. The organization receives the following results:

  1. None of the staff were fooled by the attempt due to proper security awareness.

  2. Staff deleted the email without performing any additional actions.

  Which of the following security practices would add the most value to the organization?

  A. Implement a strict password reset policy for all senior managers after a security event.
  B. Update user guidance to include suspicious incident reporting.
  C. Conduct end-user training regarding spear-phishing attempts to raise awareness.
  D. Require remote workers to use a VPN when connecting to the organization ' s networks.
  B. Update user guidance to include suspicious incident reporting.

  ---

  Explanation

  The best answer is B. Update user guidance to include suspicious incident reporting. The phishing simulation results show that users were not fooled, which means awareness training is already helping them avoid credential theft. However, the employees deleted the email without reporting it. That means the organization missed an opportunity to: investigate the message further identify other recipients block similar messages improve incident response visibility update defensive controls quickly.

  The most valuable next step is to train or guide users to report suspicious emails, not just ignore or delete them. Why the other options are incorrect:

  A. Implement a strict password reset policy for all senior managers after a security event.This does not address the gap identified by the exercise.

  C. Conduct end-user training regarding spear-phishing attempts to raise awareness.The results already show awareness was effective enough to prevent users from falling for the message. The missing behavior is reporting.

  D. Require remote workers to use a VPN when connecting to the organization ' s networks.This is unrelated to the phishing exercise outcome. From a Security+ perspective, user awareness programs should teach employees to identify and report suspicious messages. Therefore, B is the best answer.

• Question 573:

  Which of the following control types describes an alert from a SIEM tool?

  A. Preventive
  B. Corrective
  C. Compensating
  D. Detective
  D. Detective

• Question 574:

  An organization is building a new backup data center with cost-benefit as the primary requirement and RTO and RPO values around two days.

  Which of the following types of sites is the best for this scenario?

  A. Real-time recovery
  B. Hot
  C. Cold
  D. Warm
  D. Warm

  ---

  Explanation

  A warm site provides a balance between cost and recovery speed. The question states that cost-benefit is the primary requirement, so the organization does not need the most expensive option. It also says the RTO and RPO are around two days, which means the business can tolerate some downtime and some data loss.

  A real-time recovery solution and a hot site are designed for much faster recovery and much less data loss, but they are more expensive. A cold site is the least expensive option, but it usually takes too long to become operational after a disaster. A warm site is the best choice because it is more affordable than a hot site while still being able to support recovery within about two days.

• Question 575:

  Which of the following control types involves restricting IP connectivity to a router's web management interface to protect it from being exploited by a vulnerability?

  A. Corrective
  B. Physical
  C. Preventive
  D. Managerial
  C. Preventive

• Question 576:

  A systems administrator just purchased multiple network devices.

  Which of the following should the systems administrator perform to prevent attackers from accessing the devices by using publicly available information?

  A. Install endpoint protection.
  B. Disable ports/protocols.
  C. Change default passwords.
  D. Remove unnecessary software.
  C. Change default passwords.

• Question 577:

  A security analyst is reviewing the following logs about a suspicious activity alert for a user's VPN log-ins:

  

  Which of the following malicious activity indicators triggered the alert?

  A. Impossible travel
  B. Account lockout
  C. Blocked content
  D. Concurrent session usage
  A. Impossible travel

• Question 578:

  After a company was compromised, customers initiated a lawsuit. The company's attorneys have requested that the security team initiate a legal hold in response to the lawsuit.

  Which of the following describes the action the security team will most likely be required to take?

  A. Retain the emails between the security team and affected customers for 30 days.
  B. Retain any communications related to the security breach until further notice.
  C. Retain any communications between security members during the breach response.
  D. Retain all emails from the company to affected customers for an indefinite period of time.
  B. Retain any communications related to the security breach until further notice.

  ---

  Explanation

  A legal hold (also known as a litigation hold) is a notification sent from an organization's legal team to employees instructing them not to delete electronically stored information (ESI) or discard paper documents that may be relevant to a new or imminent legal case. A legal hold is intended to preserve evidence and prevent spoliation, which is the intentional or negligent destruction of evidence that could harm a party's case. A legal hold can be triggered by various events, such as a lawsuit, a regulatory investigation, or a subpoena. In this scenario, the company's attorneys have requested that the security team initiate a legal hold in response to the lawsuit filed by the customers after the company was compromised.

  This means that the security team will most likely be required to retain any communications related to the security breach until further notice. This could include emails, instant messages, reports, logs, memos, or any other documents that could be relevant to the lawsuit. The security team should also inform the relevant custodians (the employees who have access to or control over the ESI) of their preservation obligations and monitor their compliance. The security team should also document the legal hold process and its scope, as well as take steps to protect the ESI from alteration, deletion, or loss.

  References:

  1: CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, Chapter

  6: Risk Management, page 303

  2: CompTIA Security+ Certification Kit: Exam SY0-701, 7th Edition, Chapter

  6: Risk Management, page 305

  3: Legal Hold (Litigation Hold) - The Basics of E-Discovery - Exterro

  4: The Legal Implications and Consequences of a Data Breach

• Question 579:

  A company's accounts payable clerk receives a message from a vendor asking to change their bank account before paying an invoice. The clerk makes the change and sends the payment to the new account. Days later, the clerk receives another message from the same vendor with a request for a missing payment to the original bank account.

  Which of the following has most likely occurred?

  A. Phishing campaign
  B. Data exfiltration
  C. Pretext calling
  D. Business email compromise
  D. Business email compromise

• Question 580:

  Which of the following are the most important considerations when encrypting data? (Select two).

  A. Obfuscation
  B. Algorithms
  C. Data masking
  D. Key length
  E. Tokenization
  F. Salting
  B. Algorithms
  D. Key length

  ---

  Explanation

  When encrypting data, two fundamental drivers of cryptographic strength are the algorithm you choose and the key length you use (which affects brute-force feasibility and overall security margin). The Study Guide emphasizes algorithm selection as a best practice: "First, choose your encryption system wisely... Choose an encryption system with an algorithm in the public domain that has been thoroughly vetted by industry experts." It then highlights key selection/size as another central decision: "You must also select your keys in an appropriate manner. Use a key length that balances your security requirements with performance considerations." These two choices directly affect whether encryption meaningfully protects confidentiality. By contrast, obfuscation, masking, and tokenization are different data-protection techniques (often used to reduce exposure or de-identify data) rather than core encryption-strength parameters. Salting is primarily associated with strengthening password hashing (defending against rainbow table attacks), not selecting encryption primitives /strength for general data encryption. Therefore, the best two considerations in the context of encryption itself are Algorithms and Key length.

  References:

  Encryption best practices-select vetted algorithms and appropriate key length.