CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 581:

  HOTSPOT

  A security architect is tasked with designing a highly resilient, business-critical application. The application SLA is 99.999%.

  INSTRUCTIONS

  Select the network, power, and server components for the appropriate locations to achieve application resiliency.

  A component should be selected for each location, and components may be selected more than once.

  If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

  

  

  Explanation

• Question 582:

  Which of the following would best allow a company to prevent access to systems from the Internet?

  A. Containerization
  B. Virtualization
  C. SD-WAN
  D. Air-gapped
  D. Air-gapped

• Question 583:

  An administrator at a small business notices an increase in support calls from employees who receive a blocked page message after trying to navigate to a spoofed website.

  Which of the following should the administrator do?

  A. Deploy multifactor authentication.
  B. Decrease the level of the web filter settings
  C. Implement security awareness training.
  D. Update the acceptable use policy
  C. Implement security awareness training.

  ---

  Explanation

  In this scenario, employees are attempting to navigate to spoofed websites, which is being blocked by the web filter. To address this issue, the administrator should implement security awareness training. Training helps employees recognize phishing and other social engineering attacks, reducing the likelihood that they will attempt to access malicious websites in the future. Deploying multifactor authentication (MFA) would strengthen authentication but does not directly address user behavior related to phishing websites. Decreasing the level of the web filter would expose the organization to more threats. Updating the acceptable use policy may clarify guidelines but is not as effective as hands-on training for improving user behavior.

• Question 584:

  The Chief Information Security Officer wants to discuss options for a disaster recovery site that allows the business to resume operations as quickly as possible.

  Which of the following solutions meets this requirement?

  A. Hot site
  B. Cold site
  C. Geographic dispersion
  D. Warm site
  A. Hot site

• Question 585:

  A company is using a legacy FTP server to transfer nancial data to a third party. The legacy system does not support SFTP, so a compensating control is needed to protect the sensitive, nancial data in transit.

  Which of the following would be the most appropriate for the company to use?

  A. Telnet connection
  B. SSH tunneling
  C. Patch installation
  D. Full disk encryption
  B. SSH tunneling

• Question 586:

  A security team must help secure a company site after attackers defaced it. The site must be available to a wide range of countries over a secure protocol, but access from known malicious networks should be blocked.

  Which of the following will best secure the site?

  A. Next-generation firewall
  B. Reverse proxy
  C. IPSec gateway
  D. Access control server
  B. Reverse proxy

  ---

  Explanation

  A reverse proxy is the best answer because it sits in front of a web application and brokers client access to the site. For a public website, a reverse proxy can enforce secure HTTPS access, hide the origin server, terminate TLS, apply filtering rules, and block traffic from known malicious networks before requests reach the web server. This is especially relevant after website defacement, which often involves weaknesses in exposed web services or poor control of public-facing access. A next-generation firewall can block traffic and inspect applications, but it is broader network infrastructure and not as directly suited to front-ending a public website. IPSec gateways are for encrypted tunnels, not broad public web access. An access control server handles authentication, not site shielding.

• Question 587:

  A security administrator wants to determine if the company's social engineering training is effective.

  Which of the following should the administrator do to complete this task?

  A. Set up a honeypot.
  B. Send out a survey.
  C. Set up a focus group.
  D. Conduct a phishing campaign.
  D. Conduct a phishing campaign.

  ---

  Explanation

  The best answer is D. Conduct a phishing campaign. To measure whether social engineering awareness training is effective, the best method is to run a simulated phishing campaign. This allows the organization to test employee behavior in a realistic but controlled way. The administrator can track who clicks suspicious links, opens attachments, submits credentials, or reports the email appropriately. This is a practical and measurable way to evaluate training outcomes because it provides real performance data rather than opinions or assumptions. Why the other options are incorrect:

  A. Set up a honeypot.A honeypot is used to attract attackers or detect malicious activity, not to test employee awareness of social engineering.

  B. Send out a survey.A survey may show how confident employees feel, but it does not objectively measure whether they can identify and resist real phishing attempts.

  C. Set up a focus group.A focus group can gather feedback, but it is not the best method for testing actual security behavior. From the SY0-701 perspective, user awareness training effectiveness is best measured through simulated phishing exercises and similar practical assessments.

• Question 588:

  A security analyst reviews domain activity logs and notices the following:

  

  Which of the following is the best explanation for what the security analyst has discovered?

  A. The user jsmith's account has been locked out.
  B. A keylogger is installed on [smith's workstation
  C. An attacker is attempting to brute force ismith's account.
  D. Ransomware has been deployed in the domain.
  C. An attacker is attempting to brute force ismith's account.

  ---

  Explanation

  Brute force is a type of attack that tries to guess the password or other credentials of a user account by using a large number of possible combinations. An attacker can use automated tools or scripts to perform a brute force attack and gain unauthorized access to the account. The domain activity logs show that the user ismith has failed to log in 10 times in a row within a short period of time, which is a strong indicator of a brute force attack. The logs also show that the source IP address of the failed logins is different from the usual IP address of ismith, which suggests that the attacker is using a different device or location to launch the attack. The security analyst should take immediate action to block the attacker's IP address, reset ismith's password, and notify ismith of the incident.

  References:

  14. CompTIA Security+ (SY0-701) Certification Exam Objectives, Domain 1.1, page

  2. Threat Actors and Attributes -SY0- 601 CompTIA Security+ : 1.1

• Question 589:

  A wireless administrator sets up a new network in a small office using a password. The network must reduce the impact of brute-force attacks if the password is subjected to over-the-air interception.

  Which of the following security settings will help achieve this goal?

  A. WIPS
  B. SSO
  C. WPS
  D. SAE
  D. SAE

  ---

  Explanation

  SAE, or Simultaneous Authentication of Equals, is the correct answer. SAE is used with WPA3-Personal and replaces the weaker pre-shared key exchange approach used in earlier WPA versions. Its major security benefit is resistance to offline dictionary and brute-force attacks after over-the-air capture. With older WPA /WPA2-PSK handshakes, an attacker could capture the handshake and repeatedly test guessed passwords offline. SAE changes the authentication exchange so captured traffic is not useful in the same way for mass offline guessing. WIPS can detect or prevent wireless intrusions, but it does not directly strengthen the password authentication exchange. SSO is an identity convenience mechanism, and WPS is a risky setup feature historically associated with PIN brute-force weaknesses.

• Question 590:

  The Chief Information Security Officer gives the security community the opportunity to report vulnerabilities on the organization's public-facing assets.

  Which of the following does this scenario best describe?

  A. Bug bounty
  B. Red teaming
  C. Open-source intelligence
  D. Third-party information sharing
  A. Bug bounty

  ---

  Explanation

  This scenario describes a bug bounty program, which invites external security researchers to responsibly identify and report vulnerabilities in an organization's systems. CompTIA Security+ SY0-701 defines bug bounty programs as structured initiatives that reward researchers for discovering and disclosing security flaws before they can be exploited by malicious actors.

  Bug bounty programs extend security testing beyond internal teams and provide continuous, real-world testing of public-facing assets. They are particularly effective for identifying zero-day vulnerabilities, logic flaws, and edge-case issues that automated tools may miss.

  Red teaming (B) is a controlled, internal or contracted adversarial exercise, not an open invitation. Open-source intelligence (C) involves gathering publicly available information, not vulnerability reporting. Third-party information sharing (D) refers to sharing threat intelligence, not soliciting vulnerability reports.

  Because the CISO is inviting the broader security community to report vulnerabilities, the correct answer is A:

  Bug bounty.