CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 51:

  Various stakeholders are meeting to discuss their hypothetical roles and responsibilities in a specific situation, such as a security incident or major disaster.

  Which of the following best describes this meeting?

  A. Penetration test
  B. Continuity of operations planning
  C. Tabletop exercise
  D. Simulation
  C. Tabletop exercise

  ---

  Explanation

  A tabletop exercise is a discussion-based exercise where stakeholders gather to walk through the roles and responsibilities they would have during a specific situation, such as a security incident or disaster. This type of exercise is designed to identify gaps in planning and improve coordination among team members without the need for physical execution.

  References:

  CompTIA Security+ SY0-701 study materials, particularly in the domain of security operations and disaster recovery planning.

• Question 52:

  An employee clicked a malicious link in an email and downloaded malware onto the company's computer network. The malicious program exfiltrated thousands of customer records.

  Which of the following should the company implement to prevent this in the future?

  A. User awareness training
  B. Network monitoring
  C. Endpoint protection
  D. Data loss prevention
  A. User awareness training

  ---

  Explanation

  User awareness training is essential in preventing security incidents caused by human error, such as clicking on malicious links. Employees need to be educated on recognizing phishing attempts, verifying email senders, and avoiding suspicious downloads. Network monitoring detects and alerts on malicious activity but does not prevent employees from clicking on harmful links. Endpoint protection can mitigate malware infections but is not foolproof, especially if users continue to fall for phishing attacks.

  Data loss prevention (DLP) can prevent data exfiltration but does not stop malware from being introduced into the system.

  By training employees to recognize and avoid phishing scams, organizations can reduce the risk of malware infections and data breaches.

• Question 53:

  A customer of a large company receives a phone call from someone claiming to work for the company and asking for the customer's credit card information. The customer sees the caller ID is the same as the company's main phone number.

  Which of the following attacks is the customer most likely a target of?

  A. Phishing
  B. Whaling
  C. Smishing
  D. Vishing
  D. Vishing

  ---

  Explanation

  Vishing (voice phishing) is a social engineering attack where attackers impersonate a trusted entity over the phone to obtain sensitive information, such as credit card details. In this case, the attacker spoofed the company's main phone number on the caller ID to gain the customer's trust, making it likely that the customer is the target of a vishing attack.

• Question 54:

  Which of the following is the most likely to be used to document risks, responsible parties, and thresholds?

  A. Risk tolerance
  B. Risk transfer
  C. Risk register
  D. Risk analysis
  C. Risk register

  ---

  Explanation

  A risk register is a document that records and tracks the risks associated with a project, system, or organization. A risk register typically includes information such as the risk description, the risk owner, the risk probability, the risk impact, the risk level, the risk response strategy, and the risk status. A risk register can help identify, assess, prioritize, monitor, and control risks, as well as communicate them to relevant stakeholders. A risk register can also help document the risk tolerance and thresholds of an organization, which are the acceptable levels of risk exposure and the criteria for escalating or mitigating risks.

  References:

  211. CompTIA Security+ Certification Guide, Chapter 2: Risk Management, page

  33. CompTIA Security+ Certification Exam SY0-701 Practice Test 1, Question4.

• Question 55:

  An analyst is performing a vulnerability scan against the web servers exposed to the internet without a system account.

  Which of the following is most likely being performed?

  A. Non-credentialed scan
  B. Packet capture
  C. Privilege escalation
  D. System enumeration
  E. Passive scan
  A. Non-credentialed scan

• Question 56:

  A network administrator deploys an FDE solution on all end user workstations.

  Which of the following data protection strategies does this describe?

  A. Masking
  B. Data in transit
  C. Obfuscation
  D. Data at rest
  E. Data sovereignty
  D. Data at rest

  ---

  Explanation

  Full-disk encryption (FDE) protects the contents of storage media, which is a classic data-at-rest control. The Study Guide explains the "three situations" relevant to confidentiality-at rest, in transit, and in use-and then specifically ties disk encryption/FDE to protecting stored data: "Data at rest, or stored data, is that which resides in a permanent location awaiting access... Examples... hard drives..." It then describes FDE as an encryption method applied to disks: "Full-disk encryption (FDE) is a form of encryption where all the data on a hard drive is automatically encrypted, including the operating system and system files... In the case of loss or theft, FDE can prevent unauthorized access to all data on the hard drive."

  That is exactly the definition of protecting data at rest-it is intended to prevent disclosure if a laptop /workstation is lost, stolen, or the drive is removed. This is not masking (hiding parts of fields), not data in transit (network encryption like TLS/ VPN), not obfuscation (making code hard to understand), and not data sovereignty (jurisdiction/location requirements). Therefore, deploying FDE on workstations is a data-at-rest protection strategy.

  References:

  Data-at-rest definition and confidentiality contexts

  FDE definition and purpose protecting disk-stored data.

• Question 57:

  Which of the following should a security administrator adhere to when setting up a new set of firewall rules?

  A. Disaster recovery plan
  B. Incident response procedure
  C. Business continuity plan
  D. Change management procedure
  D. Change management procedure

  ---

  Explanation

  A change management procedure is a set of steps and guidelines that a security administrator should adhere to when setting up a new set of firewall rules. A firewall is a device or software that can filter, block, or allow network traffic based on predefined rules or policies. A firewall rule is a statement that defines the criteria and action for a firewall to apply to a packet or a connection. For example, a firewall rule can allow or deny traffic based on the source and destination IP addresses, ports, protocols, or applications. Setting up a new set of firewall rules is a type of change that can affect the security, performance, and functionality of the network. Therefore, a change management procedure is necessary to ensure that the change is planned, tested, approved, implemented, documented, and reviewed in a controlled and consistent manner. A change management procedure typically includes the following elements: A change request that describes the purpose, scope, impact, and benefits of the change, as well as the roles and responsibilities of the change owner, implementer, and approver. A change assessment that evaluates the feasibility, risks, costs, and dependencies of the change, as well as the alternatives and contingency plans. A change approval that authorizes the change to proceed to the implementation stage, based on the criteria and thresholds defined by the change policy. A change implementation that executes the change according to the plan and schedule, and verifies the results and outcomes of the change. A change documentation that records the details and status of the change, as well as the lessons learned and best practices.

  A change review that monitors and measures the performance and effectiveness of the change, and identifies any issues or gaps that need to be addressed or improved. A change management procedure is important for a security administrator to adhere to when setting up a new set of firewall rules, as it can help to achieve the following objectives: Enhance the security posture and compliance of the network by ensuring that the firewall rules are aligned with the security policies and standards, and that they do not introduce any vulnerabilities or conflicts. Minimize the disruption and downtime of the network by ensuring that the firewall rules are tested and validated before deployment, and that they do not affect the availability or functionality of the network services or applications. Improve the efficiency and quality of the network by ensuring that the firewall rules are optimized and updated according to the changing needs and demands of the network users and stakeholders, and that they do not cause any performance or compatibility issues.

  Increase the accountability and transparency of the network by ensuring that the firewall rules are documented and reviewed regularly, and that they are traceable and auditable by the relevant authorities and parties. The other options are not correct because they are not related to the process of setting up a new set of firewall rules. A disaster recovery plan is a set of policies and procedures that aim to restore the normal operations of an organization in the event of a system failure, natural disaster, or other emergency. An incident response procedure is a set of steps and guidelines that aim to contain, analyze, eradicate, and recover from a security incident, such as a cyberattack, data breach, or malware infection. A business continuity plan is a set of strategies and actions that aim to maintain the essential functions and operations of an organization during and after a disruptive event, such as a pandemic, power outage, or civil unrest.

  References:

  CompTIA Security+ Study Guide (SY0-701), Chapter 7: Resilience and Recovery, page 325. Professor Messer's CompTIA SY0-701 Security+ Training Course, Section 1.3: Security Operations, video: Change Management(5:45).

• Question 58:

  A few weeks after deploying additional email servers, employees complain that messages are being marked as spam.

  Which needs to be updated?

  A. CNAME
  B. SMTP
  C. DLP
  D. SPF
  D. SPF

  ---

  Explanation

  SPF (Sender Policy Framework) DNS records specify which mail servers are authorized to send email on behalf of a domain. When new email servers are added but SPF records are not updated, recipient mail systems cannot verify the legitimacy of the new servers. As a result, those messages are flagged as spam or rejected altogether.

  CompTIA Security+ SY0-701 highlights SPF as an essential email authentication mechanism used to reduce spoofing, phishing, and spam classification errors. Updating the SPF record to include the new servers ensures email reputation is maintained and messages are delivered properly.

  CNAME (A) maps hostnames but does not affect outbound email legitimacy. SMTP (B) is the mail protocol, not the authentication method. DLP (C) governs sensitive data handling, not spam classification.

  Thus, SPF is the correct answer.

• Question 59:

  Which of the following phases of the incident response process attempts to minimize disruption?

  A. Recovery
  B. Containment
  C. Preparation
  D. Analysis
  B. Containment

  ---

  Explanation

  Containment is the phase where an organization attempts to minimize the damage caused by a security incident. This may involve isolating affected systems, blocking malicious traffic, or temporarily shutting down compromised services to prevent further impact.

  Recovery (A) focuses on restoring normal operations after an incident.

  Preparation (C) involves planning and readiness before an incident occurs.

  Analysis (D) involves investigating the root cause and assessing the damage.

  References:

  CompTIA Security+ SY0-701 Official Study Guide, Security Operations domain.

• Question 60:

  A user is attempting to navigate to a website from inside the company network using a desktop. When the user types in the URL. https://www.site.com, the user is presented with a certificate mismatch warning from the browser. The user does not receive a warning when visiting http://www.anothersite.com.

  Which of the following describes this attack?

  A. On-path
  B. Domain hijacking
  C. DNS poisoning
  D. Evil twin
  C. DNS poisoning

  ---

  Explanation

  DNS poisoning - DNS poisoning occurs when hackers gain access to a DNS server and begins to redirect traffic to a different IP address by alternating a DNS record.

  For this question, DNS poisoning on HTTPS will result in a certificate mismatch error, which means a DNS record has been altered.