CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 621:

  A penetration test identifies that an SMBvl Is enabled on multiple servers across an organization. The organization wants to remediate this vulnerability in the most efficient way possible.

  Which of the following should the organization use for this purpose?

  A. GPO
  B. ACL
  C. SFTP
  D. DLP
  A. GPO

  ---

  Explanation

  SMBv1 is an outdated and vulnerable protocol that should be disabled to mitigate risks, such as exploitation by attacks like WannaCry. The question emphasizes efficiency across multiple servers. Option A (GPO) allows an organization to push a policy to disable SMBv1 across all servers in an Active Directory environment with minimal effort, making it the most efficient choice.

  Option B (ACL) refers to Access Control Lists, which manage permissions but aren't designed for protocol configuration.

  Option C (SFTP) is a secure file transfer protocol unrelated to SMBv1 remediation.

  Option D (DLP) focuses on data loss prevention, not protocol vulnerabilities. Thus, A is the correct and most efficient solution.

• Question 622:

  A company allows customers to upload PDF documents to its public e-commerce website.

  Which of the following would a security analyst most likely recommend?

  A. Utilizing attack signatures in an IDS
  B. Enabling malware detection through a UTM
  C. Limiting the affected servers with a load balancer
  D. Blocking command injections via a WAF
  B. Enabling malware detection through a UTM

• Question 623:

  A security analyst is investigating a workstation that is suspected of outbound communication to a command-and-control server. During the investigation, the analyst discovered that logs on the endpoint were deleted.

  Which of the following logs would the analyst most likely look at next?

  A. IPS
  B. Firewall
  C. ACL
  D. Windows security
  B. Firewall

  ---

  Explanation

  Since the logs on the endpoint were deleted, the next best option for the analyst is to examine firewall logs. Firewall logs can reveal external communication, including outbound traffic to a command-and-control (C2) server. These logs would contain information about the IP addresses, ports, and protocols used, which can help in identifying suspicious connections.

  IPS logs may provide information about network intrusions, but firewall logs are better for tracking communication patterns.

  ACL logs (Access Control List) are useful for tracking access permissions but not for identifying C2 communication.

  Windows security logs would have been ideal if they had not been deleted

• Question 624:

  Which of the following must be considered when designing a high-availability network? (Choose two).

  A. Ease of recovery
  B. Ability to patch
  C. Physical isolation
  D. Responsiveness
  E. Attack surface
  F. Extensible authentication
  A. Ease of recovery
  D. Responsiveness

  ---

  Explanation

  Ease of recovery. This is essential for high availability because the network must be able to recover quickly from failures to minimize downtime. Responsiveness. Ensuring that the network can handle high traffic loads and respond quickly to user requests is crucial for maintaining high availability.

  Other factors like physical isolation, ability to patch, attack surface, and extensible authentication are important for security and maintenance but are not primary considerations for high availability.

• Question 625:

  Which of the following best describes the main difference between an MOU and an SOW?

  A. An MOU is usually not legally binding, while an SOW is usually legally binding about outcomes.
  B. An MOU identifies engagement details, while an SOW specifies who will engage.
  C. An MOU requires signatures from both parties, while an SOW only requires a signature from the service provider.
  D. An MOU is typically very detailed about tasks, while an SOW is typically high-level.
  A. An MOU is usually not legally binding, while an SOW is usually legally binding about outcomes.

  ---

  Explanation

  The correct answer is A because the primary distinction between a Memorandum of Understanding (MOU) and a Statement of Work (SOW) lies in their legal enforceability and purpose. In the Security+ SY0-701 governance and third-party risk management context, an MOU is generally a formal but nonbinding agreement that outlines mutual expectations, responsibilities, and cooperation between parties. It establishes intent and alignment but typically does not impose enforceable obligations or penalties if terms are not met.

  An SOW, on the other hand, is legally binding and serves as a contractual document that defines specific deliverables, timelines, performance metrics, and acceptance criteria. The SY0-701 study guide emphasizes that SOWs are critical in vendor and service provider relationships because they clearly define what work will be performed, how success is measured, and what happens if requirements are not met. This makes the SOW enforceable in legal and regulatory contexts, especially when dealing with sensitive systems or data.

  Option B is incorrect because both MOUs and SOWs can identify engagement participants, but this is not their defining difference.

  Option C is incorrect because both documents typically require agreement from all involved parties, and signature requirements vary by organization and jurisdiction.

  Option D is incorrect because it reverses the actual level of detail: MOUs are high-level and conceptual, while SOWs are detailed and task-specific.

  In security programs, MOUs are often used for cooperative arrangements, such as information sharing between organizations or government entities. SOWs are used when accountability, compliance, and measurable outcomes are required.

  Understanding this distinction is essential for managing third-party risk, enforcing security requirements, and maintaining compliance with Security+ SY0-701 governance objectives.

• Question 626:

  The management team wants to assess the cybersecurity team's readiness to respond to a threat scenario.

  Which of the following will adequately assess and formalize a response within a short time?

  A. Send a message to all IT managers and request formal action plans.
  B. Create a bug bounty program and assess the findings.
  C. Execute a tabletop exercise and document the performance results.
  D. Hire an external consultant to independently assess the cybersecurity processes.
  C. Execute a tabletop exercise and document the performance results.

  ---

  Explanation

  A tabletop exercise is the most effective way to quickly assess a cybersecurity team's readiness to respond to a threat scenario. CompTIA Security+ SY0-701 describes tabletop exercises as discussion-based simulations where incident response team members walk through a realistic scenario to evaluate procedures, decision-making, communication, and coordination. These exercises are specifically designed to be conducted in a short timeframe while still providing meaningful insight into preparedness.

  Executing a tabletop exercise allows management to observe how the team identifies threats, escalates incidents, assigns roles, and follows the incident response plan. Documenting performance results helps formalize findings, identify gaps, and improve playbooks and procedures without the complexity of a live incident or full-scale simulation.

  Option A is informal and does not test real-time decision-making.

  Option B focuses on vulnerability discovery, not response readiness.

  Option D can be effective but is time-consuming and not suited for rapid assessment.

  Therefore, C: Execute a tabletop exercise and document the performance results is the correct answer.

• Question 627:

  An accountant is transferring information to a bank over FTP.

  Which of the following mitigations should the accountant use to protect the confidentiality of the data?

  A. Tokenization
  B. Data masking
  C. Encryption
  D. Obfuscation
  C. Encryption

  ---

  Explanation

  Encrypting the data ensures that it remains confidential and protected from unauthorized access during transfer. Standard FTP does not provide secure transmission, so adding encryption--such as using FTPS (FTP Secure) or SFTP (SSH File Transfer Protocol)--will safeguard the data by making it unreadable to anyone intercepting the transfer.

• Question 628:

  A new employee can select a particular make and model of an employee workstation from a preapproved list.

  Which of the following is this an example of?

  A. MDM
  B. CYOD
  C. PED
  D. COPE
  B. CYOD

  ---

  Explanation

  The described scenario is CYOD (Choose Your Own Device). In a CYOD model, employees may choose from a list of company-approved devices. These devices are vetted for compatibility, security, and organizational standards while still providing some flexibility to employees.

  The SY0-701 exam differentiates CYOD from other mobile deployment models:

  COPE (D) - Company-Owned,

  Personally Enabled: devices are company-owned and fully managed, but employees can use them personally.

  MDM (A) - Mobile Device Management: a tool, not a deployment model, used for managing configurations and security on devices.

  PED (C) - Portable Electronic Device: a generic category, not a deployment strategy.

  CYOD strikes a balance between employee preference and maintaining a secure, standardized environment. It reduces risk associated with BYOD while avoiding the rigidity of COPE. CYOD also supports consistent patching, support, and security enforcement because all devices meet the organization's baseline criteria.

  This aligns with the Security Architecture section of SY0-701, where the exam stresses secure device deployment strategies and maintaining uniform controls over endpoint assets.

• Question 629:

  Which of the following is a prerequisite for a DLP solution?

  A. Data destruction
  B. Data sanitization
  C. Data classification
  D. Data masking
  C. Data classification

  ---

  Explanation

  Data classification is essential for a Data Loss Prevention (DLP) solution to function effectively. It identifies and labels data based on sensitivity and importance, enabling the DLP system to apply appropriate policies to protect it.

• Question 630:

  Which of the following technologies assists in passively verifying the expired status of a digital certificate?

  A. OCSP
  B. CRL
  C. TPM
  D. CSR
  A. OCSP