CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 631:

  Which of the following is a hardware-specific vulnerability?

  A. Firmware version
  B. Buffer overflow
  C. SQL injection
  D. Cross-site scripting
  A. Firmware version

  ---

  Explanation

  Firmware is a type of software that is embedded in a hardware device, such as a router, a printer, or a BIOS chip. Firmware controls the basic functions and operations of the device, and it can be updated or modified by the manufacturer or the user. Firmware version is a hardware-specific vulnerability, as it can expose the device to security risks if it is outdated, corrupted, or tampered with. An attacker can exploit firmware vulnerabilities to gain unauthorized access, modify device settings, install malware, or cause damage to the device or the network. Therefore, it is important to keep firmware updated and verify its integrity and authenticity.

  References:

  CompTIA Security+ Study Guide with over 500 Practice Test Questions: Exam SY0-701, 9th Edition, Chapter 2, page 67. CompTIA Security+ SY0-701 Exam Objectives, Domain 2.1, page 10.

• Question 632:

  Which of the following agreement types is used to limit external discussions?

  A. BPA
  B. NDA
  C. SLA
  D. MSA
  B. NDA

• Question 633:

  A company is implementing a vendor's security tool in the cloud. The security director does not want to manage users and passwords specific to this tool but would rather utilize the company's standard user directory.

  Which of the following should the company implement?

  A. 802.1X
  B. SAML
  C. RADIUS
  D. CHAP
  B. SAML

  ---

  Explanation

  The company should implement Security Assertion Markup Language (SAML) to integrate the vendor's security tool with their existing user directory. SAML is an open standard that allows identity providers (IdP) to pass authorization credentials to service providers (SP), enabling Single Sign-On (SSO). This allows the company to use its existing directory services for authentication, avoiding the need to manage a separate set of user credentials for the new tool.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 4: Identity and Access Management, which includes SAML as a key identity federation standard for SSO. CompTIA Security+ Study Guide (SY0-601): Chapter 8, "Identity and Access Management," details the role of SAML in enabling SSO by utilizing an existing identity provider.

• Question 634:

  A security administrator wants to implement a security information and event management system. The administrator must first collect network traffic on the switch to gain visibility of the network.

  Which of the following is the most appropriate method?

  A. Syslog
  B. Port mirroring
  C. Port forwarding
  D. Load balancer logs
  B. Port mirroring

  ---

  Explanation

  The correct answer is B. Port mirroring. Port mirroring, also known as SPAN, copies network traffic from one or more switch ports or VLANs to another port where a monitoring tool, packet analyzer, IDS, or SIEM-related sensor can inspect the traffic. This is the most appropriate method when the goal is to collect network traffic directly from a switch to gain visibility into network activity.

  Why the other options are incorrect:

  A. Syslog Syslog collects log messages from systems, applications, and network devices. It is useful for SIEM log ingestion, but it does not capture full network traffic from a switch.

  C. Port forwarding Port forwarding redirects traffic from one port or IP address to another, commonly used for NAT or remote access. It is not used to monitor switch traffic.

  D. Load balancer logs Load balancer logs provide information about traffic passing through a load balancer, but they do not provide broad switch-level network visibility. Therefore, the best answer is port mirroring.

• Question 635:

  Which of the following is the best reason to complete an audit in a banking environment?

  A. Regulatory requirement
  B. Organizational change
  C. Self-assessment requirement
  D. Service-level requirement
  A. Regulatory requirement

  ---

  Explanation

  A regulatory requirement is a mandate imposed by a government or an authority that must be followed by an organization or an individual. In a banking environment, audits are often required by regulators to ensure compliance with laws, standards, and policies related to security, privacy, and financial reporting. Audits help to identify and correct any gaps or weaknesses in the security posture and the internal controls of the organization.

  References:

  Official CompTIA Security+ Study Guide (SY0-701), page 507 Security+ (Plus) Certification | CompTIA IT Certifications 2

• Question 636:

  A security analyst is reviewing the following logs:

  

  Which of the following attacks is most likely occurring?

  A. Password spraying
  B. Account forgery
  C. Pass-the-hash
  D. Brute-force
  A. Password spraying

  ---

  Explanation

  Password spraying is a type of brute force attack that tries common passwords across several accounts to find a match. It is a mass trial-and-error approach that can bypass account lockout protocols. It can give hackers access to personal or business accounts and information. It is not a targeted attack, but a high-volume attack tactic that uses a dictionary or a list of popular or weak passwords. The logs show that the attacker is using the same password ("password123") to attempt to log in to different accounts ("admin", "user1", "user2", etc.) on the same web server. This is a typical pattern of password spraying, as the attacker is hoping that at least one of the accounts has a weak password that matches the one they are trying. The attacker is also using a tool called Hydra, which is one of the most popular brute force tools, often used in cracking passwords for network authentication. Account forgery is not the correct answer, because it involves creating fake accounts or credentials to impersonate legitimate users or entities. There is no evidence of account forgery in the logs, as the attacker is not creating any new accounts or using forged credentials.

  Pass-the-hash is not the correct answer, because it involves stealing a hashed user credential and using it to create a new authenticated session on the same network. Pass- the-hash does not require the attacker to know or crack the password, as they use the stored version of the password to initiate a new session. The logs show that the attacker is using plain text passwords, not hashes, to try to log in to the web server. Brute-force is not the correct answer, because it is a broader term that encompasses different types of attacks that involve trying different variations of symbols or words until the correct password is found. Password spraying is a specific type of brute force attack that uses a single common password against multiple accounts. The logs show that the attacker is using password spraying, not brute force in general, to try to gain access to the web server.

  References:

  1: Password spraying: An overview of password spraying attacks ... - Norton,

  2: Security: Credential Stuffing vs. Password Spraying - Baeldung,

  3: Brute Force Attack: A definition + 6 types to know | Norton,

  4: What is a Pass- the-Hash Attack? - CrowdStrike,

  5: What is a Brute Force Attack? | Definition, Types & How It Works - Fortinet

• Question 637:

  A company's legal department drafted sensitive documents in a SaaS application and wants to ensure the documents cannot be accessed by individuals in high-risk countries.

  Which of the following is the most effective way to limit this access?

  A. Data masking
  B. Encryption
  C. Geolocation policy
  D. Data sovereignty regulation
  C. Geolocation policy

  ---

  Explanation

  A geolocation policy is a policy that restricts or allows access to data or resources based on the geographic location of the user or device. A geolocation policy can be implemented using various methods, such as IP address filtering, GPS tracking, or geofencing. A geolocation policy can help the company's legal department to prevent unauthorized access to sensitive documents from individuals in high-risk countries. The other options are not effective ways to limit access

  based on location:

  Data masking: This is a technique of obscuring or replacing sensitive data with fictitious or anonymized data. Data masking can protect the privacy and confidentiality of data, but it does not prevent access to data based on location.

  Encryption: This is a process of transforming data into an unreadable format using a secret key or algorithm. Encryption can protect the integrity and confidentiality of data, but it does not prevent access to data based on location. Encryption can also be bypassed by attackers who have the decryption key or method. Data sovereignty regulation: This is a set of laws or rules that govern the storage, processing, and transfer of data within a specific jurisdiction or country. Data sovereignty regulation can affect the availability and compliance of data, but it does not prevent access to data based on location. Data sovereignty regulation can also vary depending on the country or region.

  References:

  1: CompTIA Security+ SY0-701 Certification Study Guide, page 97

  2: Account Policies -SY0-601 CompTIA Security+ : 3.7, video by Professor Messer

  3: CompTIA Security+ SY0-701 Certification Study Guide, page 100

  4: CompTIA Security+ SY0-701 Certification Study Guide, page 101. : CompTIA Security+ SY0-701 Certification Study Guide, page 102.

• Question 638:

  A company suffered a critical incident where 30GB of data was exfiltrated from the corporate network.

  Which of the following actions is the most efficient way to identify where the system data was exfiltrated from and what location the attacker sent the data to?

  A. Analyze firewall and network logs for large amounts of outbound traffic to external IP addresses or domains.
  B. Analyze IPS and IDS logs to find the IP addresses used by the attacker for reconnaissance scans.
  C. Analyze endpoint and application logs to see whether file-sharing programs were running on the company systems.
  D. Analyze external vulnerability scans and automated reports to identify the systems the attacker could have exploited a remote code vulnerability.
  A. Analyze firewall and network logs for large amounts of outbound traffic to external IP addresses or domains.

  ---

  Explanation

  Firewall and network logs are the most efficient sources for identifying large outbound data transfers, as they record all traffic leaving the network. By examining these logs for significant data flows to unfamiliar or external IP addresses or domains, the security team can determine where the data was exfiltrated and potentially identify the destination of the exfiltrated data. This approach directly targets the incident's key indicators: large data transfer and external communication.

• Question 639:

  A systems administrator is changing the password policy within an enterprise environment and wants this update implemented on all systems as quickly as possible.

  Which of the following operating system security measures will the administrator most likely use?

  A. Deploying PowerShell scripts
  B. Pushing GPO update
  C. Enabling PAP
  D. Updating EDR profiles
  B. Pushing GPO update

  ---

  Explanation

  A group policy object (GPO) is a mechanism for applying configuration settings to computers and users in an Active Directory domain. By pushing a GPO update, the systems administrator can quickly and uniformly enforce the new password policy across all systems in the domain. Deploying PowerShell scripts, enabling PAP, and updating EDR profiles are not the most efficient or effective ways to change the password policy within an enterprise environment.

  References:

  CompTIA Security+ Study Guide:

  Exam SY0-701, 9th Edition, page 115

  Password Policy - Windows Security

• Question 640:

  A security officer is implementing a security awareness program and is placing security-themed posters around the building and is assigning online user training.

  Which of the following would the security officer most likely implement?

  A. Password policy
  B. Access badges
  C. Phishing campaign
  D. Risk assessment
  C. Phishing campaign

  ---

  Explanation

  In a security awareness program, a phishing campaign is often implemented alongside other awareness activities, such as security-themed posters and online user training. Phishing simulations help users recognize and respond correctly to phishing attempts, reinforcing the training's effectiveness. This practical exercise increases awareness about social engineering attacks, making it a suitable component of a comprehensive security awareness program.