CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 641:

  An attorney prints confidential documents to a copier in an office space near multiple workstations and a reception desk. When the attorney goes to the copier to retrieve the documents, the documents are missing.

  Which of the following would best prevent this from reoccurring?

  A. Place the copier in the legal department.
  B. Configure DLP on the attorney's workstation.
  C. Set up LDAP authentication on the printer.
  D. Conduct a physical penetration test.
  C. Set up LDAP authentication on the printer.

• Question 642:

  A company implemented an MDM policy 10 mitigate risks after repealed instances of employees losing company-provided mobile phones. In several cases. The lost phones were used maliciously to perform social engineering attacks against other employees.

  Which of the following MDM features should be configured to best address this issue?

  (Select two).

  A. Screen locks
  B. Remote wipe
  C. Full device encryption
  D. Push notifications
  E. Application management
  F. Geolocation
  A. Screen locks
  B. Remote wipe

  ---

  Explanation

  Integrating each SaaS solution with an Identity Provider (IdP) is the most effective way to address the security issue. This approach allows for Single Sign-On (SSO) capabilities, where users can access multiple SaaS applications with a single set of credentials while maintaining strong password policies across all services. It simplifies the user experience and ensures consistent security enforcement across different SaaS platforms.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 05 Security Program Management and Oversight.

  CompTIA Security+ SY0-601 Study Guide: Chapter on Identity and Access Management.

• Question 643:

  A company is planning a disaster recovery site and needs to ensure that a single natural disaster would not result in the complete loss of regulated backup data.

  Which of the following should the company consider?

  A. Geographic dispersion
  B. Platform diversity
  C. Hot site
  D. Load balancing
  A. Geographic dispersion

  ---

  Explanation

  Geographic dispersion is the practice of having backup data stored in different locations that are far enough apart to minimize the risk of a single natural disaster affecting both sites. This ensures that the company can recover its regulated data in case of a disaster at the primary site. Platform diversity, hot site, and load balancing are not directly related to the protection of backup data from natural disasters.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 449

  Disaster Recovery Planning: Geographic Diversity

• Question 644:

  Which of the following best describes why the SMS OTP authentication method is more risky to implement than the TOTP method?

  A. The SMS OTP method requires an end user to have an active mobile telephone service and SIM card.
  B. Generally. SMS OTP codes are valid for up to 15 minutes while the TOTP time frame is 30 to 60 seconds
  C. The SMS OTP is more likely to be intercepted and lead to unauthorized disclosure of the code than the TOTP method.
  D. The algorithm used to generate on SMS OTP code is weaker than the one used to generate a TOTP code
  C. The SMS OTP is more likely to be intercepted and lead to unauthorized disclosure of the code than the TOTP method.

  ---

  Explanation

  The SMS OTP (One-Time Password) method is more vulnerable to interception compared to TOTP (Time-based One-Time Password) because SMS messages can be intercepted through various attack vectors like SIM swapping or SMS phishing. TOTP, on the other hand, generates codes directly on the device and does not rely on a communication channel like SMS, making it less susceptible to interception.

  References:

  CompTIA Security+ SY0-701 study materials, particularly in the domain of identity and access management.

• Question 645:

  Which of the following phases of an incident response involves generating reports?

  A. Recovery
  B. Preparation
  C. Lessons learned
  D. Containment
  C. Lessons learned

  ---

  Explanation

  The lessons learned phase of an incident response process involves reviewing the incident and generating reports. This phase helps identify what went well, what needs improvement, and what changes should be made to prevent future incidents. Documentation and reporting are essential parts of this phase to ensure that the findings are recorded and used for future planning. Recovery focuses on restoring services and normal operations. Preparation involves creating plans and policies for potential incidents, not reporting.

  Containment deals with isolating and mitigating the effects of the incident, not generating reports.

• Question 646:

  Which of the following will most likely lead an organization to revise its change management policy?

  A. An engineer adds a new feature to the production service.
  B. A production server continuously runs at its maximum load.
  C. Software is migrated to a cloud that offers increased flexibility in its updates.
  D. A legacy server lacks support for new regulatory requirements.
  C. Software is migrated to a cloud that offers increased flexibility in its updates.

  ---

  Explanation

  The best answer is C. Software is migrated to a cloud that offers increased flexibility in its updates. A change management policy defines how changes are requested, reviewed, approved, tested, documented, and implemented. When an organization migrates software to a cloud environment that supports more dynamic, frequent, or automated updates, the change management process may need to be revised to reflect the new operational model. Cloud environments often introduce: faster deployment cycles infrastructure as code automated updates continuous integration and continuous delivery different approval and rollback processes.

  These changes can significantly affect how the organization governs system changes, so revising the policy is likely necessary. Why the other options are incorrect:

  A. An engineer adds a new feature to the production service.This is an example of a change that should follow policy, not necessarily a reason to revise the policy itself.

  B. A production server continuously runs at its maximum load.This is more of a performance or capacity issue than a direct reason to revise change management policy.

  D. A legacy server lacks support for new regulatory requirements.This points more toward compliance remediation or system replacement, not specifically revising change management policy. From the SY0-701 perspective, major shifts in how systems are updated and maintained, especially through cloud adoption, are strong reasons to update change management governance. Therefore, C is correct.

• Question 647:

  Following a security review, an organization must ensure users verify their identities against the company's identity services with individual credentials leveraging WPA2-Enterprise for wireless access.

  Which of the following configuration steps correctly applies RADIUS in this environment?

  A. Enabling 802.1X authentication and integrating it with the corporate directory
  B. Installing self-signed certificates on all user devices
  C. Enabling MAC filters for all wireless clients
  D. Configuring the wireless controller to require multifactor authentication
  A. Enabling 802.1X authentication and integrating it with the corporate directory

  ---

  Explanation

  WPA2-Enterprise is designed for environments where users authenticate with unique, individual credentials backed by an enterprise identity store, rather than a shared preshared key. The Study Guide explicitly states: "WPA2-Enterprise relies on a RADIUS authentication server as part of an 802.1X implementation for authentication. Users can thus have unique credentials and be individually identified." That maps directly to the requirement that users verify identity against the company's identity services using individual credentials. It further explains how this is implemented operationally: "802.1X is an IEEE standard for access control... In wireless networks, 802.1X is used to integrate with RADIUS servers, allowing enterprise users to authenticate and gain access to the network."

  Therefore, the correct configuration step is enabling 802.1X and tying authentication into the organization's identity source (commonly a corporate directory). The other choices don't correctly "apply RADIUS" for WPA2-Enterprise: self-signed certs are not universally required for all EAP types and can introduce trust issues; MAC filters are weak and spoofable; and MFA might be beneficial but is not the fundamental step that enables RADIUS-backed WPA2-Enterprise authentication.

  References:

  WPA2-Enterprise uses RADIUS + 802.1X and supports unique user credentials

  802.1X integrates wireless authentication with RADIUS.

• Question 648:

  A security team wants WAF policies to be automatically created when applications are deployed.

  Which concept describes this capability?

  A. IaC
  B. IoT
  C. IoC
  D. IaaS
  A. IaC

  ---

  Explanation

  Automatically generating WAF rules when applications are deployed is a hallmark of Infrastructure as Code (IaC). IaC allows infrastructure components-including firewalls, WAF policies, and load balancers-to be defined and deployed via code templates rather than manual configuration. In DevSecOps, IaC enables security controls to be embedded into deployment pipelines, ensuring that protections such as WAF rules are created instantly and consistently whenever new application versions are released.

  Security+ SY0-701 highlights IaC as a method for automating infrastructure provisioning, standardizing security controls, and reducing configuration drift. This allows development and security teams to collaborate more effectively by treating security policies as code.

  IoT (B) refers to smart devices, IoC (C) refers to indicators of compromise, and IaaS (D) refers to cloud compute infrastructure-not automated security policy creation.

  Thus, the correct answer is A: IaC.

• Question 649:

  For which of the following reasons would a systems administrator leverage a SHA-256 hash from an installer file that is posted on a vendor's website?

  A. To test the integrity of the file
  B. To validate the authenticity of the file
  C. To activate the license for the file
  D. To calculate the checksum of the file
  A. To test the integrity of the file

  ---

  Explanation

  A SHA-256 hash published by a vendor is used to verify that the downloaded installer file has not been altered, corrupted, or damaged. The administrator calculates the SHA-256 hash of the downloaded file and compares it with the hash posted on the vendor's website. If both values match, the file integrity is confirmed.

  Why the other options are incorrect:

  B. To validate the authenticity of the file This is incorrect because a hash by itself does not prove who created the file. Authenticity is typically verified through a digital signature or certificate, not only by comparing hashes.

  C. To activate the license for the file This is incorrect because a SHA-256 hash has no role in software licensing or activation.

  D. To calculate the checksum of the file This is not the best answer because calculating the checksum is the process being performed, but the reason for doing it is to verify the file's integrity. Conclusion: The correct answer is A because SHA-256 is primarily used to confirm file integrity.

• Question 650:

  Which of the following risk management strategies is being used when a Chief Information Security Officer ignores known vulnerabilities identified during a risk assessment?

  A. Transfer
  B. Avoid
  C. Mitigate
  D. Accept
  D. Accept

  ---

  Explanation

  The correct answer is Accept because knowingly choosing not to address identified vulnerabilities is a formal example of risk acceptance. In the Security+ SY0-701 risk management framework, accepting risk means that leadership is aware of a vulnerability and its potential impact but decides to take no corrective action. This decision is typically based on factors such as cost, operational constraints, low likelihood of exploitation, or limited business impact.

  Risk acceptance is a deliberate management decision, not an oversight. When a Chief Information Security Officer ignores known vulnerabilities identified during a risk assessment, the organization is implicitly acknowledging the risk and choosing to tolerate it. The SY0-701 study guide emphasizes that risk acceptance must be informed and approved by appropriate leadership, as accountability remains with the organization if the risk materializes.

  Option A, Transfer, is incorrect because transferring risk involves shifting responsibility to a third party, such as purchasing cyber insurance or outsourcing services. Option B, Avoid, refers to eliminating risk entirely by discontinuing the risky activity, system, or process. Option C, Mitigate, involves implementing security controls to reduce the likelihood or impact of the risk, such as patching vulnerabilities or adding compensating controls.

  Accepting risk does not mean the vulnerability is harmless; it means leadership has determined that addressing it is not justified at that time. The SY0-701 objectives highlight that accepted risks should be documented, reviewed periodically, and reassessed as conditions change, especially if threat likelihood or business impact increases.

  In summary, ignoring known vulnerabilities after a risk assessment reflects a conscious decision to tolerate potential loss rather than reduce or eliminate it. This aligns directly with the risk acceptance strategy, making Option D the correct answer.