CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 651:

  An organization recently updated its security policy to include the following statement:

  Regular expressions are included in source code to remove special characters such as $, |, ;. &, `, and ? from variables set by forms in a web application.

  Which of the following best explains the security technique the organization adopted by making this addition to the policy?

  A. Identify embedded keys
  B. Code debugging
  C. Input validation
  D. Static code analysis
  C. Input validation

  ---

  Explanation

  Input validation is a security technique that checks the user input for any malicious or unexpected data before processing it by the application. Input validation can prevent various types of attacks, such as injection, cross-site scripting, buffer overflow, and command execution, that exploit the vulnerabilities in the application code. Input validation can be performed on both the client-side and the server-side, using methods such as whitelisting, blacklisting, filtering, sanitizing, escaping, and encoding. By including regular expressions in the source code to remove special characters from the variables set by the forms in the web application, the organization adopted input validation as a security technique. Regular expressions are patterns that match a specific set of characters or strings, and can be used to filter out any unwanted or harmful input. Special characters, such as $, |, ;, &, `, and ?, can be used by attackers to inject commands or scripts into the application, and cause damage or data theft. By removing these characters from the input, the organization can reduce the risk of such attacks.

  Identify embedded keys, code debugging, and static code analysis are not the security techniques that the organization adopted by making this addition to the policy. Identify embedded keys is a process of finding and removing any hard- coded keys or credentials from the source code, as these can pose a security risk if exposed or compromised. Code debugging is a process of finding and fixing any errors or bugs in the source code, which can affect the functionality or performance of the application. Static code analysis is a process of analyzing the source code without executing it, to identify any vulnerabilities, flaws, or coding standards violations. These techniques are not related to the use of regular expressions to remove special characters from the input.

  References:

  CompTIA Security+ SY0-701 Certification Study Guide, page 375-376

  Professor Messer's CompTIA SY0-701 Security+ Training Course, video 4.1 - Vulnerability Scanning, 8:00 - 9:08

  Application Security -SY0-601 CompTIA Security+ : 3.2,

  0:00 - 2:00.

• Question 652:

  A security analyst receives an alert from a corporate endpoint used by employees to issue visitor badges. The alert contains the following details:

  

  Which of the following best describes the indicator that triggered the alert?

  A. Blocked content
  B. Brute-force attack
  C. Concurrent session usage
  D. Account lockout
  B. Brute-force attack

  ---

  Explanation

  The activity described in the table, where multiple connection attempts are made on port 445 (used for SMB services), suggests a brute-force attack. The attacker likely used automated methods to guess credentials, causing multiple failures.

  Such attempts are a hallmark of brute-force attacks targeting shared resources.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 4: Security Operations, Section: "Indicators of Malicious Activity".

• Question 653:

  An attacker submits a request containing unexpected characters in an attempt to gain unauthorized access to information within the underlying systems.

  Which of the following best describes this attack?

  A. Side loading
  B. Target of evaluation
  C. Resource reuse
  D. SQL injection
  D. SQL injection

  ---

  Explanation

  SQL injection is an attack technique where an attacker includes unexpected characters or SQL code in a request to manipulate a database query, aiming to gain unauthorized access to data or execute additional database commands. This form of injection targets vulnerabilities in applications that don't properly validate input, allowing attackers to interact with underlying database systems maliciously.

• Question 654:

  An administrator discovers that some files on a database server were recently encrypted. The administrator sees from the security logs that the data was last accessed by a domain user.

  Which of the following best describes the type of attack that occurred?

  A. Insider threat
  B. Social engineering
  C. Watering-hole
  D. Unauthorized attacker
  A. Insider threat

  ---

  Explanation

  An insider threat is a type of attack that originates from someone who has legitimate access to an organization's network, systems, or data. In this case, the domain user who encrypted the files on the database server is an example of an insider threat, as they abused their access privileges to cause harm to the organization. Insider threats can be motivated by various factors, such as financial gain, revenge, espionage, or sabotage.

  References:

  1: General Security Concepts, page 251. CompTIA Security+ Certification Kit: Exam SY0- 701, 7th Edition, Chapter

  1: General Security Concepts, page 252.

• Question 655:

  A systems administrator notices that one of the systems critical for processing customer transactions is running an end-of-life operating system.

  Which of the following techniques would increase enterprise security?

  A. Installing HIDS on the system
  B. Placing the system in an isolated VLAN
  C. Decommissioning the system
  D. Encrypting the system's hard drive
  B. Placing the system in an isolated VLAN

  ---

  Explanation

  To enhance security for a system running an end-of-life operating system, placing the system in an isolated VLAN is the most effective approach. By isolating the system from the rest of the network, you can limit its exposure to potential threats while maintaining its functionality. This segmentation helps protect the rest of the network from any vulnerabilities in the outdated system. Installing HIDS (Host-based Intrusion Detection System) can help detect intrusions but won't mitigate the risks posed by an unsupported OS. Decommissioning may not be feasible if the system is critical. Encrypting the system's hard drive protects data at rest but doesn't address vulnerabilities from an outdated OS.

• Question 656:

  Which of the following methods to secure data is most often used to protect data in transit?

  A. Encryption
  B. Obfuscation
  C. Permission restrictions
  D. Hashing
  A. Encryption

• Question 657:

  Which of the following best describes a common use of OSINT?

  A. Monitoring internal systems and network traffic to detect abnormal behavior
  B. Installing and configuring security patches to fix known vulnerabilities
  C. Collecting information from public platforms to find possible security exposures
  D. Encrypting sensitive company data and storing it securely in the cloud
  C. Collecting information from public platforms to find possible security exposures

  ---

  Explanation

  OSINT stands for open source intelligence and is commonly used to gather information from publicly available sources to support security activities such as reconnaissance, threat intelligence, and identifying exposures (for example, leaked credentials, exposed infrastructure details, or public references to vulnerabilities). The Practice Tests book defines OSINT directly: "OSINT, or open source intelligence, is intelligence information obtained from public sources like search engines, websites, domain name registrars, and a host of other locations." That definition aligns precisely with option C's "collecting information from public platforms."

  The Study Guide similarly explains OSINT in the threat intelligence context: "Open source threat intelligence is threat intelligence that is acquired from publicly available sources." This supports the idea that OSINT is used to discover relevant information that may affect security posture-such as indicators, exposed assets, or details useful for defensive planning. The other options describe different operational activities: A is internal monitoring (SIEM/IDS/EDR style), B is patch management, and D is encryption/storage strategy-none are "open source intelligence."

  References:

  OSINT definition as intelligence obtained from public sources

  OSINT as threat intelligence acquired from publicly available sources.

• Question 658:

  Which of the following should a security team do first before a new web server goes live?

  A. Harden the virtual host.
  B. Create WAF rules.
  C. Enable network intrusion detection.
  D. Apply patch management.
  A. Harden the virtual host.

  ---

  Explanation

  Before a new web server goes live, the first step should be to harden the virtual host. Hardening involves securing the server by disabling unnecessary services, configuring permissions, and applying best practices to minimize vulnerabilities.

  This foundational step reduces the attack surface and ensures the server is secure before additional security measures, such as WAF rules, intrusion detection, or patch management, are applied.

• Question 659:

  Which of the following types of vulnerabilities is primarily caused by improper use and management of cryptographic certificates?

  A. Misconfiguration
  B. Resource reuse
  C. Insecure key storage
  D. Weak cipher suites
  C. Insecure key storage

  ---

  Explanation

  Insecure key storage refers to vulnerabilities caused by improper handling of cryptographic keys and certificates, such as storing them in plaintext or lacking access controls.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 2: Threats, Section: "Cryptographic Vulnerabilities and Mitigation".

• Question 660:

  The security team at a large global company needs to reduce the cost of storing data used for performing investigations.

  Which of the following types of data should have its retention length reduced?

  A. Packet capture
  B. Endpoint logs
  C. OS security logs
  D. Vulnerability scan
  A. Packet capture

  ---

  Explanation

  Packet capture data can be very large and may not need to be stored for extended periods compared to other logs essential for security audits.