CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 661:

  A systems administrator works for a local hospital and needs to ensure patient data is protected and secure.

  Which of the following data classifications should be used to secure patient data?

  A. Private
  B. Critical
  C. Sensitive
  D. Public
  C. Sensitive

  ---

  Explanation

  Sensitive is the best answer because patient data contains personally identifiable and medical information that requires stronger protection against unauthorized access, disclosure, or misuse. In security classification questions, "sensitive" is the category most directly associated with information that could harm individuals or the organization if exposed.

  The distractors are weaker for these reasons: Public is clearly incorrect because patient data is never intended for open disclosure.

  Critical refers to information or systems essential to operations, availability, or business continuity, not specifically to privacy-regulated personal data.

  Private can sometimes mean internal-use data, but it does not as clearly express the higher confidentiality requirements associated with medical records.

  So the cleanest classification for patient data is sensitive.

• Question 662:

  While investigating a possible incident, a security analyst discovers the following log entries:

  67.118.34.157 ----- [28/Jul/2022:10:26:59 -0300] "GET /query.php?q- wireless%20headphones / HTTP/1.0" 200 12737

  132.18.222.103 ----[28/Jul/2022:10:27:10 -0300] "GET /query.php?q=123 INSERT INTO users VALUES('temp', 'pass123')# / HTTP/1.0" 200 935 12.45.101.121 ----- [28/Jul/2022:10:27:22 -0300] "GET /query.php?q=mp3%20players I

  HTTP/1.0" 200 14650

  Which of the following should the analyst do first?

  A. Implement a WAF
  B. Disable the query .php script
  C. Block brute-force attempts on temporary users
  D. Check the users table for new accounts
  D. Check the users table for new accounts

  ---

  Explanation

  The logs show an SQL injection attack. The first step is to verify if new accounts have been created, indicating a successful injection.

• Question 663:

  Which of the following should be used to ensure a user has the permissions needed to effectively do an assigned job role?

  A. Changing default passwords
  B. Implementing least privilege
  C. Enforcing baseline configurations
  D. Applying network segmentation
  B. Implementing least privilege

  ---

  Explanation

  The principle of least privilege ensures users are granted only the permissions necessary to perform their specific job functions, minimizing the risk of unauthorized access or actions.

• Question 664:

  A company that has a large IT operation is looking to better control, standardize, and lower the time required to build new servers.

  Which of the following architectures will best achieve the company's objectives?

  A. IoT
  B. IaC
  C. IaaS
  D. ICS
  B. IaC

  ---

  Explanation

  Infrastructure as Code (IaC) is the best solution for controlling, standardizing, and speeding up the process of building new servers. IaC allows the company to define the infrastructure using code, enabling automated provisioning, configuration, and management of servers and other IT resources. This approach ensures consistency, reduces human error, and accelerates the deployment process. With IaC, the company can quickly spin up new servers in a standardized and efficient manner.

• Question 665:

  A company processes personal data from customers in multiple countries.

  Which of the following actions is most critical for maintaining legal compliance with global privacy regulations?

  A. Storing all customer data on encrypted local servers
  B. Hiring a data privacy officer to review contracts
  C. Ensuring DPAs are in place with third-party vendors
  D. Using strong passwords and firewalls on all endpoints
  C. Ensuring DPAs are in place with third-party vendors

  ---

  Explanation

  The best answer is C. Ensuring DPAs are in place with third-party vendors. When a company handles personal data across multiple countries, one of the most important legal and regulatory requirements is ensuring that any third parties processing that data are contractually bound to protect it appropriately. A DPA (Data Processing Agreement) defines how a vendor may collect, process, store, share, and protect personal data. This is a key requirement in many privacy frameworks and regulations. This matters because organizations are often still responsible for customer data even when a third-party provider handles it. A DPA helps establish: the roles and responsibilities of each party the legal basis and limits for data processing security and privacy obligations breach notification expectations cross-border data handling requirements.

  Why the other options are incorrect:

  A. Storing all customer data on encrypted local serversEncryption is important, but this alone does not ensure compliance with international privacy laws. Legal compliance involves governance, lawful processing, third-party handling, and contractual obligations.

  B. Hiring a data privacy officer to review contractsA privacy officer may be helpful or required in some situations, but simply hiring one is not as directly critical as having the actual data processing agreements in place.

  D. Using strong passwords and firewalls on all endpointsThese are valuable security controls, but they are not sufficient for legal compliance with global privacy regulations. From a Security+ perspective, privacy compliance often involves third-party risk management, contractual controls, and lawful data handling, making DPAs the most critical answer here.

• Question 666:

  A company is aware of a given security risk related to a specific market segment. The business chooses not to accept responsibility and target their services to a different market segment.

  Which of the following describes this risk management strategy?

  A. Exemption
  B. Exception
  C. Avoid
  D. Transfer
  C. Avoid

  ---

  Explanation

  Avoidance involves choosing not to engage in activities or markets where certain risks are present. This is a proactive approach to risk management.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 5: Security Program Management, Section: "Risk Management Strategies".

• Question 667:

  A company captures log-in details and reviews them each week to identify conditions such as excessive log-in attempts and frequent lockouts.

  Which of the following should a security analyst recommend to improve security compliance monitoring?

  A. Including the date and person who reviewed the information in a report
  B. Adding automated alerting when anomalies occur
  C. Requiring a statement each week that no exceptions were noted
  D. Masking the username in a report to protect privacy
  B. Adding automated alerting when anomalies occur

• Question 668:

  A company is working with a vendor to perform a penetration test.

  Which of the following includes an estimate about the number of hours required to complete the engagement?

  A. SOW
  B. BPA
  C. SLA
  D. NDA
  A. SOW

  ---

  Explanation

  A statement of work (SOW) is a document that defines the scope, objectives, deliverables, timeline, and costs of a project or service. It typically includes an estimate of the number of hours required to complete the engagement, as well as the roles and responsibilities of the parties involved. A SOW is often used for penetration testing projects to ensure that both the client and the vendor have a clear and mutual understanding of what is expected and how the work will be performed. A business partnership agreement (BPA), a service level agreement (SLA), and a non-disclosure agreement (NDA) are different types of contracts that may be related to a penetration testing project, but they do not include an estimate of the number of hours required to complete the engagement.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 492

  What to Look For in a Penetration Testing Statement of Work?

• Question 669:

  A company processes and stores sensitive data on its own systems.

  Which of the following steps should the company take first to ensure compliance with privacy regulations?

  A. Implement access controls and encryption.
  B. Develop and provide training on data protection policies.
  C. Create incident response and disaster recovery plans.
  D. Purchase and install security software.
  B. Develop and provide training on data protection policies.

  ---

  Explanation

  Establishing clear data protection policies and training employees is foundational for compliance. It ensures that everyone in the organization understands the requirements, their responsibilities, and how to handle sensitive data correctly.

  This foundation enables effective implementation of technical controls, incident response plans, and security measures in alignment with privacy regulations.

• Question 670:

  Which of the following vulnerabilities is associated with installing software outside of a manufacturer's approved software repository?

  A. Jailbreaking
  B. Memory injection
  C. Resource reuse
  D. Side loading
  D. Side loading

  ---

  Explanation

  Side loading is the process of installing software outside of a manufacturer's approved software repository. This can expose the device to potential vulnerabilities, such as malware, spyware, or unauthorized access. Side loading can also bypass security controls and policies that are enforced by the manufacturer or the organization. Side loading is often done by users who want to access applications or features that are not available or allowed on their devices.

  References:

  Sideloading - CompTIA Security + Video Training | Interface Technical Training, Security+ (Plus) Certification | CompTIA IT Certifications, Load Balancers -CompTIA Security+ SY0-501 -2.1, CompTIA Security+ SY0-601

  Certification Study Guide.