CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 671:

  An organization with multiple geographic locations has invested in various internet circuits at each location, including MPLS, 4G/5G, broadband, and dial-up. An architect is configuring a solution that will allow locations to function consistently and leverage links based on specific criteria.

  Which of the following is the best solution for the architect to configure?

  A. SD-WAN
  B. UTM
  C. VPN
  D. SASE
  A. SD-WAN

  ---

  Explanation

  The correct answer is A. SD-WAN.

  SD-WAN, or Software-Defined Wide Area Network, allows organizations with multiple locations to manage and optimize WAN connections across different circuit types, such as MPLS, broadband, cellular, and other internet links. It can dynamically route traffic based on business rules, performance, link quality, cost, latency, or application requirements.

  This aligns with CompTIA Security+ SY0-701 security architecture concepts related to network infrastructure, availability, resilience, and secure connectivity between locations.

  Why the other options are incorrect:

  B. UTM Unified Threat Management provides multiple security features, such as firewalling, intrusion prevention, antivirus, and web filtering, but it does not primarily manage multiple WAN circuits based on routing criteria.

  C. VPN A VPN provides encrypted connectivity over an untrusted network, but it does not inherently optimize traffic across MPLS, broadband, 4G/5G, and dial-up links.

  D. SASE Secure Access Service Edge combines networking and cloud-delivered security services, but the best answer for leveraging multiple circuit types across locations based on specific criteria is SD-WAN. Therefore, the best solution is SD-WAN.

• Question 672:

  A security audit of an organization revealed that most of the IT staff members have domain administrator credentials and do not change the passwords regularly.

  Which of the following solutions should the security learn propose to resolve the findings in the most complete way?

  A. Creating group policies to enforce password rotation on domain administrator credentials
  B. Reviewing the domain administrator group, removing all unnecessary administrators, and rotating all passwords
  C. Integrating the domain administrator's group with an IdP and requiring SSO with MFA for all access
  D. Securing domain administrator credentials in a PAM vault and controlling access with role-based access control
  D. Securing domain administrator credentials in a PAM vault and controlling access with role-based access control

  ---

  Explanation

  Using a Privileged Access Management (PAM) vault to secure domain administrator credentials and enforcing role-based access control (RBAC) is the most comprehensive solution. PAM systems help manage and control access to privileged accounts, ensuring that only authorized personnel can access sensitive credentials. This approach also facilitates password rotation, auditing, and ensures that credentials are not misused or left unchanged. Integrating PAM with RBAC ensures that access is granted based on the user's role, further enhancing security.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 05 Security Program Management and Oversight.

  CompTIA Security+ SY0-601 Study Guide: Chapter on Identity and Access Management.

• Question 673:

  Which of the following mitigation techniques would a security analyst most likely use to avoid bloatware on devices?

  A. Disabled ports/protocols
  B. Application allow list
  C. Default password changes
  D. Access control permissions
  B. Application allow list

  ---

  Explanation

  Application allow listing is the most effective technique to prevent bloatware, unauthorized software, or unnecessary applications from running on devices. Allow lists work by permitting only pre-approved, trusted applications to execute, blocking everything else by default. This is a recommended best practice in Security+ SY0-701 for reducing attack surface, preventing malware, and maintaining lean, hardened system images.

  Bloatware often comes pre-installed on devices or is unintentionally installed by users. An allow list ensures only authorized applications required for business functions can run, thereby eliminating bloatware risks.

  Disabling ports/protocols (A) hardens network access but does not prevent software installation. Default password changes (C) improve authentication security but are unrelated to software control. Access control permissions (D) restrict who can access what but do not prevent installation of unnecessary apps.

  Thus, the correct answer is B: Application allow list.

• Question 674:

  A security analyst is investigating an application server and discovers that software on the server is behaving abnormally. The software normally runs batch jobs locally and does not generate traffic, but the process is now generating outbound traffic over random high ports.

  Which of the following vulnerabilities has likely been exploited in this software?

  A. Memory injection
  B. Race condition
  C. Side loading
  D. SQL injection
  A. Memory injection

  ---

  Explanation

  Memory injection vulnerabilities allow unauthorized code or commands to be executed within a software program, leading to abnormal behavior such as generating outbound traffic over random high ports. This issue often arises from software not properly validating or encoding input, which can be exploited by attackers to inject malicious code.

  References:

  CompTIA Security+ SY0-701 course content and official CompTIA study resources.

• Question 675:

  Which of the following is the most common data loss path for an air-gapped network?

  A. Bastion host
  B. Unsecured Bluetooth
  C. Unpatched OS
  D. Removable devices
  D. Removable devices

  ---

  Explanation

  An air-gapped network is a network that is physically isolated from other networks, such as the internet, to prevent unauthorized access and data leakage. However, an air-gapped network can still be compromised by removable devices, such as USB drives, CDs, DVDs, or external hard drives, that are used to transfer data between the air-gapped network and other networks. Removable devices can carry malware, spyware, or other malicious code that can infect the air-gapped network or exfiltrate data from it. Therefore, removable devices are the most common data loss path for an air-gapped network.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, Chapter 9: Network Security, page 449

• Question 676:

  Which of the following activities are associated with vulnerability management? (Choose two.)

  A. Reporting
  B. Prioritization
  C. Exploiting
  D. Correlation
  E. Containment
  F. Tabletop exercise
  A. Reporting
  B. Prioritization

  ---

  Explanation

  Reporting involves documenting and communicating the findings of vulnerability scans and assessments. This allows stakeholders to be informed about existing vulnerabilities and track remediation efforts.

  Prioritization is the process of ranking vulnerabilities based on their severity, impact, and exploitability, helping the organization address the most critical vulnerabilities first.

• Question 677:

  A systems administrator uses a key to encrypt a message being sent to a peer in a different branch office. The peer then uses the same key to decrypt the message.

  Which of the following describes this example?

  A. Symmetric
  B. Asymmetric
  C. Hashing
  D. Salting
  A. Symmetric

• Question 678:

  An office wants to install a Wi-Fi network. The security team must ensure a secure design. The access points will be more powerful and use WPA3 with a 16-character randomized key.

  Which of the following should the security team do next?

  A. Create a heat map of the building perimeter.
  B. Deploy IPSec tunnels from each access point to the controller.
  C. Enable WPA2-PSK with a 24-character randomized key.
  D. Disable SSH administration on all access points.
  A. Create a heat map of the building perimeter.

  ---

  Explanation

  Because the organization plans to deploy high-powered wireless access points, the next critical step is to create a heat map of the building perimeter. CompTIA Security+ SY0-701 highlights wireless heat maps as an essential design tool for identifying signal bleed, coverage overlap, dead zones, and areas where wireless signals extend beyond intended boundaries.

  Stronger access points increase the risk of signal leakage outside the building, which could allow unauthorized users to attempt connections from parking lots or nearby buildings. A heat map enables the security team to visualize RF propagation and adjust power levels, antenna placement, and access point locations to minimize external exposure while maintaining internal coverage.

  Deploying IPSec tunnels (B) is unnecessary for standard WLAN architectures. Enabling WPA2-PSK (C) weakens security compared to WPA3. Disabling SSH administration (D) is a hardening step but does not address wireless coverage risks.

  Therefore, the correct next step in secure Wi-Fi design is A: Create a heat map of the building perimeter.

• Question 679:

  Which of the following activities is the first stage in the incident response process?

  A. Detection
  B. Declaration
  C. Containment
  D. Verification
  A. Detection

  ---

  Explanation

  Detection is the first stage in the incident response process. It involves identifying potential security incidents through alerts, monitoring, and analysis to determine if an incident has occurred. Effective detection is crucial as it initiates the response process, allowing the team to assess the situation and proceed with containment and other response steps.

• Question 680:

  A security analyst must select a metric to determine the required investment in technology based on past availability incidents.

  Which of the following is the most relevant value to help select technology that mitigates risk and considers reliability?

  A. MTBF
  B. RTO
  C. ALE
  D. RPO
  A. MTBF

  ---

  Explanation

  The best answer is A. MTBF. MTBF (Mean Time Between Failures) is a reliability metric that measures the average time a system or component operates before failing. Since the question specifically mentions past availability incidents and asks for a value that helps choose technology while considering reliability, MTBF is the most relevant metric. A higher MTBF generally indicates more reliable technology and helps justify investment decisions when selecting systems intended to reduce outages and improve availability. Why the other options are incorrect:

  B. RTORecovery Time Objective is the target amount of time to restore service after an outage. It is important for disaster recovery planning, but it does not directly measure reliability.

  C. ALEAnnualized Loss Expectancy estimates expected yearly financial loss from a risk. It is useful for risk-based investment decisions, but the question specifically emphasizes availability incidents and reliability, which points more directly to MTBF.

  D. RPORecovery Point Objective measures acceptable data loss in time. It applies to backup and recovery strategy, not system reliability. From a Security+ standpoint, when evaluating technologies for availability and reliability, MTBF is the strongest metric among these options.