CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 61:

  Which of the following consequences would a retail chain most likely face from customers in the event the retailer is non-compliant with PCI DSS?

  A. Contractual impacts
  B. Sanctions
  C. Fines
  D. Reputational damage
  D. Reputational damage

  ---

  Explanation

  While fines, sanctions, and contractual impacts are possible outcomes from regulatory bodies or payment processors, reputational damage is the primary consequence directly impacting customers. If customers learn that the retailer failed to protect their payment information, their trust in the brand may erode, potentially leading to a loss of business and harm to the retailer's reputation.

• Question 62:

  Which of the following examples would be best mitigated by input sanitization?

  A. <script>alert ("Warning!") ,-</script>
  B. nmap - 10.11.1.130
  C. Email message: "Click this link to get your free gift card."
  D. Browser message: "Your connection is not private."
  A. <script>alert ("Warning!") ,-</script>

  ---

  Explanation

  This example of a script injection attack would be best mitigated by input sanitization. Input sanitization involves cleaning or filtering user inputs to ensure that they do not contain harmful data, such as malicious scripts. This prevents attackers from executing script-based attacks (e.g., Cross-Site Scripting or XSS). Nmap command is unrelated to input sanitization, as it is a network scanning tool. Email phishing attempts require different mitigations, such as user training. Browser warnings about insecure connections involve encryption protocols, not input validation

• Question 63:

  An organization determines that tenured employees have retained privileges beyond those required to perform their duties.

  Which of the following should the organization do to address the issue?

  A. Implement regular account reviews.
  B. Provide privileged user account training.
  C. Require a jump box for privileged account use.
  D. Apply more restrictive security baselines.
  A. Implement regular account reviews.

  ---

  Explanation

  The correct answer is A. Implement regular account reviews.

  This scenario describes privilege creep, which occurs when users accumulate permissions over time as they change roles, departments, or responsibilities. Regular account reviews help ensure users have only the access required for their current job duties.

  This supports the principle of least privilege, which is a key CompTIA Security+ SY0-701 identity and access management concept.

  Why the other options are incorrect:

  B. Provide privileged user account training Training is useful, but it does not remove unnecessary privileges.

  C. Require a jump box for privileged account use A jump box can control administrative access to sensitive systems, but it does not solve the issue of users retaining excessive privileges.

  D. Apply more restrictive security baselines Security baselines harden systems and configurations, but they do not directly review or remove unnecessary user permissions. Therefore, the best answer is regular account reviews.

• Question 64:

  Which of the following is a benefit of an RTO when conducting a business impact analysis?

  A. It determines the likelihood of an incident and its cost.
  B. It determines the roles and responsibilities for incident responders.
  C. It determines the state that systems should be restored to following an incident.
  D. It determines how long an organization can tolerate downtime after an incident.
  D. It determines how long an organization can tolerate downtime after an incident.

  ---

  Explanation

  Recovery Time Objective (RTO) defines the maximum acceptable downtime before business operations must be restored. It helps organizations set expectations for recovery speed and prioritize system restoration accordingly.

  A (likelihood of an incident and cost) relates to risk assessment, not RTO.

  B (roles and responsibilities) falls under incident response planning, not RTO.

  C (state of restored systems) is covered by Recovery Point Objective (RPO), not RTO.

  References:

  CompTIA Security+ SY0-701 Official Study Guide, Security Program Management and Oversight domain.

• Question 65:

  A security analyst investigates abnormal outbound traffic from a corporate endpoint. The traffic is encrypted and uses non-standard ports.

  Which of the following data sources should the analyst use first to confirm whether this traffic is malicious?

  A. Application logs
  B. Vulnerability scans
  C. Endpoint logs
  D. Packet captures
  C. Endpoint logs

  ---

  Explanation

  When investigating abnormal outbound traffic originating from a specific endpoint, endpoint logs are the most appropriate first data source to review. According to CompTIA Security+ SY0-701, endpoint logs provide detailed visibility into process execution, user actions, service creation, network connections initiated by applications, and security agent detections. This context is critical for determining which process initiated the encrypted traffic and why it is using non-standard ports.

  Because the traffic is encrypted, packet captures (D) would reveal limited payload information and are more resource-intensive. Endpoint logs can quickly identify suspicious executables, command-line arguments, parent-child process relationships, and persistence mechanisms that indicate malware or command-and-control activity. Modern EDR tools rely heavily on endpoint telemetry for exactly this reason.

  Application logs (A) may be useful later but are limited to specific applications. Vulnerability scans (B) identify weaknesses, not active malicious behavior.

  Security+ SY0-701 emphasizes starting investigations as close to the suspected source as possible. Since the activity originates from a corporate endpoint, endpoint logs provide the fastest and most relevant confirmation of whether the traffic is malicious.

• Question 66:

  Users at a company are reporting they are unable to access the URL for a new retail website because it is flagged as gambling and is being blocked.

  Which of the following changes would allow users to access the site?

  A. Creating a firewall rule to allow HTTPS traffic
  B. Configuring the IPS to allow shopping
  C. Tuning the DLP rule that detects credit card data
  D. Updating the categorization in the content filter
  D. Updating the categorization in the content filter

  ---

  Explanation

  A content filter is a device or software that blocks or allows access to web content based on predefined rules or categories. In this case, the new retail website is mistakenly categorized as gambling by the content filter, which prevents users from accessing it. To resolve this issue, the content filter's categorization needs to be updated to reflect the correct category of the website, such as shopping or retail. This will allow the content filter to allow access to the website instead of blocking it.

• Question 67:

  Which of the following is the best way to validate the integrity and availability of a disaster recovery site?

  A. Lead a simulated failover.
  B. Conduct a tabletop exercise.
  C. Periodically test the generators.
  D. Develop requirements for database encryption.
  A. Lead a simulated failover.

  ---

  Explanation

  A simulated failover tests the disaster recovery site's ability to handle a full transition of services. This ensures all systems can function as expected during an actual disaster.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 5: Security Program Management, Section: "Disaster Recovery and Business Continuity Planning".

• Question 68:

  To which of the following security categories does an EDR solution belong?

  A. Physical
  B. Operational
  C. Managerial
  D. Technical
  D. Technical

• Question 69:

  An employee in the accounting department receives an email containing a demand for payment for services performed by a vendor. However, the vendor is not in the vendor management database.

  Which of the following is this scenario an example of?

  A. Pretexting
  B. Impersonation
  C. Ransomware
  D. Invoice scam
  D. Invoice scam

  ---

  Explanation

  The scenario describes an instance where an employee receives a fraudulent invoice from a vendor that is not recognized in the company's vendor management system. This is a classic example of an invoice scam, where attackers attempt to trick organizations into making payments for fake or non-existent services. These scams often rely on social engineering tactics to bypass financial controls.

  References:

  CompTIA Security+ SY0-701 study materials, particularly in the context of social engineering attacks and common scams.

• Question 70:

  A security officer observes that a software development team is not complying with its corporate security policy on encrypting confidential data.

  Which of the following categories refers to this type of non-compliance?

  A. External
  B. Standard
  C. Regulation
  D. Internal
  D. Internal