CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 691:

  Company A jointly develops a product with Company B, which is located in a different country. Company A finds out that their intellectual property is being shared with unauthorized companies.

  Which of the following has been breached?

  A. SLA
  B. AUP
  C. SOW
  D. MOA
  D. MOA

  ---

  Explanation

  A Memorandum of Agreement (MOA) outlines terms of cooperation, including restrictions on sharing intellectual property. A breach indicates the terms of the agreement were violated, compromising confidentiality or usage terms.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 5: Security Program Management, Section: "Third-Party Risk Management".

• Question 692:

  An organization discovered files with proprietary financial data have been deleted. The files have been recovered from backup but every time the Chief Financial Officer logs in to the file server, the same files are deleted again No other users are experiencing this issue.

  Which of the following types of malware is MOST likely causing this behavior?

  A. Logic bomb
  B. Crypto malware
  C. Spyware
  D. Remote access Trojan
  A. Logic bomb

  ---

  Explanation

  Logic bomb: a set of instructions secretly incorporated into a program so that if a particular condition is satisfied they will be carried out, usually with harmful effects.

• Question 693:

  A legacy device is being decommissioned and is no longer receiving updates or patches.

  Which of the following describes this scenario?

  A. End of business
  B. End of testing
  C. End of support
  D. End of life
  D. End of life

• Question 694:

  A systems administrator would like to deploy a change to a production system.

  Which of the following must the administrator submit to demonstrate that the system can be restored to a working state in the event of a performance issue?

  A. Backout plan
  B. Impact analysis
  C. Test procedure
  D. Approval procedure
  A. Backout plan

• Question 695:

  A security analyst receives an alert that an employee has clicked on a phishing email and exposed their credentials.

  Which of the following should the analyst do?

  A. Notify all employees about the phishing attack and instruct them to avoid suspicious emails.
  B. Wait for confirmation from the employee before making any changes to the account.
  C. Reimage the employee ' s workstation to ensure no malware is present.
  D. Lock the employee ' s account to prevent further unauthorized access.
  D. Lock the employee ' s account to prevent further unauthorized access.

  ---

  Explanation

  The best answer is D. Lock the employee ' s account to prevent further unauthorized access. If credentials have been exposed in a phishing incident, the most urgent priority is to contain the threat by preventing attackers from using those credentials. Locking or disabling the affected account is an immediate response step that reduces the risk of unauthorized access, lateral movement, privilege abuse, or data theft. Why the other options are incorrect:

  A. Notify all employees about the phishing attack and instruct them to avoid suspicious emails. Awareness messaging may be useful later, but it does not immediately contain the compromised account.

  B. Wait for confirmation from the employee before making any changes to the account.Waiting introduces unnecessary risk if the credentials are already exposed.

  C. Reimage the employee ' s workstation to ensure no malware is present.Reimaging may be appropriate if malware was delivered, but the question specifically says the employee exposed credentials. The first priority is account containment. From a Security+ incident response perspective, the immediate action after credential compromise is to disable or lock the account, making D the best answer.

• Question 696:

  Which of the following security controls is most likely being used when a critical legacy server is segmented into a private network?

  A. Deterrent
  B. Corrective
  C. Compensating
  D. Preventive
  C. Compensating

  ---

  Explanation

  When a critical legacy server is segmented into a private network, the security control being used is compensating. Compensating controls are alternative measures put in place to satisfy a security requirement when the primary control is not feasible or practical. In this case, segmenting the legacy server into a private network serves as a compensating control to protect it from potential vulnerabilities that cannot be mitigated directly.

  Compensating: Provides an alternative method to achieve the desired security outcome when the primary control is not possible.

  Deterrent: Aims to discourage potential attackers but does not directly address segmentation.

  Corrective: Used to correct or mitigate the impact of an incident after it has occurred.

  Preventive: Aims to prevent security incidents but is not specific to the context of segmentation.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 1.1 - Compare and contrast various types of security controls (Compensating controls).

• Question 697:

  Which of the following is an example of implementing Zero Trust architecture?

  A. Building strong network boundaries to prevent intrusion
  B. Verifying user identity once at the start of the session
  C. Granting resource access after continuous validation
  D. Prioritizing perimeter defense to block external threats
  C. Granting resource access after continuous validation

  ---

  Explanation

  The best answer is C. Granting resource access after continuous validation. Zero Trust architecture is based on the principle of never trust, always verify. Access should not be granted simply because a user or device is inside the network or was authenticated once earlier. Instead, access decisions should be based on continuous validation of identity, device health, context, and other relevant factors. This means users and devices are evaluated repeatedly and granted only the minimum access necessary. Why the other options are incorrect:

  A. Building strong network boundaries to prevent intrusionThis reflects a traditional perimeter-based security model, not Zero Trust.

  B. Verifying user identity once at the start of the sessionZero Trust does not rely on one-time authentication alone. It emphasizes ongoing verification.

  D. Prioritizing perimeter defense to block external threatsAgain, this focuses on perimeter security rather than continuous, identity-and context-based access control. From a Security+ perspective, Zero Trust is best represented by continuous validation before and during access, which makes C correct.

• Question 698:

  Which of the following would be most useful in determining whether the long-term cost to transfer a risk is less than the impact of the risk?

  A. ARO
  B. RTO
  C. RPO
  D. ALE
  E. SLE
  D. ALE

• Question 699:

  Which of the following control types is AUP an example of?

  A. Physical
  B. Managerial
  C. Technical
  D. Operational
  B. Managerial

  ---

  Explanation

  An Acceptable Use Policy (AUP) is an example of a managerial control. Managerial controls are policies and procedures that govern an organization's operations, ensuring security through directives and rules. The AUP defines acceptable behavior and usage of company resources, setting guidelines for employees. Physical controls refer to security measures like locks, fences, or security guards. Technical controls involve security mechanisms such as firewalls or encryption.

  Operational controls are procedures for maintaining security, such as backup and recovery plans.

• Question 700:

  A security professional discovers a folder containing an employee's personal information on the enterprise's shared drive.

  Which of the following best describes the data type the security professional should use to identify organizational policies and standards concerning the storage of employees' personal information?

  A. Legal
  B. Financial
  C. Privacy
  D. Intellectual property
  C. Privacy

  ---

  Explanation

  Privacy data includes information such as Personally Identifiable Information (PII), which relates to employees' or customers' personal data. Organizations often maintain policies and standards specifically addressing how such sensitive information should be handled.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 5: Security Program Management, Section: "Data Types and Classifications".