CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 701:

  A security analyst sees an increase of vulnerabilities on workstations after a deployment of a company group policy.

  Which of the following vulnerability types will the analyst most likely find on the workstations?

  A. Misconfiguration
  B. Zero-day
  C. Malicious update
  D. Supply chain
  A. Misconfiguration

• Question 702:

  Which of the following describes when a user installs an unauthorized application by bypassing the authorized application store and installing a binary file?

  A. Jailbreaking
  B. Sideloading
  C. Memory injection
  D. VM escaping
  B. Sideloading

  ---

  Explanation

  The best answer is B. Sideloading. Sideloading is the installation of an application from outside the official or authorized application store, often by directly installing a binary package or application file. This bypasses standard review and distribution controls. Why the other options are incorrect:

  A. JailbreakingJailbreaking removes or bypasses manufacturer or operating system restrictions, often on mobile devices. It may enable sideloading, but it is not the same thing as the act described.

  C. Memory injectionMemory injection is a technique used to place code into another process's memory. It is unrelated to installing an app from an unauthorized source.

  D. VM escapingVM escape is an attack in which code breaks out of a virtual machine into the host environment. It does not describe unauthorized app installation. From a Security+ standpoint, bypassing the approved app store and directly installing a binary is the definition of sideloading.

• Question 703:

  An engineer recently deployed a group of 100 web servers in a cloud environment. Per the security policy, all web-server ports except 443 should be disabled.

  Which of the following can be used to accomplish this task?

  A. Application allow list
  B. SWG
  C. Host-based firewall
  D. VPN
  C. Host-based firewall

  ---

  Explanation

  Host-based firewall - This is a firewall on a host where you can configured rules for ports/connections allowed on that specific host.

  As the question specifically is asking for web-server ports to be blocked, it would make more sense to configure rules to block the ports on each web server.

  ======================== Other Choices:

  Application allow list - A list of applications and application components that are permitted to reside or perform actions on a device SWG(Secure Web Gateway) - A security product that operates between employees and the internet by filtering unsafe content from web traffic to stop cyber threats and data breaches. They also block risky or unauthorized user behavior.

  SWGs usually analyses the content of traffic.

  VPN (Virtual Private Network) - A service that establishes a secure encrypted connection between networks over the internet. Hosts connected on the network will behave logically as if they're on the same network even if they are a physically not.

• Question 704:

  A company identified the potential for malicious insiders to harm the organization.

  Which of the following measures should the organization implement to reduce this risk?

  A. Unified threat management
  B. Web application firewall
  C. User behavior analytics
  D. Intrusion detection system
  C. User behavior analytics

• Question 705:

  Which of the following should an organization focus on the most when making decisions about vulnerability prioritization?

  A. Exposure factor
  B. CVSS
  C. CVE
  D. Industry impact
  B. CVSS

  ---

  Explanation

  The Common Vulnerability Scoring System (CVSS) is a standardized metric used to assess the severity of vulnerabilities, aiding organizations in prioritizing their response based on risk.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 2: Vulnerabilities, Section: "Vulnerability Prioritization and Metrics".

• Question 706:

  An organization wants a third-party vendor to do a penetration test that targets a specific device. The organization has provided basic information about the device.

  Which of the following best describes this kind of penetration test?

  A. Partially known environment
  B. Unknown environment
  C. Integrated
  D. Known environment
  A. Partially known environment

  ---

  Explanation

  A partially known environment is a type of penetration test where the tester has some information about the target, such as the IP address, the operating system, or the device type. This can help the tester focus on specific vulnerabilities and reduce the scope of the test. A partially known environment is also called a gray box test.

  References:

  CompTIA Security+ Certification Kit: Exam SY0-701, 7th Edition, Chapter 10, page 543.

• Question 707:

  A network engineer deployed a redundant switch stack to increase system availability. However, the budget can only cover the cost of one ISP connection.

  Which of the following best describes the potential risk factor?

  A. The equipment MTBF is unknown.
  B. The ISP has no SLA.
  C. An RPO has not been determined.
  D. There is a single point of failure.
  D. There is a single point of failure.

• Question 708:

  Which of the following actions would reduce the number of false positives for an analyst to manually review?

  A. Create playbooks as part of a SOAR platform
  B. Redefine the patch management process
  C. Replace an EDR tool with an XDR solution
  D. Disable AV heuristics scanning
  A. Create playbooks as part of a SOAR platform

• Question 709:

  An employee asks a security analyst to scan a suspicious email that contains a link to a file on a file-sharing site. The analyst determines that the file is safe after downloading and scanning the file with antivirus software. When the employee opens the file, their device is infected with ransomware.

  Which of the following steps should the analyst have taken?

  A. Review the file in a code editor.
  B. Monitor the file connections with netstat.
  C. Execute the file in a sandbox.
  D. Retrieve the file hash and check with OSINT.
  C. Execute the file in a sandbox.

  ---

  Explanation

  The best answer is C. Execute the file in a sandbox. A sandbox is an isolated environment used to safely run suspicious files and observe their behavior without risking production systems. In this case, the analyst only used antivirus scanning, which may miss new, obfuscated, or previously unknown ransomware. By executing the file in a sandbox, the analyst could have observed malicious behaviors such as: file encryption attempts process spawning registry changes network beaconing suspicious system modifications.

  This makes sandboxing a much better method for analyzing potentially malicious files than relying only on signature-based antivirus. Why the other options are incorrect:

  A. Review the file in a code editor.This might help in limited cases, but many malicious files are compiled, packed, or obfuscated. It is not a reliable primary analysis method.

  B. Monitor the file connections with netstat.Netstat only shows network connections and would not fully reveal ransomware behavior, especially if the malware acts locally before making network connections.

  D. Retrieve the file hash and check with OSINT.Hash reputation checks can help identify known malware, but they do not detect new or modified ransomware samples that do not yet appear in threat intelligence sources. From the SY0-701 perspective, suspicious files should be analyzed using dynamic analysis in a sandbox to identify behavior that static tools may miss. That is why C is the best answer.

• Question 710:

  Which of the following should a systems administrator use to ensure an easy deployment of resources within the cloud provider?

  A. Software as a service
  B. Infrastructure as code
  C. Internet of Things
  D. Software-defined networking
  B. Infrastructure as code

  ---

  Explanation

  Infrastructure as code (IaC) is a method of using code and automation to manage and provision cloud resources, such as servers, networks, storage, and applications. IaC allows for easy deployment, scalability, consistency, and repeatability of cloud environments. IaC is also a key component of DevSecOps, which integrates security into the development and operations processes.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, Chapter 6: Cloud and Virtualization Concepts, page 294.