CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 711:

  A systems administrator is concerned about vulnerabilities within cloud computing instances.

  Which of the following is most important for the administrator to consider when architecting a cloud computing environment?

  A. SQL injection
  B. TOC/TOU
  C. VM escape
  D. Tokenization
  E. Password spraying
  C. VM escape

  ---

  Explanation

  In cloud computing, virtual machines (VMs) share physical resources. VM escape is a critical vulnerability where an attacker could break out of a virtualized environment and access the host system or other VMs running on the same physical hardware. This would pose a significant security risk, as it could allow attackers to compromise the entire cloud infrastructure.

• Question 712:

  Which of the following can best protect against an employee inadvertently installing malware on a company system?

  A. Host-based firewall
  B. System isolation
  C. Least privilege
  D. Application allow list
  D. Application allow list

  ---

  Explanation

  An application allow list is a security technique that specifies which applications are authorized to run on a system and blocks all other applications. An application allow list can best protect against an employee inadvertently installing malware on a company system because it prevents the execution of any unauthorized or malicious software, such as viruses, worms, trojans, ransomware, or spyware. An application allow list can also reduce the attack surface and improve the performance of the system.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, Chapter 11: Secure Application Development, page 551

• Question 713:

  n administrator is investigating an incident and discovers several users' computers were infected with malware after viewing files that were shared with them. The administrator discovers no degraded performance in the infected machines and an examination of the log files does not show excessive failed logins.

  Which of the following attacks is most likely the cause of the malware?

  A. Malicious flash drive
  B. Remote access Trojan
  C. Brute-forced password
  D. Cryptojacking
  D. Cryptojacking

  ---

  Explanation

  Cryptojacking is the likely cause in this scenario. It involves malware that hijacks the resources of infected computers to mine cryptocurrency, usually without the user's knowledge. This type of attack doesn't typically degrade performance significantly or result in obvious system failures, which matches the situation described, where the machines showed no signs of degraded performance or excessive failed logins.

  References:

  CompTIA Security+ SY0-701 Course Content: Cryptojacking is covered under types of malware attacks, highlighting its stealthy nature and impact on infected systems.

• Question 714:

  Client files can only be accessed by employees who need to know the information and have specified roles in the company.

  Which of the following best describes this security concept?

  A. Availability
  B. Confidentiality
  C. Integrity
  D. Non-repudiation
  B. Confidentiality

  ---

  Explanation

  The scenario described, where client files are only accessible to employees who "need to know" the information, reflects the concept of confidentiality. Confidentiality ensures that sensitive information is only accessible to those who are authorized to view it, preventing unauthorized access.

  Availability ensures that data is accessible when needed but doesn't focus on restricting access.

  Integrity ensures that data remains accurate and unaltered but doesn't pertain to access control.

  Non-repudiation ensures that actions cannot be denied after they are performed, but this concept is unrelated to access control.

• Question 715:

  An organization recently experienced the following social engineering attacks that introduced malware into the network:

  1. In the first attack, the sender impersonated a staff member in the legal department and sent an email stating that the employee needed to click a link to sign an NDA in order to remain employed. The link provided was to a malicious website.

  2. In the second attack, the sender impersonated the director of finance and instructed the accounts payable department to pay an outstanding invoice. The attached invoice contained malware.

  Which of the following is the most likely reason these attacks were successful?

  A. Both attacks passed the spam filters, which resulted in the end users thinking the emails were legitimate.
  B. Both attacks concealed the delivery of malware, which led end users to trust the emails.
  C. Both attacks appealed to authority, which made the end users feel obligated to perform the requested actions.
  D. Both attacks relied on dumpster diving to obtain a list of valid contacts to receive the malicious emails.
  C. Both attacks appealed to authority, which made the end users feel obligated to perform the requested actions.

• Question 716:

  A security administrator is deploying a DLP solution to prevent the exfiltration of sensitive customer data.

  Which of the following should the administrator do first?

  A. Block access to cloud storage websites.
  B. Create a rule to block outgoing email attachments.
  C. Apply classifications to the data.
  D. Remove all user permissions from shares on the file server.
  C. Apply classifications to the data.

  ---

  Explanation

  Data classification is the process of assigning labels or tags to data based on its sensitivity, value, and risk. Data classification is the first step in a data loss prevention (DLP) solution, as it helps to identify what data needs to be protected and how. By applying classifications to the data, the security administrator can define appropriate policies and rules for the DLP solution to prevent the exfiltration of sensitive customer data.

  References:

  8: Data Protection, page 323. CompTIA Security+ Practice Tests: Exam SY0-701, 3rd Edition, Chapter

  8: Data Protection, page 327.

• Question 717:

  A systems administrator is working on a solution with the following requirements:

  1. Provide a secure zone.

  2. Enforce a company-wide access control policy.

  3. Reduce the scope of threats.

  Which of the following is the systems administrator setting up?

  A. Zero Trust
  B. AAA
  C. Non-repudiation
  D. CIA
  A. Zero Trust

  ---

  Explanation

  Zero Trust is a security model that assumes no trust for any entity inside or outside the network perimeter and requires continuous verification of identity and permissions. Zero Trust can provide a secure zone by isolating and protecting sensitive data and resources from unauthorized access. Zero Trust can also enforce a company-wide access control policy by applying the principle of least privilege and granular segmentation for users, devices, and applications. Zero Trust can reduce the scope of threats by preventing lateral movement and minimizing the attack surface.

• Question 718:

  A systems administrator is working on a solution with the following requirements: Provide a secure zone. Enforce a company-wide access control policy. Reduce the scope of threats.

  Which of the following is the systems administrator setting up?

  A. Zero Trust
  B. AAA
  C. Non-repudiation
  D. CIA
  A. Zero Trust

  ---

  Explanation

  The correct answer is Zero Trust because it directly aligns with all three stated requirements: creating secure zones, enforcing consistent access control policies across the organization, and reducing the overall threat surface. In the Security+ SY0-701 framework, Zero Trust is a modern security architecture model based on the principle of never trust, always verify. It assumes that threats may already exist inside or outside the network and therefore requires continuous validation of users, devices, and sessions. Zero Trust architectures segment environments into secure zones, often using microsegmentation, to prevent lateral movement by attackers. This directly reduces the scope of threats by limiting what an attacker can access even if one component is compromised. Enforcing company-wide access control policies is another core Zero Trust principle, as access decisions are centrally governed and based on identity, device posture, context, and least privilege rather than network location.

  Option B, AAA (Authentication, Authorization, and Accounting), is an access control framework, but it does not inherently define secure zones or reduce threat scope through segmentation. Option C, Non-repudiation, ensures actions cannot be denied later and is primarily related to auditing and accountability, not access control architecture.

  Option D, CIA, refers to confidentiality, integrity, and availability-fundamental security goals rather than an implementation model.

  The SY0-701 study guide emphasizes Zero Trust as a strategic approach to minimizing attack surfaces, enforcing least privilege, and protecting enterprise resources regardless of user location or network boundaries. By continuously validating access and restricting trust, Zero Trust architectures significantly reduce risk and improve resilience against both internal and external threats.

  In summary, the combination of secure zones, centralized access control enforcement, and reduced threat exposure clearly indicates the implementation of a Zero Trust architecture.

• Question 719:

  After failing an audit twice, an organization has been ordered by a government regulatory agency to pay fines.

  Which of the following causes this action?

  A. Non-compliance
  B. Contract violations
  C. Government sanctions
  D. Rules of engagement
  A. Non-compliance

  ---

  Explanation

  Failure to meet regulatory standards or requirements (non-compliance) can result in fines and penalties imposed by a government regulatory agency. When an organization does not comply with mandated regulations or fails audits, it may face financial repercussions to enforce adherence to required standards.

• Question 720:

  A company wants to ensure employees are allowed to copy files from a virtual desktop during the workday but are restricted during non-working hours.

  Which of the following security measures should the company set up?

  A. Digital rights management
  B. Role-based access control
  C. Time-based access control
  D. Network access control
  C. Time-based access control