CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 721:

  Which of the following is an algorithm performed to verify that data has not been modified?

  A. Hash
  B. Code check
  C. Encryption
  D. Checksum
  A. Hash

  ---

  Explanation

  A hash is an algorithm used to verify data integrity by generating a fixed-size string of characters from input data. If even a single bit of the input data changes, the hash value will change, allowing users to detect any modification to the data.

  Hashing algorithms like SHA-256 and MD5 are commonly used to ensure data has not been altered.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 6: Cryptography and PKI, which discusses the role of hashing in verifying data integrity.

• Question 722:

  A service provider wants a cost-effective way to rapidly expand from providing internet links to managing them.

  Which of the following methods will allow the service provider to best scale its services while maintaining performance consistency?

  A. Escalation support
  B. Increased workforce
  C. Baseline enforcement
  D. Technical debt
  C. Baseline enforcement

• Question 723:

  A data administrator is configuring authentication for a SaaS application and would like to reduce the number of credentials employees need to maintain. The company prefers to use domain credentials to access new SaaS applications.

  Which of the following methods would allow this functionality?

  A. SSO
  B. LEAP
  C. MFA
  D. PEAP
  A. SSO

  ---

  Explanation

  SSO stands for single sign-on, which is a method of authentication that allows users to access multiple applications or services with one set of credentials. SSO reduces the number of credentials employees need to maintain and simplifies the login process. SSO can also improve security by reducing the risk of password reuse, phishing, and credential theft. SSO can be implemented using various protocols, such as SAML, OAuth, OpenID Connect, and Kerberos, that enable the exchange of authentication information between different domains or systems. SSO is commonly used for accessing SaaS applications, such as Office 365, Google Workspace, Salesforce, and others, using domain credentials.

  B. LEAP stands for Lightweight Extensible Authentication Protocol, which is a Cisco proprietary protocol that provides authentication for wireless networks. LEAP is not related to SaaS applications or domain credentials.

  C. MFA stands for multi-factor authentication, which is a method of authentication that requires users to provide two or more pieces of evidence to prove their identity. MFA can enhance security by adding an extra layer of protection beyond passwords, such as tokens, biometrics, or codes. MFA is not related to SaaS applications or domain credentials, but it can be used in conjunction with SSO.

  D. PEAP stands for Protected Extensible Authentication Protocol, which is a protocol that provides secure authentication for wireless networks. PEAP uses TLS to create an encrypted tunnel between the client and the server, and then uses another authentication method, such as MS-CHAPv2 or EAP-GTC, to verify the user's identity. PEAP is not related to SaaS applications or domain credentials.

  References:

  1: Security+ (SY0-701) Certification Study Guide | CompTIA IT Certifications

  2: What is Single Sign-On (SSO)? - Definition from WhatIs.com

  3: Single sign-on - Wikipedia

  4: Lightweight Extensible Authentication Protocol - Wikipedia : What is Multi-Factor Authentication (MFA)? - Definition from WhatIs.com : Protected Extensible Authentication Protocol - Wikipedia

• Question 724:

  A company wants to track modifications to the code used to build new virtual servers.

  Which of the following will the company most likely deploy?

  A. Change management ticketing system
  B. Behavioral analyzer
  C. Collaboration platform
  D. Version control tool
  D. Version control tool

  ---

  Explanation

  A version control tool, such as Git, tracks changes made to code, maintains history, and allows developers to manage and revert to earlier versions when needed. This ensures accountability and control over modifications.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 3: Security Architecture, Section: "Version Control and Documentation".

• Question 725:

  Which of the following tools is effective in preventing a user from accessing unauthorized removable media?

  A. USB data blocker
  B. Faraday cage
  C. Proximity reader
  D. Cable lock
  A. USB data blocker

  ---

  Explanation

  A USB data blocker, also known as a "USB condom" (really, no kidding!), is a device that allows you to plug into USB charging ports including charging kiosks, and USB ports on gadgets owned by other people.

  The main purpose of using one is to eliminate the risk of infecting your phone or tablet with malware, and even prevent hackers to install/execute any malicious code to access your data.

• Question 726:

  HOTSPOT

  You are a security administrator investigating a potential infection on a network.

  INSTRUCTIONS

  Click on each host and firewall. Review all logs to determine which host originated the infection and then identify if each remaining host is clean or infected.

  If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

  

  

  

  

  

  

  Explanation

• Question 727:

  Since a recent upgrade to a WLAN infrastructure, several mobile users have been unable to access the internet from the lobby. The networking team performs a heat map survey of the building and finds several WAPs in the area. The WAPs are using similar frequencies with high power settings.

  Which of the following installation considerations should the security team evaluate next?

  A. Channel overlap
  B. Encryption type
  C. New WLAN deployment
  D. WAP placement
  A. Channel overlap

  ---

  Explanation

  When multiple Wireless Access Points (WAPs) are using similar frequencies with high power settings, it can cause channel overlap, leading to interference and connectivity issues. This is likely the reason why mobile users are unable to access the internet in the lobby. Evaluating and adjusting the channel settings on the WAPs to avoid overlap is crucial to resolving the connectivity problems.

  References:

  CompTIA Security+ SY0-701 study materials, particularly the domain on Wireless and Mobile Security, which covers WLAN deployment considerations.

• Question 728:

  Which of the following can assist in recovering data if the decryption key is lost?

  A. CSR
  B. Salting
  C. Root of trust
  D. Escrow
  D. Escrow

  ---

  Explanation

  Key escrow is the process of storing encryption keys (or copies of them) with a trusted third party so data can be recovered if the primary decryption key is lost. In Security+ SY0-701, escrow is emphasized as a required safeguard for organizations that rely heavily on encryption, especially for regulated data or systems requiring guaranteed recoverability.

  A CSR (A) is a Certificate Signing Request and does not store keys. Salting (B) is used with hashing to prevent password attacks and does not assist in data recovery. A root of trust (C) ensures secure hardware initialization but does not store backup decryption keys.

  Key escrow directly addresses scenarios where encryption keys are misplaced, corrupted, deleted, or lost due to employee departure or system failure. Without escrow, encrypted data could become permanently inaccessible.

  Thus, the correct answer is Escrow, the only mechanism specifically designed to allow recovery when decryption keys are unavailable.

• Question 729:

  A security engineer receives reports of unauthorized devices on the organization ' s network.

  Which of the following best describes a secure and effective way to mitigate the risks?

  A. Deploy a NAC solution to block wireless connections until devices can be verified against the baseline configuration.
  B. Set the NAC solution to only accept handshakes initiated from a static set of IP addresses.
  C. Configure a NAC solution to enforce 802.1X authentication with device certificates and implement endpoint security checks.
  D. Implement a NAC solution that redirects all devices to the guest Wi-Fi for holding until a security analyst can validate the security compliance.
  C. Configure a NAC solution to enforce 802.1X authentication with device certificates and implement endpoint security checks.

  ---

  Explanation

  The best answer is C. Configure a NAC solution to enforce 802.1X authentication with device certificates and implement endpoint security checks. NAC (Network Access Control) is used to verify devices before granting them access to the network. A strong NAC deployment should validate both identity and security posture. Enforcing 802.1X authentication ensures that devices must authenticate before connecting, and using device certificates strengthens trust in the device itself. Endpoint security checks add posture assessment, such as confirming antivirus, patch level, or compliance state. This is the most secure and effective approach because it prevents unauthorized or noncompliant devices from joining the network in the first place. Why the other options are incorrect:

  A. Deploy a NAC solution to block wireless connections until devices can be verified against the baseline configuration.This only addresses wireless access and is too limited. Unauthorized devices could still attempt access in other ways.

  B.

  Set the NAC solution to only accept handshakes initiated from a static set of IP addresses.IP addresses are not a reliable basis for device trust and can be spoofed or reassigned. D. Implement a NAC solution that redirects all devices to the guest Wi-Fi for holding until a security analyst can validate the security compliance.Redirecting all devices is not practical or efficient, and guest Wi-Fi is not the best control for secure admission.

  From a Security+ perspective, the strongest NAC implementation uses 802.1X, certificates, and posture assessment, making C correct.

• Question 730:

  Which of the following is required for an organization to properly manage its restore process in the event of system failure?

  A. IRP
  B. DRP
  C. RPO
  D. SDLC
  B. DRP

  ---

  Explanation

  A disaster recovery plan (DRP) is a set of policies and procedures that aim to restore the normal operations of an organization in the event of a system failure, natural disaster, or other emergency. A DRP typically includes the following elements: A risk assessment that identifies the potential threats and impacts to the organization's critical assets and processes.

  A business impact analysis that prioritizes the recovery of the most essential functions and data.

  A recovery strategy that defines the roles and responsibilities of the recovery team, the resources and tools needed, and the steps to follow to restore the system. A testing and maintenance plan that ensures the DRP is updated and validated regularly. A DRP is required for an organization to properly manage its restore process in the event of system failure, as it provides a clear and structured framework for recovering from a disaster and minimizing the downtime and data loss.

  References:

  CompTIA Security+ Study Guide (SY0-701), Chapter 7: Resilience and Recovery, page 325.