CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 731:

  Which of the following agreements defines response time, escalation, and performance metrics?

  A. BPA
  B. MOA
  C. NDA
  D. SLA
  D. SLA

• Question 732:

  A user, who is waiting for a flight at an airport, logs in to the airline website using the public Wi-Fi, ignores a security warning and purchases an upgraded seat. When the flight lands, the user finds unauthorized credit card charges.

  Which of the following attacks most likely occurred?

  A. Replay attack
  B. Memory leak
  C. Buffer overflow attack
  D. On-path attack
  D. On-path attack

• Question 733:

  Which of the following explains why an attacker cannot easily decrypt passwords using a rainbow table attack?

  A. Digital signatures
  B. Salting
  C. Hashing
  D. Perfect forward secrecy
  B. Salting

  ---

  Explanation

  Salting is a technique used to enhance the security of hashed passwords by adding a unique, random value (salt) to each password before hashing it. This prevents attackers from easily decrypting passwords using rainbow tables, which are precomputed tables for reversing cryptographic hash functions. Since each password has a unique salt, the same password will produce different hash values, making rainbow table attacks ineffective.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 04 Security Operations. CompTIA Security+ SY0-601 Study Guide: Chapter on Cryptography and Hashing Techniques.

• Question 734:

  A security operations center determines that the malicious activity detected on a server is normal.

  Which of the following activities describes the act of ignoring detected activity in the future?

  A. Tuning
  B. Aggregating
  C. Quarantining
  D. Archiving
  A. Tuning

  ---

  Explanation

  Tuning is the activity of adjusting the configuration or parameters of a security tool or system to optimize its performance and reduce false positives or false negatives. Tuning can help to filter out the normal or benign activity that is detected by the security tool or system, and focus on the malicious or anomalous activity that requires further investigation or response. Tuning can also help to improve the efficiency and effectiveness of the security operations center by reducing the workload and alert fatigue of the analysts. Tuning is different from aggregating, which is the activity of collecting and combining data from multiple sources or sensors to provide a comprehensive view of the security posture. Tuning is also different from quarantining, which is the activity of isolating a potentially infected or compromised device or system from the rest of the network to prevent further damage or spread. Tuning is also different from archiving, which is the activity of storing and preserving historical data or records for future reference or compliance. The act of ignoring detected activity in the future that is deemed normal by the security operations center is an example of tuning, as it involves modifying the settings or rules of the security tool or system to exclude the activity from the detection scope. Therefore, this is the best answer among the given options.

  References:

  Security Alerting and Monitoring Concepts and Tools -CompTIA Security+ SY0-701: 4.3, video at 7:00

  CompTIA Security+ SY0-701 Certification Study Guide, page 191.

• Question 735:

  A user downloaded software from an online forum. After the user installed the software, the security team observed external network traffic connecting to the user's computer on an uncommon port.

  Which of the following is the most likely explanation of this unauthorized connection?

  A. The software had a hidden keylogger.
  B. The software was ransomware.
  C. The user's computer had a fileless virus.
  D. The software contained a backdoor.
  D. The software contained a backdoor.

  ---

  Explanation

  The scenario describes software downloaded from an untrusted source that, after installation, initiates external communication over an uncommon port. This behavior is characteristic of a backdoor, which allows unauthorized remote access and control, often using nonstandard ports to evade detection. A keylogger primarily captures user input, ransomware typically encrypts files and demands payment, and a fileless virus operates in memory without leaving traditional artifacts, none of which best match the described network behavior.

• Question 736:

  An IT team rolls out a new management application that uses a randomly generated MFA token sent to the administrator's phone. Despite this new MFA precaution, there is a security breach of the same software.

  Which of the following describes this kind of attack?

  A. Smishing
  B. Typosquatting
  C. Espionage
  D. Pretexting
  D. Pretexting

  ---

  Explanation

  Comprehensive and Detailed Explanation From Exact Extract:

  If MFA is in place yet attackers still breach the system, the compromise most likely resulted from social engineering, specifically pretexting. Pretexting occurs when an attacker fabricates a convincing scenario (a "pretext") to trick the victim into revealing authentication information, such as OTP codes, MFA prompts, or login details. Even strong MFA cannot prevent an attack when a human is tricked into voluntarily providing the code.

  Smishing (A) involves fraudulent SMS messages, but no messaging is mentioned in the scenario. Typosquatting (B) involves deceptive URLs that appear similar to legitimate sites and is unrelated to MFA compromise. Espionage (C) refers to stealing sensitive or national-security-related information, not bypassing MFA protections.

  Security+ SY0-701 details pretexting under Social Engineering Attacks, emphasizing that MFA does not fully mitigate human manipulation. Attackers frequently impersonate IT staff, vendors, or automated systems to convince victims to "verify" or "confirm" credentials. This perfectly matches a breach where MFA was present but still circumvented through deception.

• Question 737:

  Which of the following best describe the benefits of a microservices architecture when compared to a monolithic architecture? (Choose two.)

  A. Easier debugging of the system
  B. Reduced cost of ownership of the system
  C. Improved scalability of the system
  D. Increased compartmentalization of the system
  E. Stronger authentication of the system
  F. Reduced complexity of the system
  C. Improved scalability of the system
  D. Increased compartmentalization of the system

  ---

  Explanation

  A microservices architecture offers the following benefits compared to a monolithic architecture:

  Improved scalability: Each microservice can be independently scaled based on demand, allowing more efficient resource usage and better performance for high-demand components.

  Increased compartmentalization : Microservices are designed as separate, independent components, which improves modularity and allows for better fault isolation, easier updates, and focused development on specific services.

  While microservices have benefits such as easier debugging and reduced cost of ownership, their primary advantages lie in scalability and compartmentalization.

• Question 738:

  An organization is developing a security program that conveys the responsibilities associated with the general operation of systems and software within the organization.

  Which of the following documents would most likely communicate these expectations?

  A. Business continuity plan
  B. Change management procedure
  C. Acceptable use policy
  D. Software development life cycle policy
  D. Software development life cycle policy

  ---

  Explanation

  A software development life cycle (SDLC) policy outlines responsibilities, best practices, and standards for developing, deploying, and maintaining secure systems and software.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 5: Security Program Management, Section: "Policies and Standards".

• Question 739:

  A systems administrator wants to use a technical solution to explicitly define file permissions for the entire team.

  Which of the following should the administrator implement?

  A. ACL
  B. Monitoring
  C. Isolation
  D. HIPS
  A. ACL

• Question 740:

  An organization discovers that its cold site does not have enough storage and computers available.

  Which of the following was most likely the cause of this failure?

  A. Capacity planning
  B. Load balancing
  C. Backups
  D. Platform diversity
  A. Capacity planning

  ---

  Explanation

  A cold site is a backup facility that provides basic power, space, and environmental controls but does not include hardware or preconfigured systems. It is the organization's responsibility to ensure the site has adequate storage, servers, and equipment staged or available for rapid procurement.

  If the cold site "does not have enough storage and computers," the cause is a failure in capacity planning (A). CompTIA Security+ SY0-701 highlights the need for organizations to determine:

  Required compute capacity

  Storage needs

  Network bandwidth

  Expected recovery workload

  Hardware replacement timelines

  Load balancing (B) distributes traffic; it has nothing to do with cold-site readiness. Backups (C) store data, not physical resources. Platform diversity (D) refers to using multiple technologies to reduce systemic risk.

  The issue is specifically the lack of resources, which directly reflects inadequate capacity planning. Therefore, A is the correct answer.