CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 741:

  Which of the following actions best addresses a vulnerability found on a company's web server?

  A. Patching
  B. Segmentation
  C. Decommissioning
  D. Monitoring
  A. Patching

• Question 742:

  An analyst is reviewing job postings to ensure sensitive company information is not being shared with the general public.

  Which of the following is the analyst most likely looking for?

  A. Office addresses
  B. Software versions
  C. List of board members
  D. Government identification numbers
  B. Software versions

• Question 743:

  A staff member finds a USB drive in the office ' s parking lot.

  Which of the following should the staff member do?

  A. Notify the file owner after reviewing the contents of the drive.
  B. Use an air-gapped system to open the files without exposing the network.
  C. Wipe the drive immediately using a secure method.
  D. Submit the device to the security team without connecting it.
  D. Submit the device to the security team without connecting it.

  ---

  Explanation

  The best answer is D. Submit the device to the security team without connecting it. An unknown USB drive found in a parking lot is a classic example of a potential social engineering or malware delivery attack. Attackers may intentionally leave infected removable media where employees will find it and plug it into a system. The safest action is to not connect the device at all and instead turn it over to the security team for proper handling. Why the other options are incorrect:

  A. Notify the file owner after reviewing the contents of the drive.Reviewing the contents requires connecting the drive, which could infect the system or trigger malicious code.

  B. Use an air-gapped system to open the files without exposing the network.Even an air-gapped system can be put at risk. Regular employees should not analyze suspicious media on their own.

  C. Wipe the drive immediately using a secure method.This destroys possible evidence and still requires handling the device in a way that may not follow incident procedures. From a Security+ standpoint, removable media from unknown sources should be treated as suspicious. Proper procedure is to avoid connecting it and escalate to the security team. Therefore, D is the correct answer.

• Question 744:

  A company evaluates several options that would allow employees to have remote access to the network. The security team wants to ensure the solution includes AAA to comply with internal security policies.

  Which of the following should the security team recommend?

  A. IPSec with RADIUS
  B. RDP connection with LDAPS
  C. Web proxy for all remote traffic
  D. Jump server with 802.1X
  A. IPSec with RADIUS

• Question 745:

  While reviewing logs, a security administrator identifies the following code:

  <script>function (send_info)</script>

  Which of the following best describes the vulnerability being exploited?

  A. XSS
  B. SQLi
  C. DDoS
  D. CSRF
  A. XSS

  ---

  Explanation

  The <script> tags in the code suggest a Cross-Site Scripting (XSS) attack, where malicious scripts are injected into web pages viewed by other users. XSS vulnerabilities allow attackers to execute scripts in the context of a user's browser, which can lead to data theft, session hijacking, and other malicious actions.

• Question 746:

  A company purchased cyber insurance to address items listed on the risk register.

  Which of the following strategies does this represent?

  A. Accept
  B. Transfer
  C. Mitigate
  D. Avoid
  B. Transfer

  ---

  Explanation

  Cyber insurance is a type of insurance that covers the financial losses and liabilities that result from cyberattacks, such as data breaches, ransomware, denial-of-service, phishing, or malware. Cyber insurance can help a company recover from the costs of restoring data, repairing systems, paying ransoms, compensating customers, or facing legal actions. Cyber insurance is one of the possible strategies that a company can use to address the items listed on the risk register. A risk register is a document that records the identified risks, their probability, impact, and mitigation strategies for a project or an organization. The four common risk mitigation strategies are:

  Accept: The company acknowledges the risk and decides to accept the consequences without taking any action to reduce or eliminate the risk. This strategy is usually chosen when the risk is low or the cost of mitigation is too high.

  Transfer: The company transfers the risk to a third party, such as an insurance company, a vendor, or a partner. This strategy is usually chosen when the risk is high or the company lacks the resources or expertise to handle the risk.

  Mitigate: The company implements controls or measures to reduce the likelihood or impact of the risk. This strategy is usually chosen when the risk is moderate or the cost of mitigation is reasonable.

  Avoid: The company eliminates the risk by changing the scope, plan, or design of the project or the organization. This strategy is usually chosen when the risk is unacceptable or the cost of mitigation is too high. By purchasing cyber insurance, the company is transferring the risk to the insurance company, which will cover the financial losses and liabilities in case of a cyberattack. Therefore, the correct answer is B. Transfer.

  References:

  CompTIA Security+ Study Guide (SY0-701), Chapter 8: Governance, Risk, and Compliance, page 377. Professor Messer's CompTIA SY0-701 Security+ Training Course, Section 8.1: Risk Management, video: Risk Mitigation Strategies (5:37).

• Question 747:

  Which of the following describes the reason root cause analysis should be conducted as part of incident response?

  A. To gather loCs for the investigation
  B. To discover which systems have been affected
  C. To eradicate any trace of malware on the network
  D. To prevent future incidents of the same nature
  D. To prevent future incidents of the same nature

  ---

  Explanation

  Root cause analysis is a process of identifying and resolving the underlying factors that led to an incident. By conducting root cause analysis as part of incident response, security professionals can learn from the incident and implement corrective actions to prevent future incidents of the same nature. For example, if the root cause of a data breach was a weak password policy, the security team can enforce a stronger password policy and educate users on the importance of password security. Root cause analysis can also help to improve security processes, policies, and procedures, and to enhance security awareness and culture within the organization. Root cause analysis is not meant to gather loCs (indicators of compromise) for the investigation, as this is a task performed during the identification and analysis phases of incident response. Root cause analysis is also not meant to discover which systems have been affected or to eradicate any trace of malware on the network, as these are tasks performed during the containment and eradication phases of incident response.

  References:

  CompTIA Security+ SY0-701 Certification Study Guide, page 424-425

  Professor Messer's CompTIA SY0-701 Security+ Training Course, video 5.1 - Incident Response, 9:55 - 11:18.

• Question 748:

  A newly identified network access vulnerability has been found in the OS of legacy loT devices.

  Which of the following would best mitigate this vulnerability quickly?

  A. Insurance
  B. Patching
  C. Segmentation
  D. Replacement
  C. Segmentation

  ---

  Explanation

  Segmentation is a technique that divides a network into smaller subnetworks or segments, each with its own security policies and controls. Segmentation can help mitigate network access vulnerabilities in legacy loT devices by isolating them from other devices and systems, reducing their attack surface and limiting the potential impact of a breach. Segmentation can also improve network performance and efficiency by reducing congestion and traffic. Patching, insurance, and replacement are other possible strategies to deal with network access vulnerabilities, but they may not be feasible or effective in the short term. Patching may not be available or compatible for legacy loT devices, insurance may not cover the costs or damages of a cyberattack, and replacement may be expensive and time-consuming.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 142-143

• Question 749:

  An employee clicked a link in an email from a payment website that asked the employee to update contact information. The employee entered the log-in information but received a "page not found" error message.

  Which of the following types of social engineering attacks occurred?

  A. Brand impersonation
  B. Pretexting
  C. Typosquatting
  D. Phishing
  D. Phishing

  ---

  Explanation

  Phishing is the correct answer because the attack uses a fraudulent email containing a malicious link to trick the user into entering credentials on a fake website. The key element in this scenario is the delivery method-an email prompting the user to click a link and submit sensitive information.

  Importantly, this phishing attack leverages brand impersonation as part of its effectiveness. The attacker pretends to be a legitimate payment website to gain the user's trust, which is a common phishing tactic. However, "brand impersonation" is not a standalone attack type in this context; it is a technique used within phishing.

  The "page not found" message after credential submission further indicates a fake site designed only to harvest credentials.

  Therefore, while impersonation is involved, the overall attack type is phishing.

  References:

  Other Social Engineering Attacks -CompTIA Security+ SY0-701 -2.2, CompTIA Security+: Social Engineering Techniques&

  Other Attack ... - NICCS, [CompTIA Security+ Study Guide with over 500 Practice Test Questions:Exam SY0-701,

  9th Edition]

• Question 750:

  A systems administrator is reviewing the VPN logs and notices that during non-working hours a user is accessing the company file server and information is being transferred to a suspicious IP address.

  Which of the following threats is most likely occurring?

  A. Typosquatting
  B. Root or trust
  C. Data ex ltration
  D. Blackmail
  C. Data ex ltration