CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 751:

  A company's marketing department collects, modifies, and stores sensitive customer data. The infrastructure team is responsible for securing the data while in transit and at rest.

  Which of the following data roles describes the customer?

  A. Processor
  B. Custodian
  C. Subject
  D. Owner
  C. Subject

  ---

  Explanation

  According to the CompTIA Security+ SY0-701 Certification Study Guide, data subjects are the individuals whose personal data is collected, processed, or stored by an organization. Data subjects have certain rights and expectations regarding how their data is handled, such as the right to access, correct, delete, or restrict their data. Data subjects are different from data owners, who are the individuals or entities that have the authority and responsibility to determine how data is classified, protected, and used. Data subjects are also different from data processors, who are the individuals or entities that perform operations on data on behalf of the data owner, such as collecting, modifying, storing, or transmitting data. Data subjects are also different from data custodians, who are the individuals or entities that implement the security controls and procedures specified by the data owner to protect data while in transit and at rest.

  References:

  CompTIA Security+ SY0-701 Certification Study Guide, Chapter 2: Data Security, page 511

• Question 752:

  A newly appointed board member with cybersecurity knowledge wants the board of directors to receive a quarterly report detailing the number of incidents that impacted the organization. The systems administrator is creating a way to present the data to the board of directors.

  Which of the following should the systems administrator use?

  A. Packet captures
  B. Vulnerability scans
  C. Metadata
  D. Dashboard
  D. Dashboard

  ---

  Explanation

  A dashboard is a graphical user interface that provides a visual representation of key performance indicators, metrics, and trends related to security events and incidents. A dashboard can help the board of directors to understand the number and impact of incidents that affected the organization in a given period, as well as the status and effectiveness of the security controls and processes. A dashboard can also allow the board of directors to drill down into specific details or filter the data by various criteria. A packet capture is a method of capturing and analyzing the network traffic that passes through a device or a network segment. A packet capture can provide detailed information about the source, destination, protocol, and content of each packet, but it is not a suitable way to present a summary of incidents to the board of directors. A vulnerability scan is a process of identifying and assessing the weaknesses and exposures in a system or a network that could be exploited by attackers. A vulnerability scan can help the organization to prioritize and remediate the risks and improve the security posture, but it is not a relevant way to report the number of incidents that occurred in a quarter.

  Metadata is data that describes other data, such as its format, origin, structure, or context. Metadata can provide useful information about the characteristics and properties of data, but it is not a meaningful way to communicate the impact and frequency of incidents to the board of directors.

  References:

  1: CompTIA Security+ SY0-701 Certification Study Guide, page 372

  2: SIEM Dashboards -SY0-601 CompTIA Security+ : 4.

  3, video by Professor Messer3: CompTIA Security+ SY0-701 Certification Study Guide, page 346

  4: CompTIA Security+ SY0-701 Certification Study Guide, page 362. : CompTIA Security+ SY0-701 Certification Study Guide, page 97.

• Question 753:

  Which of the following security concepts is accomplished with the installation of a RADIUS server?

  A. CIA
  B. AAA
  C. ACL
  D. PEM
  B. AAA

  ---

  Explanation

  The installation of a RADIUS server (Remote Authentication Dial-In User Service) is primarily associated with the security concept of AAA, which stands for Authentication, Authorization, and Accounting. RADIUS servers are used to manage user credentials and permissions centrally, ensuring that only authenticated and authorized users can access network resources, and tracking user activity for accounting purposes.

  Authentication: Verifies the identity of a user or device.

  When a user tries to access a network, the RADIUS server checks their credentials (username and password) against a database.

  Authorization: Determines what an authenticated user is allowed to do. After authentication, the RADIUS server grants permissions based on predefined policies.

  Accounting: Tracks the consumption of network resources by users. This involves logging session details such as the duration of connections and the amount of data transferred.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 4.6 - Implement and maintain identity and access management.

• Question 754:

  Which of the following explains how a supply chain service provider could introduce a security vulnerability into an organization?

  A. Delaying hardware shipments needed for system upgrades
  B. Outsourcing customer service operations to a foreign call center
  C. Failing to encrypt data stored on the organization's internal database
  D. Having privileged access to client systems and becoming a target for attackers
  D. Having privileged access to client systems and becoming a target for attackers

  ---

  Explanation

  The correct answer is having privileged access to client systems and becoming a target for attackers, which directly reflects a major risk discussed in the Security+ SY0-701 domain of Security Program Management and Oversight, specifically within third-party and supply chain risk management. Supply chain service providers often require elevated or privileged access to an organization's systems to perform maintenance, monitoring, software updates, or support services. This level of access significantly expands the organization's attack surface.

  When a vendor has privileged access, attackers may target the service provider as an indirect path into the primary organization. This type of compromise is especially dangerous because malicious activity may appear legitimate, using trusted credentials and authorized connections. The Security+ study guide emphasizes that third-party compromises can bypass traditional perimeter defenses, making them particularly difficult to detect and contain. As a result, vendors can unintentionally introduce vulnerabilities even if the organization's internal security controls are strong.

  The other options do not directly introduce a security vulnerability. Delayed hardware shipments affect availability and project timelines but do not create a security weakness. Outsourcing customer service may introduce privacy or compliance concerns, but it does not inherently create a technical vulnerability unless combined with poor access controls. Failing to encrypt internal databases is an internal security failure, not a supply chain issue caused by a service provider.

  From a Security+ perspective, managing this risk requires strong contractual controls, least-privilege access, continuous monitoring, and audit rights. Organizations must treat vendors as extensions of their own environment. Therefore, privileged access held by a supply chain provider-and the increased likelihood of that provider being targeted-is the most accurate explanation of how a supply chain service provider can introduce a security vulnerability.

• Question 755:

  A company must ensure that log searches are conducted in the shortest time frame.

  Which of the following should the company do to maintain logs in live storage for 90 days?

  A. Conduct deduplication.
  B. Conduct archiving.
  C. Apply aggregation.
  D. Apply compression.
  C. Apply aggregation.

  ---

  Explanation

  The best answer is C. Apply aggregation. In Security+ logging and monitoring concepts, log aggregation means collecting logs from multiple systems and centralizing them in one place, often for use by a SIEM or another monitoring platform.

  This improves the speed and efficiency of searches because analysts do not need to query many separate devices or locations individually. Centralized logs are much easier to index, correlate, and search quickly. Why the other options are not the best choice:

  A. Conduct deduplicationDeduplication reduces repeated data and may save storage space, but it is primarily a storage-efficiency method. It does not directly provide the best improvement for fast searching across logs.

  B. Conduct archivingArchiving is used for long-term retention, but archived logs are usually moved out of readily searchable live storage. This would not support the requirement for the shortest search time frame.

  D. Apply compressionCompression saves storage capacity, but compressed logs may require decompression or additional processing before review. This does not best support the need for the fastest searches. From a Security+ perspective, when the goal is rapid log review, correlation, and search performance, aggregation is the strongest answer because it supports centralized monitoring and efficient analysis of live logs over the retention period.

• Question 756:

  Which of the following allows for the attribution of messages to individuals?

  A. Adaptive identity
  B. Non-repudiation
  C. Authentication
  D. Access logs
  B. Non-repudiation

  ---

  Explanation

  Non-repudiation is the ability to prove that a message or document was sent or signed by a particular person, and that the person cannot deny sending or signing it. Non-repudiation can be achieved by using cryptographic techniques, such as hashing and digital signatures, that can verify the authenticity and integrity of the message or document. Non-repudiation can be useful for legal, financial, or contractual purposes, as it can provide evidence of the origin and content of the message or document.

  References:

  Non-repudiation -CompTIA Security+ SY0-701 ?1.2, CompTIA Security+ SY0-301: 6.1 ?Non-repudiation, CompTIA Security+ (SY0-701) Certification Exam Objectives, Domain 1.2, page 2.

• Question 757:

  Which of the following best describes the risk present after controls and mitigating factors have been applied?

  A. Residual
  B. Avoided
  C. Inherent
  D. Operational
  A. Residual

• Question 758:

  A company is concerned about theft of client data from decommissioned laptops.

  Which of the following is the most cost-effective method to decrease this risk?

  A. Wiping
  B. Recycling
  C. Shredding
  D. Deletion
  A. Wiping

  ---

  Explanation

  Wiping is the most cost-effective method to decrease the risk of client data theft from decommissioned laptops. Wiping involves using software tools to securely erase all data on the hard drive, making it unrecoverable. This ensures that sensitive information cannot be accessed, even if the laptop is later reused or disposed of. Compared to shredding (which involves physical destruction and is more costly) or simple deletion (which does not truly erase the data), wiping is an effective, inexpensive way to mitigate the risk.

• Question 759:

  A network administrator deployed a DNS logging tool that logs suspicious websites that are visited and then sends a daily report based on various weighted metrics.

  Which of the following best describes the type of control the administrator put in place?

  A. Preventive
  B. Deterrent
  C. Corrective
  D. Detective
  D. Detective

  ---

  Explanation

  The tool that the network administrator deployed is described as one that logs suspicious websites and sends a daily report based on various weighted metrics. This fits the description of a detective control. Detective controls are designed to identify and log security events or incidents after they have occurred. By analyzing these logs and generating reports, the tool helps in detecting potential security breaches, thus allowing for further investigation and response.

  References:

  Based on the CompTIA Security+ SY0-701 Resources, specifically under the domain of Security Operations, which discusses different types of security controls, including detective controls.

• Question 760:

  A Chief Information Officer wants to ensure that network devices cannot connect to the public internet and the local network to directly perform firmware updates. The IT team must manually perform the update process by using a portable device.

  Which of the following architecture types best fits this description?

  A. Microservices
  B. Air-gapped
  C. Software-defined networking
  D. Serverless
  B. Air-gapped

  ---

  Explanation

  The correct answer is Air-gapped because this architecture deliberately isolates systems from external and internal networks to prevent any direct electronic communication. In the Security+ SY0-701 domain of Security Architecture, air-gapped environments are used to achieve the highest level of protection against network-based threats by physically or logically separating critical systems from untrusted networks such as the internet or even the organization's internal network.

  In this scenario, the CIO requires that network devices cannot connect to the public internet or the local network for firmware updates, and that updates must be performed manually using a portable device. This is a defining characteristic of an air-gapped architecture. Air-gapped systems rely on controlled, manual transfer methods-such as USB drives or other removable media-to introduce updates, ensuring that malware, remote exploits, and supply-chain-based network attacks cannot reach the isolated systems through traditional network paths.

  Option A, Microservices, refers to an application design model where software is built as loosely coupled services and does not address physical or logical network isolation. Option C, Software-defined networking, focuses on centralized and programmable network control, not network disconnection. Option D, Serverless, is a cloud computing model where infrastructure management is abstracted away from developers and is incompatible with isolated, offline environments.

  The SY0-701 study guide highlights air-gapped architectures as common in high-security environments such as industrial control systems, military systems, financial infrastructure, and environments requiring maximum protection against zero-day exploits and remote compromise. While air-gapping introduces operational overhead and update delays, it significantly reduces attack surface and exposure to external threats.

  In summary, an architecture that requires manual updates via portable media and prevents any direct network connectivity is best described as air-gapped, making option B the correct answer.