CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 761:

  An organization experiences a suspected data breach that affects sensitive client information. The incident response team must preserve logs, server images, and email communications related to the breach.

  Which of the following best describes this course of action?

  A. Maintaining the chain of custody
  B. Performing root cause analysis
  C. Enforcing a legal hold
  D. Conducting a containment activity
  C. Enforcing a legal hold

  ---

  Explanation

  A legal hold is the correct answer because the organization is preserving potentially relevant evidence after a suspected breach involving sensitive client information. In incident response and governance, legal hold prevents deletion, alteration, or routine retention-policy destruction of data that may be required for litigation, regulatory investigation, discovery, or internal investigation. Logs, server images, and email communications are exactly the kinds of records that may become evidence. Chain of custody is related but narrower: it documents who handled evidence, when, and how integrity was maintained. Root cause analysis happens later to determine why the breach occurred. Containment focuses on stopping spread or limiting damage. Here, the key action is preservation of records.

• Question 762:

  Which of the following allows a systems administrator to tune permissions for a file?

  A. Patching
  B. Access control list
  C. Configuration enforcement
  D. Least privilege
  B. Access control list

  ---

  Explanation

  Access control lists (ACLs) allow administrators to fine-tune file permissions by specifying which users or groups have access to a file and defining the level of access.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 3: Security Architecture, Section: "Access Control Mechanisms".

• Question 763:

  During a SQL update of a database, a temporary field that was created was replaced by an attacker in order to allow access to the system.

  Which of the following best describes this type of vulnerability?

  A. Race condition
  B. Memory injection
  C. Malicious update
  D. Side loading
  A. Race condition

  ---

  Explanation

  A race condition occurs when two or more processes access shared data and try to change it at the same time, leading to unpredictable outcomes. In this case, the attacker exploited a timing issue, replacing a temporary field during a SQL update to gain unauthorized access. This type of vulnerability is often due to a lack of proper synchronization controls, allowing malicious actions to occur within critical update windows.

• Question 764:

  A penetration tester is testing the security of a building's alarm system.

  Which type of penetration test is being conducted?

  A. Physical
  B. Defensive
  C. Integrated
  D. Continuous
  A. Physical

  ---

  Explanation

  Testing the security of a building's alarm system falls under physical penetration testing. According to Security+ SY0-701, physical penetration tests evaluate the effectiveness of physical security controls such as locks, alarms, cameras, sensors, badge readers, and access control points. These tests simulate real-world attempts to bypass or disable physical protections. Defensive testing (B) refers to defensive security operations, not pen testing scope. Integrated testing (C) relates to combined system evaluations but is not a standard pen testing category. Continuous testing (D) refers to ongoing automated tests, not physical alarm evaluation.

  Thus, the correct answer is A: Physical.

• Question 765:

  Which of the following would a security administrator use to comply with a secure baseline during a patch update?

  A. Information security policy
  B. Service-level expectations
  C. Standard operating procedure
  D. Test result report
  C. Standard operating procedure

  ---

  Explanation

  Standard operating procedures (SOPs) outline the steps to be followed to maintain a secure baseline, such as testing and deploying patches while minimizing risk to the system.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 4: Security Operations, Section: "Patch Management and Baseline Compliance".

• Question 766:

  A security engineer configured a remote access VPN. The remote access VPN allows end users to connect to the network by using an agent that is installed on the endpoint, which establishes an encrypted tunnel.

  Which of the following protocols did the engineer most likely implement?

  A. GRE
  B. IPSec
  C. SD-WAN
  D. EAP
  B. IPSec

  ---

  Explanation

  IPSec is commonly used in remote access VPNs to establish secure, encrypted tunnels between the endpoint and the network. This ensures that data transmitted over the VPN is protected from interception, providing confidentiality, integrity, and authentication. IPSec is a widely used protocol for secure remote access VPNs.

• Question 767:

  Which of the following should an internal auditor check for first when conducting an audit of the organization's risk management program?

  A. Policies and procedures
  B. Asset management
  C. Vulnerability assessment
  D. Business impact analysis
  A. Policies and procedures

  ---

  Explanation

  Policies and procedures form the foundation of an organization's risk management program. They establish the framework and guidelines for managing risks across the organization, including roles, responsibilities, and the approach for identifying, assessing, and mitigating risks.

  Without well-defined policies and procedures, it would be challenging to assess other areas of risk management effectively, as they are all built upon these foundational documents.

  Asset management, vulnerability assessment, and business impact analysis are critical components of a risk management program, but they should follow a review of policies and procedures. These documents set the standards and processes that the organization uses to manage assets, assess vulnerabilities, and conduct impact analyses.

• Question 768:

  Callers speaking a foreign language are using company phone numbers to make unsolicited phone calls lo a partner organization. A security analyst validates through phone system logs that the calls are occurring and the numbers are not being spoofed.

  Which of the following is the most likely explanation?

  A. The executive team is traveling internationally and trying to avoid roaming charges
  B. The company's SIP server security settings are weak.
  C. Disgruntled employees are making calls to the partner organization.
  D. The service provider has assigned multiple companies the same numbers
  B. The company's SIP server security settings are weak.

  ---

  Explanation

  If cadets are using company phone numbers to make unsolicited calls, and the logs confirm the numbers are not being spoofed, it suggests that the SIP (Session Initiation Protocol) server's security settings might be weak. This could allow unauthorized access or exploitation of the company's telephony services, potentially leading to misuse by unauthorized individuals.

  References:

  CompTIA Security+ SY0-701 study materials, especially on SIP security and common vulnerabilities.

• Question 769:

  Which of the following should an organization use to ensure that it can review the controls and performance of a service provider or vendor?

  A. Service-level agreement
  B. Memorandum of agreement
  C. Right-to-audit clause
  D. Supply chain analysis
  C. Right-to-audit clause

  ---

  Explanation

  A right-to-audit clause gives an organization the legal ability to inspect and verify a service provider's or vendor's controls, processes, and compliance with contractual obligations, ensuring transparency and accountability.

• Question 770:

  Which of the following is the best way to securely store an encryption key for a data set in a manner that allows multiple entities to access the key when needed?

  A. Public key infrastructure
  B. Open public ledger
  C. Public key encryption
  D. Key escrow
  D. Key escrow

  ---

  Explanation

  Key escrow involves storing the encryption key with a trusted third party or system that securely retains the key and grants access to authorized entities as needed. This approach ensures that multiple authorized parties can access the key in a controlled and secure manner, making it a reliable solution for shared access requirements.