CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 771:

  A new employee accessed an unauthorized website. An investigation found that the employee violated the company's rules.

  Which of the following did the employee violate?

  A. MOU
  B. AUP
  C. NDA
  D. MOA
  B. AUP

• Question 772:

  Alerts from email protection systems and MSSPs must be entered into an IT service management system and assigned to the security team.

  Which of the following should an organization implement to enable this functionality?

  A. Automated compliance monitoring
  B. Automated ticket creation
  C. Automated vulnerability scans
  D. Automated indicator sharing
  B. Automated ticket creation

  ---

  Explanation

  The best answer is B. Automated ticket creation. The requirement is to take alerts from email protection systems and MSSPs and ensure they are entered into an IT service management system and assigned to the security team. That function is best achieved through automated ticket creation, which generates incidents or service tickets based on incoming alerts and routes them to the appropriate group. This improves consistency, response time, and tracking of security events. Why the other options are incorrect:

  A. Automated compliance monitoringThis focuses on compliance status, not routing alerts into an ITSM workflow.

  C. Automated vulnerability scansVulnerability scanning identifies weaknesses, but it does not create or assign incident tickets from security alerts.

  D. Automated indicator sharingIndicator sharing helps distribute threat intelligence, but it does not directly create and assign IT service tickets. From a Security+ viewpoint, integrating alert sources with response workflows commonly involves ticketing automation, so B is correct.

• Question 773:

  Which of the following security controls are a company implementing by deploying HIPS? (Select two).

  A. Directive
  B. Preventive
  C. Physical
  D. Corrective
  E. Compensating
  F. Detective
  B. Preventive
  F. Detective

• Question 774:

  Which of the following should be used to aggregate log data in order to create alerts and detect anomalous activity?

  A. SIEM
  B. WAF
  C. Network taps
  D. IDS
  A. SIEM

  ---

  Explanation

  A Security Information and Event Management (SIEM) solution collects, aggregates, and correlates logs from multiple sources to detect anomalies and generate alerts. SIEMs are essential for security monitoring and incident detection.

  References:

  Security+ SY0-701 Course Content, Security+ SY0-601 Book.

• Question 775:

  A security engineer is implementing FDE for all laptops in an organization.

  Which of the following are the most important for the engineer to consider as part of the planning process?

  (Select two).

  A. Key escrow
  B. TPM presence
  C. Digital signatures
  D. Data tokenization
  E. Public key management
  F. Certificate authority linking
  A. Key escrow
  B. TPM presence

  ---

  Explanation

  Key escrow is a method of storing encryption keys in a secure location, such as a trusted third party or a hardware security module (HSM). Key escrow is important for FDE because it allows the recovery of encrypted data in case of lost or forgotten passwords, device theft, or hardware failure. Key escrow also enables authorized access to encrypted data for legal or forensic purposes. TPM presence is a feature of some laptops that have a dedicated chip for storing encryption keys and other security information. TPM presence is important for FDE because it enhances the security and performance of encryption by generating and protecting the keys within the chip, rather than relying on software or external devices. TPM presence also enables features such as secure boot, remote attestation, and device authentication.

• Question 776:

  A vendor needs to remotely and securely transfer files from one server to another using the command line.

  Which of the following protocols should be implemented to allow for this type of access?

  (Select two).

  A. SSH
  B. SNMP
  C. RDP
  D. S/MIME
  E. SMTP
  F. SFTP
  A. SSH
  F. SFTP

  ---

  Explanation

  Secure Shell (SSH) is a protocol used for secure command-line access to remote systems, while Secure File Transfer Protocol (SFTP) is an extension of SSH used specifically for securely transferring files. Both SSH and SFTP ensure that data is encrypted during transmission, protecting it from interception or tampering.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 03 Security Architecture. CompTIA Security+ SY0-601 Study Guide: Chapter on Secure Protocols and Encryption.

• Question 777:

  A company plans to secure its systems by: Preventing users from sending sensitive data over corporate email Restricting access to potentially harmful websites.

  Which of the following features should the company set up? (Select two).

  A. DLP software
  B. DNS filtering
  C. File integrity monitoring
  D. Stateful firewall
  E. Guardralls
  F. Antivirus signatures
  A. DLP software
  B. DNS filtering

• Question 778:

  A nation-state attacker gains access to the email accounts of several journalists by compromising a website that the journalists frequently use.

  Which of the following types of attacks describes this example?

  A. On-path
  B. Watering-hole
  C. Typosquatting
  D. Brand impersonation
  B. Watering-hole

  ---

  Explanation

  The correct answer is Watering-hole because the attack involves compromising a legitimate website that is regularly visited by a specific group of targeted users-in this case, journalists-in order to indirectly infect or compromise them. The Security+ SY0-701 study guide defines watering-hole attacks as targeted attacks where adversaries identify websites frequented by their intended victims and then compromise those sites to deliver malware, steal credentials, or conduct further exploitation.

  In this scenario, the attacker does not directly target the journalists' email systems. Instead, the attacker compromises a trusted website that the journalists frequently access. When the journalists visit the site, malicious code can be delivered through drive-by downloads, malicious scripts, or credential-harvesting mechanisms. This technique is particularly effective for nation-state attackers because it leverages trust and normal user behavior, making detection more difficult.

  Option A, On-path, is incorrect because on-path (man-in-the-middle) attacks involve intercepting or altering communications between two parties in transit, rather than compromising a third-party website. Option C, Typosquatting, involves registering domains with misspelled names to trick users into visiting malicious sites, which is not described here. Option D, Brand impersonation, typically refers to phishing or spoofing attacks that mimic a trusted brand to deceive users, often via email or fake websites, rather than compromising a legitimate one.

  The SY0-701 objectives emphasize that watering-hole attacks are commonly associated with advanced persistent threats (APTs), including nation-state actors, because they allow precise targeting of specific industries, professions, or organizations. This attack method highlights the importance of browser security, threat intelligence, web filtering, and user awareness to reduce exposure to trusted-but-compromised resources.

  In summary, compromising a frequently used website to gain access to a targeted group's accounts is a textbook example of a watering-hole attack.

• Question 779:

  Which of the following is used to quantitatively measure the criticality of a vulnerability?

  A. CVE
  B. CVSS
  C. CIA
  D. CERT
  B. CVSS

  ---

  Explanation

  CVSS stands for Common Vulnerability Scoring System, which is a framework that provides a standardized way to assess and communicate the severity and risk of vulnerabilities. CVSS uses a set of metrics and formulas to calculate a numerical score ranging from 0 to 10, where higher scores indicate higher criticality. CVSS can help organizations prioritize remediation efforts and compare vulnerabilities across different systems and vendors. The other options are not used to measure the criticality of a vulnerability, but rather to identify, classify, or report them.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 39

• Question 780:

  Which of the following would be the best way to handle a critical business application that is running on a legacy server?

  A. Segmentation
  B. Isolation
  C. Hardening
  D. Decommissioning
  A. Segmentation

  ---

  Explanation

  For a critical business application that must remain on a legacy server, segmentation is the best choice. It reduces risk by placing the legacy system in a restricted network zone and limiting access to only necessary systems and traffic.

  Isolation can be too extreme if the application still needs to communicate with users or other systems, hardening may be limited on legacy platforms, and decommissioning is not practical because the application is still critical to the business.