CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 781:

  An employee clicks a malicious link in an email that appears to be from the company's Chief Executive Officer. The employee's computer is infected with ransomware that encrypts the company's files.

  Which of the following is the most effective way for the company to prevent similar incidents in the future?

  A. Security awareness training
  B. Database encryption
  C. Segmentation
  D. Reporting suspicious emails
  A. Security awareness training

  ---

  Explanation

  Security awareness training is the most effective way to prevent similar incidents, as it educates employees on how to recognize and respond to phishing emails and other social engineering attacks. By training employees to spot suspicious links and emails, especially those that appear to be from high-level executives, the company can reduce the likelihood of employees falling victim to such attacks in the future.

• Question 782:

  Which of the following attacks exploits a potential vulnerability as a result of using weak cryptographic algorithms?

  A. Password cracking
  B. On-path
  C. Digital signing
  D. Side-channel
  A. Password cracking

  ---

  Explanation

  Weak cryptographic algorithms make it easier for attackers to crack passwords by using techniques such as brute-force or dictionary attacks. When encryption algorithms are weak, they produce predictable patterns or can be processed faster, allowing attackers to break the encryption and recover sensitive information, such as passwords, more easily.

• Question 783:

  A spoofed identity was detected for a digital certificate.

  Which of the following are the type of unidentified key and the certificate mat could be in use on the company domain?

  A. Private key and root certificate
  B. Public key and expired certificate
  C. Private key and self-signed certificate
  D. Public key and wildcard certificate
  C. Private key and self-signed certificate

  ---

  Explanation

  A self-signed certificate is a certificate that is signed by its own private key rather than by a trusted certificate authority (CA). This means that the authenticity of the certificate relies solely on the issuer's own authority. If a spoofed identity was detected, it could indicate that a private key associated with a self-signed certificate was compromised. Self-signed certificates are often used internally within organizations, but they carry higher risks since they are not validated by a third-party CA, making them more susceptible to spoofing.

  References:

  CompTIA Security+ SY0-701 study materials, particularly the domains discussing Public Key Infrastructure (PKI) and certificate management.

• Question 784:

  A company is required to use certified hardware when building networks.

  Which of the following best addresses the risks associated with procuring counterfeit hardware?

  A. A thorough analysis of the supply chain
  B. A legally enforceable corporate acquisition policy
  C. A right to audit clause in vendor contracts and SOWs
  D. An in-depth penetration test of all suppliers and vendors
  A. A thorough analysis of the supply chain

  ---

  Explanation

  Counterfeit hardware is hardware that is built or modified without the authorization of the original equipment manufacturer (OEM). It can pose serious risks to network quality, performance, safety, and reliability. Counterfeit hardware can also contain malicious components that can compromise the security of the network and the data that flows through it. To address the risks associated with procuring counterfeit hardware, a company should conduct a thorough analysis of the supply chain, which is the network of entities involved in the production, distribution, and delivery of the hardware. By analyzing the supply chain, the company can verify the origin, authenticity, and integrity of the hardware, and identify any potential sources of counterfeit or tampered products. A thorough analysis of the supply chain can include the following steps: Establishing a trusted relationship with the OEM and authorized resellers Requesting documentation and certification of the hardware from the OEM or authorized resellers Inspecting the hardware for any signs of tampering, such as mismatched labels, serial numbers, or components Testing the hardware for functionality, performance, and security Implementing a tracking system to monitor the hardware throughout its lifecycle Reporting any suspicious or counterfeit hardware to the OEM and law enforcement agencies.

  References:

  1: Identify Counterfeit and Pirated Products - Cisco,

  2: What Is Hardware Security? Definition, Threats, and Best Practices,

  3: Beware of Counterfeit Network Equipment - TechNewsWorld, : Counterfeit Hardware: The Threat and How to Avoid It

• Question 785:

  A security administrator needs to reduce the attack surface in the company's data centers.

  Which of the following should the security administrator do to complete this task?

  A. Implement a honeynet.
  B. Define Group Policy on the servers.
  C. Configure the servers for high availability.
  D. Upgrade end-of-support operating systems.
  D. Upgrade end-of-support operating systems.

  ---

  Explanation

  Upgrading end-of-support operating systems is one of the most effective ways to reduce the attack surface. Unsupported OS versions no longer receive security patches, making them prime targets for attackers. Removing outdated software ensures that known vulnerabilities cannot be exploited.

  A (honeynet) is used for threat analysis, not reducing the attack surface.

  B (Group Policy) helps enforce security policies but does not address outdated vulnerabilities.

  C (High availability) focuses on uptime, not security risk reduction.

  References:

  CompTIA Security+ SY0-701 Official Study Guide, Security Architecture domain.

• Question 786:

  Which of the following cryptographic solutions protects data at rest?

  A. Digital signatures
  B. Full disk encryption
  C. Private key
  D. Steganography
  B. Full disk encryption

  ---

  Explanation

  Full disk encryption (FDE) secures data at rest by encrypting the entire storage drive, ensuring that data is protected when the system is powered off or if the drive is accessed without authorization. This approach is commonly used to protect sensitive data stored on devices like laptops, servers, and storage media.

• Question 787:

  Which of the following is a primary security concern for a company setting up a BYOD program?

  A. End of life
  B. Buffer overflow
  C. VM escape
  D. Jailbreaking
  D. Jailbreaking

  ---

  Explanation

  Jailbreaking is a primary security concern for a company setting up a BYOD (Bring Your Own Device) program. Jailbreaking is the process of removing the manufacturer's or the carrier's restrictions on a device, such as a smartphone or a tablet, to gain root access and install unauthorized or custom software. Jailbreaking can compromise the security of the device and the data stored on it, as well as expose it to malware, viruses, or hacking. Jailbreaking can also violate the warranty and the terms of service of the device, and make it incompatible with the company's security policies and standards. Therefore, a company setting up a BYOD program should prohibit jailbreaking and enforce device compliance and encryption.

  References:

  CompTIA Security+ Study Guide with over 500 Practice Test Questions: Exam SY0-701, 9th Edition, Chapter 2, page 76. CompTIA Security+ SY0-701 Exam Objectives, Domain 2.4, page 11.

• Question 788:

  A software company currently secures access using a combination of traditional username/password configurations and one-time passwords for MFA. However, employees still struggle to maintain both a password manager and the authenticator application. The company wants to migrate to a single, integrated authentication solution that is more secure and provides a smoother login experience for its employees.

  Which of the following solutions will best satisfy the company ' s needs?

  A. Migrating to FIDO2 passkeys, utilizing built-in device biometrics for user authentication
  B. Implementing SMS-based one-time passwords as the primary second factor for all logins
  C. Implementing SAML federation across authentication servers so employees can use SSO to access applications
  D. Deploying a PKI system that requires all employees to use smart cards for login access
  A. Migrating to FIDO2 passkeys, utilizing built-in device biometrics for user authentication

  ---

  Explanation

  The best answer is A. Migrating to FIDO2 passkeys, utilizing built-in device biometrics for user authentication. The company wants a single, integrated authentication solution that is both more secure and easier for employees to use. FIDO2 passkeys best match this requirement because they allow passwordless authentication using cryptographic credentials stored on the user's device, often unlocked with biometrics or a local PIN. This improves security and usability because: users no longer need to manage a password plus a separate authenticator app phishing resistance is stronger than traditional passwords and OTPs authentication is integrated into the device experience biometric unlock makes login smoother for users.

  Why the other options are incorrect:

  B. Implementing SMS-based one-time passwords as the primary second factor for all loginsSMS is weaker than modern phishing-resistant methods and still does not solve the issue of streamlining authentication as well as passkeys.

  C.

  Implementing SAML federation across authentication servers so employees can use SSO to access applicationsSSO improves convenience, but it does not by itself replace passwords with a more secure integrated authentication method.

  It solves access federation, not the core password-plus-authenticator problem.

  D. Deploying a PKI system that requires all employees to use smart cards for login accessSmart cards can be secure, but they are less convenient and less seamless than device-based passkeys and biometrics for many organizations. From a SY0-701 perspective, FIDO2 and passwordless authentication are strong modern controls that improve both security and user experience. Therefore, A is the best answer.

• Question 789:

  A systems administrator uses deception techniques to help detect and study attacks within a network. The administrator deploys a document filled with fake passwords and customer payment information.

  Which of the following techniques is the administrator using?

  A. Honeytoken
  B. Honeypot
  C. Honeyfile
  D. Honeynet
  C. Honeyfile

  ---

  Explanation

  The best answer is C. Honeyfile.

  A honeyfile is a decoy file that is intentionally placed where an attacker might discover and open it. It often contains fake but tempting information, such as passwords, payment data, or confidential records. If someone accesses, copies, or opens the file, that activity can alert defenders to suspicious behavior. This question specifically describes a document filled with fake passwords and customer payment information. Because the decoy is a file or document, honeyfile is the most precise answer. Why the other options are incorrect:

  A. HoneytokenA honeytoken is a broader term for fake digital data used to detect unauthorized access, such as fake credentials, database entries, or API keys. A honeyfile can be considered a type of honeytoken, but since the question specifically mentions a document, honeyfile is the better answer.

  B. HoneypotA honeypot is a decoy system or service designed to attract attackers, not just a single document.

  D. HoneynetA honeynet is an entire network of decoy systems used for detection and research. From a Security+ perspective, deception technologies include honeyfiles, honeytokens, honeypots, and honeynets. Since the item deployed is a document, C is the best answer.

• Question 790:

  Which of the following receives logs from various devices and services, and then presents alerts?

  A. SIEM
  B. SCADA
  C. SNMP
  D. SCAP
  A. SIEM