CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 71:

  During a routine audit, an analyst discovers that a department at a high school uses a simul-ation program that was not properly vetted before deployment.

  Which of the following threats is this an example of?

  A. Espionage
  B. Data exfiltration
  C. Shadow IT
  D. Zero-day
  C. Shadow IT

• Question 72:

  A security analyst is assessing several company firewalls.

  Which of the following tools would the analyst most likely use to generate custom packets to use during the assessment?

  A. hping
  B. Wireshark
  C. PowerShell
  D. netstat
  A. hping

  ---

  Explanation

  hping is a packet-crafting tool that can generate custom TCP/IP packets. A security analyst can use it to test firewall rules, assess packet filtering behavior, and verify how firewalls respond to specific packet types or flags.

  Wireshark is primarily used for packet capture and analysis. PowerShell can be used for scripting and administration, but it is not the best answer for generating custom packets in this context. netstat displays network connections and listening ports, but it does not generate custom packets.

• Question 73:

  After multiple on premises security solutions were migrated to the cloud, the incident response time increased. The analyst are spending a long time to trace information on different cloud consoles and correlating data in different formats.

  Which of the following can be used to optimize the incident response time?

  A. CASB
  B. VPC
  C. SWG
  D. CMS
  A. CASB

  ---

  Explanation

  CASB vs SWG CASB is the more optimal solution for multiple on premises security solutions CASB services are explicitly designed to fit the needs of large enterprises You can access link and read about it:

  https://www.gend.co/blog/casb-or-swg-which-is-best-option-for-your-enterprise

• Question 74:

  A SOC analyst establishes a remote control session on an end user's machine and discovers the following in a file:

  gmail.com[ENT][email protected][ENT]NoOneCanGuessThis123! [ENT]Hello Susan, it was great to see you the other day! Let's plan a followup[BACKSPACE]follow-up meeting soon. Here is the link to register. [RTN][CTRL]c [CTRL]v [RTN]after[BACKSPACE]After you register give me a call on my cellphone.

  Which of the following actions should the SOC analyst perform rst?

  A. Advise the user to change passwords.
  B. Reimage the end user's machine.
  C. Check the policy on personal email at work.
  D. Check host rewall logs.
  A. Advise the user to change passwords.

• Question 75:

  A security team is in the process of hardening the network against externally crafted malicious packets.

  Which of the following is the most secure method to protect the internal network?

  A. Anti-malware solutions
  B. Host-based rewalls
  C. Intrusion prevention systems
  D. Network access control
  E. Network allow list
  C. Intrusion prevention systems

• Question 76:

  A security analyst created a fake account and saved the password in a non-readily accessible directory in a spreadsheet. An alert was also con gured to notify the security team if the spreadsheet is opened.

  Which of the following best describes the deception method being deployed?

  A. Honeypot
  B. Honeyfile
  C. Honeytoken
  D. Honeynet
  B. Honeyfile

• Question 77:

  Which of the following security principles most likely requires validation before allowing traffic between systems?

  A. Policy enforcement
  B. Authentication
  C. Zero Trust architecture
  D. Confidentiality
  C. Zero Trust architecture

• Question 78:

  A company tested and validated the effectiveness of network security appliances within the corporate network. The IDS detected a high rate of SQL injection attacks against the company's servers, and the company's perimeter firewall is at capacity.

  Which of the following would be the best action to maintain security and reduce the traffic to the perimeter firewall?

  A. Set the appliance to IPS mode and place it in front of the company firewall.
  B. Convert the firewall to a WAF and use IPSec tunnels to increase throughput.
  C. Set the firewall to fail open if it is overloaded with traffic and send alerts to the SIEM.
  D. Configure the firewall to perform deep packet inspection and monitor TLS traffic.
  A. Set the appliance to IPS mode and place it in front of the company firewall.

  ---

  Explanation

  Given the scenario where an Intrusion Detection System (IDS) has detected a high rate of SQL injection attacks and the perimeter firewall is at capacity, the best action would be to set the appliance to Intrusion Prevention System (IPS) mode and place it in front of the company firewall. This approach has several benefits:

  Intrusion Prevention System (IPS): Unlike IDS, which only detects and alerts on malicious activity, IPS can actively block and prevent those activities. Placing an IPS in front of the firewall means it can filter out malicious traffic before it reaches the firewall, reducing the load on the firewall and enhancing overall security.

  Reducing Traffic Load: By blocking SQL injection attacks and other malicious traffic before it reaches the firewall, the IPS helps maintain the firewall's performance and prevents it from becoming a bottleneck.

  Enhanced Security: The IPS provides an additional layer of defense, identifying and mitigating threats in real-time.

  Option B (Convert the firewall to a WAF and use IPSec tunnels) would not address the primary issue of reducing traffic to the firewall effectively.

  Option C (Set the firewall to fail open) would compromise security.

  Option D (Deep packet inspection) could be resource-intensive and might not alleviate the firewall capacity issue effectively.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 2.5 - Mitigation techniques used to secure the enterprise.

• Question 79:

  A systems administrator successfully configures VPN access to a cloud environment.

  Which of the following capabilities should the administrator use to best facilitate remote administration?

  A. A jump host in the shared services security zone
  B. An SSH server within the corporate LAN
  C. A reverse proxy on the firewall
  D. An MDM solution with conditional access
  A. A jump host in the shared services security zone

  ---

  Explanation

  A jump host in a shared services security zone is specifically designed to provide secure access to remote environments, such as a cloud environment, while ensuring that access is monitored and controlled. This setup facilitates remote administration by providing a dedicated entry point, allowing administrators to access sensitive network areas through a secure, segmented pathway. This setup minimizes direct exposure to the cloud environment and enhances security.

• Question 80:

  An administrator notices that several users are logging in from suspicious IP addresses. After speaking with the users, the administrator determines that the employees were not logging in from those IP addresses and resets the affected users' passwords.

  Which of the following should the administrator implement to prevent this type of attack from succeeding in the future?

  A. Multifactor authentication
  B. Permissions assignment
  C. Access management
  D. Password complexity
  A. Multifactor authentication

  ---

  Explanation

  The correct answer is A because multifactor authentication (MFA) is a method of verifying a user's identity by requiring more than one factor, such as something the user knows (e.g., password), something the user has (e.g., token), or something the user is (e.g., biometric). MFA can prevent unauthorized access even if the user's password is compromised, as the attacker would need to provide another factor to log in. The other options are incorrect because they do not address the root cause of the attack, which is weak authentication. Permissions assignment (B) is the process of granting or denying access to resources based on the user's role or identity. Access management ?is the process of controlling who can access what and under what conditions. Password complexity (D) is the requirement of using strong passwords that are hard to guess or crack, but it does not prevent an attacker from using a stolen password.

  References:

  1: General Security Concepts1 Professor Messer's CompTIA SY0- 701 Security+ Training Course, Section 1.2: Security Concepts Multi-factor Authentication -SY0-601 CompTIA Security+ : 2.4 TOTAL: CompTIA Security+ Cert (SY0-701) | Udemy, Section

  3: Identity and Access Management, Lecture

  15: Multifactor Authentication CompTIA Security+ Certification SY0-

  601: The Total Course [Video], Chapter 3:

  Identity and Account Management, Section 2: Enabling Multifactor Authentication5