CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 801:

  During a wireless network scan at a data center the IT security team discovered Wi-Fi signals broadcasting from an unknown device.

  Which of the following best describes the cause of the incident?

  A. Domain hijacking
  B. On-path attack
  C. Rogue access point
  D. Jamming
  C. Rogue access point

• Question 802:

  Which of the following describes a situation where a user is authorized before being authenticated?

  A. Privilege escalation
  B. Race condition
  C. Tailgating
  D. Impersonation
  D. Impersonation

• Question 803:

  Which of the following topics would most likely be included within an organization's SDLC?

  A. Service-level agreements
  B. Information security policy
  C. Penetration testing methodology
  D. Branch protection requirements
  B. Information security policy

• Question 804:

  An organization plans to take online orders via a new website. Three web servers are available for this website. However, the organization does not want to reveal the network addresses or quantity of the individual servers to the general public.

  Which of the following would best fulfill these requirements?

  A. IPSec
  B. Explicit proxy
  C. Port security
  D. Virtual IP
  D. Virtual IP

• Question 805:

  A few weeks after deploying additional email servers, a company begins to receive complaints that messages are going into recipients' spam folders.

  Which of the following needs to be updated?

  A. CNAME
  B. SMTP
  C. DLP
  D. SPF
  D. SPF

  ---

  Explanation

  When new email servers are deployed, organizations must update their SPF (Sender Policy Framework) records to list the new servers as authorized senders. If the SPF DNS record does not include the new IP addresses, recipient mail systems cannot verify the legitimacy of the messages, causing them to be flagged as spam or rejected.

  Security+ SY0-701 identifies SPF as a key email authentication mechanism responsible for preventing: Email spoofing Unauthorized sender impersonation False spam detection Domain reputation issues

  CNAME (A) maps domain aliases but does not authenticate email. SMTP (B) is the mail protocol and does not influence spam classification. DLP (C) prevents data leakage, not spam filtering.

  Updating the SPF record resolves legitimacy issues by informing receiving mail servers that the new email servers are trusted.

  Thus, the correct answer is D: SPF.

• Question 806:

  Which of the following vulnerabilities is exploited when an attacker overwrites a register with a malicious address?

  A. VM escape
  B. SQL injection
  C. Buffer overflow
  D. Race condition
  C. Buffer overflow

  ---

  Explanation

  A buffer overflow is a vulnerability that occurs when an application writes more data to a memory buffer than it can hold, causing the excess data to overwrite adjacent memory locations. A register is a small storage area in the CPU that holds temporary data or instructions. An attacker can exploit a buffer overflow to overwrite a register with a malicious address that points to a shellcode, which is a piece of code that gives the attacker control over the system. By doing so, the attacker can bypass the normal execution flow of the application and execute arbitrary commands.

  References:

  CompTIA Security+ SY0-701 Certification Study Guide, Chapter 2: Threats, Attacks, and Vulnerabilities, Section 2.3: Application Attacks, Page 76

  Buffer Overflows - CompTIA Security+ SY0-701 - 2.3

• Question 807:

  An organization maintains intellectual property that it wants to protect.

  Which of the following concepts would be most beneficial to add to the company's security awareness training program?

  A. Insider threat detection
  B. Simulated threats
  C. Phishing awareness
  D. Business continuity planning
  A. Insider threat detection

  ---

  Explanation

  For an organization that wants to protect its intellectual property, adding insider threat detection to the security awareness training program would be most beneficial. Insider threats can be particularly dangerous because they come from trusted individuals within the organization who have legitimate access to sensitive information. Insider threat detection: Focuses on identifying and mitigating threats from within the organization, including employees, contractors, or business partners who might misuse their access.

  Simulated threats: Often used for testing security measures and training, but not specifically focused on protecting intellectual property. Phishing awareness: Important for overall security but more focused on preventing external attacks rather than internal threats.

  Business continuity planning: Ensures the organization can continue operations during and after a disruption but does not directly address protecting intellectual property from insider threats.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 5.6 - Implement security awareness practices (Insider threat detection).

• Question 808:

  Which of the following is the phase in the incident response process when a security analyst reviews roles and responsibilities?

  A. Preparation
  B. Recovery
  C. Lessons learned
  D. Analysis
  A. Preparation

  ---

  Explanation

  Preparation is the phase in the incident response process when a security analyst reviews roles and responsibilities, as well as the policies and procedures for handling incidents. Preparation also involves gathering and maintaining the necessary tools, resources, and contacts for responding to incidents. Preparation can help a security analyst to be ready and proactive when an incident occurs, as well as to reduce the impact and duration of the incident.

  Some of the activities that a security analyst performs during the preparation phase are: Defining the roles and responsibilities of the incident response team members, such as the incident manager, the incident coordinator, the technical lead, the communications lead, and the legal advisor. Establishing the incident response plan, which outlines the objectives, scope, authority, and procedures for responding to incidents, as well as the escalation and reporting mechanisms. Developing the incident response policy, which defines the types and categories of incidents, the severity levels, the notification and reporting requirements, and the roles and responsibilities of the stakeholders. Creating the incident response playbook, which provides the step-by-step guidance and checklists for handling specific types of incidents, such as denial-of-service, ransomware, phishing, or data breach. Acquiring and testing the incident response tools, such as network and host-based scanners, malware analysis tools, forensic tools, backup and recovery tools, and communication and collaboration tools. Identifying and securing the incident response resources, such as the incident response team, the incident response location, the evidence storage, and the external support.

  Building and maintaining the incident response contacts, such as the internal and external stakeholders, the law enforcement agencies, the regulatory bodies, and the media.

  References:

  6: Architecture and Design, Section 6.4: Secure Systems Design, p. 279-280 CompTIA Security+ SY0-701 Certification Exam Objectives, Domain

  3: Architecture and Design, Objective 3.5: Given a scenario, implement secure network architecture concepts, Sub-objective: Incident response, p. 16

• Question 809:

  After a recent vulnerability scan, a security engineer needs to harden the routers within the corporate network.

  Which of the following is the most appropriate to disable?

  A. Console access
  B. Routing protocols
  C. VLANs
  D. Web-based administration
  D. Web-based administration

  ---

  Explanation

  Web-based administration is a feature that allows users to configure and manage routers through a web browser interface. While this feature can provide convenience and ease of use, it can also pose a security risk, especially if the web interface is exposed to the internet or uses weak authentication or encryption methods. Web-based administration can be exploited by attackers to gain unauthorized access to the router's settings, firmware, or data, or to launch attacks such as cross-site scripting (XSS) or cross-site request forgery (CSRF). Therefore, disabling web-based administration is a good practice to harden the routers within the corporate network. Console access, routing protocols, and VLANs are other features that can be configured on routers, but they are not the most appropriate to disable for hardening purposes. Console access is a physical connection to the router that requires direct access to the device, which can be secured by locking the router in a cabinet or using a strong password. Routing protocols are essential for routers to exchange routing information and maintain network connectivity, and they can be secured by using authentication or encryption mechanisms. VLANs are logical segments of a network that can enhance network performance and security by isolating traffic and devices, and they can be secured by using VLAN access control lists (VACLs) or private VLANs (PVLANs).

  References:

  CCNA SEC: Router Hardening Your Router's Security Stinks: Here's How to Fix It

• Question 810:

  A security analyst is reviewing the security of a SaaS application that the company intends to purchase.

  Which of the following documentations should the security analyst request from the SaaS application vendor?

  A. Service-level agreement
  B. Third-party audit
  C. Statement of work
  D. Data privacy agreement
  B. Third-party audit