CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 811:

  Which of the following threat actors is the most likely to be hired by a foreign government to attack critical systems located in other countries?

  A. Hacktivist
  B. Whistleblower
  C. Organized crime
  D. Unskilled attacker
  C. Organized crime

  ---

  Explanation

  Organized crime is a type of threat actor that is motivated by financial gain and often operates across national borders. Organized crime groups may be hired by foreign governments to conduct cyberattacks on critical systems located in other countries, such as power grids, military networks, or financial institutions. Organized crime groups have the resources, skills, and connections to carry out sophisticated and persistent attacks that can cause significant damage and disruption.

  References:

  1: Threat Actors - CompTIA Security+ SY0-701 - 2.1

  2: CompTIA Security+ SY0-701 Certification Study Guide

• Question 812:

  An administrator learns that users are receiving large quantities of unsolicited messages. The administrator checks the content filter and sees hundreds of messages sent to multiple users.

  Which of the following best describes this kind of attack?

  A. Watering hole
  B. Typosquatting
  C. Business email compromise
  D. Phishing
  D. Phishing

  ---

  Explanation

  The scenario describes a large number of unsolicited emails sent to multiple users. This is characteristic of phishing, which SY0-701 defines as mass-distributed fraudulent messages designed to trick recipients into clicking malicious links, downloading malware, or divulging sensitive information.

  Phishing campaigns typically involve:

  High volume

  Non-targeted messaging

  Use of spoofed addresses or fake content

  Delivery through email systems

  A watering-hole attack (A) compromises a legitimate website frequented by targets-not email. Typosquatting (B) relies on malicious websites with deceptive URLs. Business Email Compromise (C) involves highly targeted spear-phishing or impersonation attacks, not bulk email blasts.

  Because this incident involves "hundreds of messages" delivered to "multiple users," it clearly matches the characteristics of a phishing attack, not a sophisticated targeted attack type.

  Phishing is the most common form of social engineering and is emphasized heavily in the Security+ exam due to its frequency and effectiveness.

• Question 813:

  An enterprise is trying to limit outbound DNS traffic originating from its internal network. Outbound DNS requests will only be allowed from one device with the IP address 10.50.10.25.

  Which of the following firewall ACLs will accomplish this goal?

  A. Access list outbound permit 0.0.0.0 0 0.0.0.0/0 port 53 Access list outbound deny 10.50.10.25 32 0.0.0.0/0 port 53
  B. Access list outbound permit 0.0.0.0/0 10.50.10.25 32 port 53 Access list outbound deny 0.0.0.0 0 0.0.0.0/0 port 53
  C. Access list outbound permit 0.0.0.0 0 0.0.0.0/0 port 53 Access list outbound deny 0.0.0.0/0 10.50.10.25 32 port 53
  D. Access list outbound permit 10.50.10.25 32 0.0.0.0/0 port 53 Access list outbound deny 0.0.0.0.0.0.0.0.0/0 port 53
  D. Access list outbound permit 10.50.10.25 32 0.0.0.0/0 port 53 Access list outbound deny 0.0.0.0.0.0.0.0.0/0 port 53

  ---

  Explanation

  A firewall ACL (access control list) is a set of rules that determines which traffic is allowed or denied by the firewall. The rules are processed in order, from top to bottom, until a match is found. The syntax of a firewall ACL rule is: Access list <direction> <action> <source address> <destination address> <protocol> <port>

  To limit outbound DNS traffic originating from the internal network, the firewall ACL should allow only the device with the IP address 10.50.10.25 to send DNS requests to any destination on port 53, and deny all other outbound traffic on port53. The correct firewall ACL is: Access list outbound permit 10.50.10.25/32 0.0.0.0/0 port 53 Access list outbound deny 0.0.0.0/0 0.0.0.0/0 port 53

  The first rule permits outbound traffic from the source address 10.50.10.25/32 (a single host) to any destination address (0.0.0.0/0) on port 53 (DNS). The second rule denies all other outbound traffic on port 53.

  References:

  CompTIA Security+ Certification Kit: Exam SY0-701, 7th Edition, Chapter 4, page 175.

• Question 814:

  An administrator is estimating the cost associated with an attack that could result in the replacement of a physical server.

  Which of the following processes is the administrator performing?

  A. Quantitative risk analysis
  B. Disaster recovery test
  C. Physical security controls review
  D. Threat modeling
  A. Quantitative risk analysis

• Question 815:

  Which of the following security concepts is the best reason for permissions on a human resources fileshare to follow the principle of least privilege?

  A. Integrity
  B. Availability
  C. Confidentiality
  D. Non-repudiation
  C. Confidentiality

  ---

  Explanation

  Confidentiality is the security concept that ensures data is protected from unauthorized access or disclosure. The principle of least privilege is a technique that grants users or systems the minimum level of access or permissions that they need to perform their tasks, and nothing more. By applying the principle of least privilege to a human resources fileshare, the permissions can be restricted to only those who have a legitimate need to access the sensitive data, such as HR staff, managers, or auditors. This can prevent unauthorized users, such as hackers, employees, or contractors, from accessing, copying, modifying, or deleting the data. Therefore, the principle of least privilege can enhance the confidentiality of the data on the fileshare. Integrity, availability, and non-repudiation are other security concepts, but they are not the best reason for permissions on a human resources fileshare to follow the principle of least privilege. Integrity is the security concept that ensures data is accurate and consistent, and protected from unauthorized modification or corruption. Availability is the security concept that ensures data is accessible and usable by authorized users or systems when needed. Non-repudiation is the security concept that ensures the authenticity and accountability of data and actions, and prevents the denial of involvement or responsibility. While these concepts are also important for data security, they are not directly related to the level of access or permissions granted to users or systems.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 16-17, 372-373

• Question 816:

  Which of the following describes the most effective way to address OS vulnerabilities after they are identified?

  A. Endpoint protection
  B. Removal of unnecessary software
  C. Configuration enforcement
  D. Patching
  D. Patching

• Question 817:

  A company is expanding its threat surface program and allowing individuals to security test the company's internet-facing application. The company will compensate researchers based on the vulnerabilities discovered.

  Which of the following best describes the program the company is setting up?

  A. Open-source intelligence
  B. Bug bounty
  C. Red team
  D. Penetration testing
  B. Bug bounty

  ---

  Explanation

  A bug bounty is a program that rewards security researchers for finding and reporting vulnerabilities in an application or system. Bug bounties are often used by companies to improve their security posture and incentivize ethical hacking. A bug bounty program typically defines the scope, rules, and compensation for the researchers.

  References:

  CompTIA Security+ Study Guide with over 500 Practice Test Questions: Exam SY0-701, 9th Edition, Chapter 1, page 10. CompTIA Security+ (SY0-701) Certification Exam Objectives, Domain 1.1, page 2.

• Question 818:

  Which of the following is the best mitigation for a zero-day vulnerability found in mission-critical production servers that must be highly available?

  A. Virtualizing and migrating to a containerized instance
  B. Removing and sandboxing to an isolated network
  C. Monitoring and implementing compensating controls
  D. Patching and redeploying to production as quickly as possible
  C. Monitoring and implementing compensating controls

• Question 819:

  A client demands at least 99.99% uptime from a service provider's hosted security services.

  Which of the following documents includes the information the service provider should return to the client?

  A. MOA
  B. SOW
  C. MOU
  D. SLA
  D. SLA

  ---

  Explanation

  A service level agreement (SLA) is a document that defines the level of service expected by a customer from a service provider, indicating the metrics by which that service is measured, and the remedies or penalties, if any, should the agreed-upon levels not be achieved. An SLA can specify the minimum uptime or availability of a service, such as 99.99%, and the consequences for failing to meet that standard. A memorandum of agreement (MOA), a statement of work (SOW), and a memorandum of understanding (MOU) are other types of documents that can be used to establish a relationship between parties, but they do not typically include the details of service levels and performance metrics that an

  SLA does.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 16-17

• Question 820:

  Which of the following is an example of change management?

  A. Implementing an update after a board grants approval
  B. Setting a new password for a user
  C. Performing a penetration test before deploying a patch
  D. Auditing all system equipment before sending the list to the Chief Executive Officer
  A. Implementing an update after a board grants approval

  ---

  Explanation

  The best answer is A. Implementing an update after a board grants approval. Change management is the formal process used to request, review, approve, test, document, and implement changes to systems and environments in a controlled manner. A common example is submitting a proposed change to a change advisory board (CAB) or other approval authority, receiving approval, and then implementing the update according to procedure. This answer reflects the structured governance process that Security+ associates with proper change management. Why the other options are incorrect:

  B. Setting a new password for a userThis is a routine administrative or support task, not a formal example of change management.

  C. Performing a penetration test before deploying a patchPenetration testing is a security assessment activity. It may support decision-making, but it is not itself the best example of the change management process.

  D. Auditing all system equipment before sending the list to the Chief Executive OfficerThis is closer to inventory or audit work, not change management. From a SY0-701 perspective, change management is about controlled, approved, and documented changes to the environment. Therefore, A is the correct answer.