CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 831:

  A company must ensure sensitive data at rest is rendered unreadable.

  Which of the following will the company most likely use?

  A. Hashing
  B. Tokenization
  C. Encryption
  D. Segmentation
  C. Encryption

  ---

  Explanation

  Encryption is a method of transforming data in a way that makes it unreadable without a secret key necessary to decrypt the data back into plaintext. Encryption is one of the most common and effective ways to protect data at rest, as it prevents unauthorized access, modification, or theft of the data. Encryption can be applied to different types of data at rest, such as block storage, object storage, databases, archives, and so on. Hashing, tokenization, and segmentation are not methods of rendering data at rest unreadable, but rather of protecting data in other ways. Hashing is a one-way function that generates a fixed-length output, called a hash or digest, from an input, such that the input cannot be recovered from the output. Hashing is used to verify the integrity and authenticity of data, but not to encrypt it. Tokenization is a process that replaces sensitive data with non-sensitive substitutes, called tokens, that have no meaning or value on their own. Tokenization is used to reduce the exposure and compliance scope of sensitive data, but not to encrypt it. Segmentation is a technique that divides a network or a system into smaller, isolated units, called segments, that have different levels of access and security. Segmentation is used to limit the attack surface and contain the impact of a breach, but not to encrypt data at rest.

  References:

  CompTIA Security+ Study Guide:

  Exam SY0-701, 9th Edition, pages 77-781

  Protecting data at rest - Security Pillar

• Question 832:

  A malicious actor conducted a brute-force attack on a company's web servers and eventually gained access to the company's customer information database.

  Which of the following is the most effective way to prevent similar attacks?

  A. Regular patching of servers
  B. Web application firewalls
  C. Multifactor authentication
  D. Enabling encryption of customer data
  C. Multifactor authentication

  ---

  Explanation

  multifactor authentication (MFA). MFA requires users to provide multiple forms of authentication (such as a password and a one-time code. The most effective way to prevent similar brute-force attacks in the future is to implement sent to a mobile device) before gaining access. This significantly reduces the likelihood of successful brute-force attacks, as attackers would need more than just the password to gain unauthorized access to the system.

  While regular patching, web application firewalls, and encryption of customer data are important security measures, MFA directly addresses the core vulnerability exploited by brute-force attacks.

• Question 833:

  Which of the following would be the best ways to ensure only authorized personnel can access a secure facility? (Select two).

  A. Fencing
  B. Video surveillance
  C. Badge access
  D. Access control vestibule
  E. Sign-in sheet
  F. Sensor
  C. Badge access
  D. Access control vestibule

  ---

  Explanation

  Badge access and access control vestibule are two of the best ways to ensure only authorized personnel can access a secure facility. Badge access requires the personnel to present a valid and authenticated badge to a reader or scanner that grants or denies access based on predefined rules and permissions. Access control vestibule is a physical security measure that consists of a small room or chamber with two doors, one leading to the outside and one leading to the secure area. The personnel must enter the vestibule and wait for the first door to close and lock before the second door can be opened. This prevents tailgating or piggybacking by unauthorized individuals.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, Chapter 4, pages 197-1981

• Question 834:

  During a penetration test in a hypervisor, the security engineer is able to inject a malicious payload and access the host filesystem.

  Which of the following best describes this vulnerability?

  A. VM escape
  B. Cross-site scripting
  C. Malicious update
  D. SQL injection
  A. VM escape

• Question 835:

  Which of the following is a reason why a forensic specialist would create a plan to preserve data after an modem and prioritize the sequence for performing forensic analysis?

  A. Order of volatility
  B. Preservation of event logs
  C. Chain of custody
  D. Compliance with legal hold
  A. Order of volatility

  ---

  Explanation

  When conducting a forensic analysis after an incident, it's essential to prioritize the data collection process based on the "order of volatility." This principle dictates that more volatile data (e.g., data in memory, network connections) should be captured before less volatile data (e.g., disk drives, logs). The idea is to preserve the most transient and potentially valuable evidence first, as it is more likely to be lost or altered quickly.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 04 Security Operations. CompTIA Security+ SY0-601 Study Guide: Chapter on Digital Forensics.

• Question 836:

  Which of the following concepts protects sensitive information from unauthorized disclosure?

  A. Integrity
  B. Availability
  C. Authentication
  D. Confidentiality
  D. Confidentiality

  ---

  Explanation

  The best answer is D. Confidentiality. In the CIA triad, confidentiality means protecting information from unauthorized disclosure. It ensures that only authorized users, systems, or processes can view sensitive data. The other choices are different security concepts:

  A. Integrity means protecting data from unauthorized modification or destruction.

  B. Availability means ensuring systems and data are accessible when needed.

  C. Authentication means verifying the identity of a user, device, or process. Since the question specifically asks about protecting sensitive information from unauthorized disclosure, confidentiality is the correct answer.

• Question 837:

  During a penetration test, a vendor attempts to enter an unauthorized area using an access badge.

  Which of the following types of tests does this represent?

  A. Defensive
  B. Passive
  C. Offensive
  D. Physical
  D. Physical

• Question 838:

  A security analyst notices an increase in port scans on the edge of the corporate network.

  Which of the following logs should the analyst check to obtain the attacker's source IP address?

  A. OS security
  B. Firewall
  C. Application
  D. Endpoint
  B. Firewall

  ---

  Explanation

  A firewall log records inbound and outbound network traffic, including source and destination IP addresses, port numbers, and connection attempts. Since port scans involve probing various ports on a network, the firewall logs will provide visibility into the attacker's source IP address and help the analyst assess the nature of the scanning activity.

• Question 839:

  Which of the following is the best way to improve the confidentiality of remote connections to an enterprise's infrastructure?

  A. Firewalls
  B. Virtual private networks
  C. Extensive logging
  D. Intrusion detection systems
  B. Virtual private networks

• Question 840:

  A software developer wishes to implement an application security technique that will provide assurance of the application's integrity.

  Which of the following techniques will achieve this?

  A. Secure cookies
  B. Input validation
  C. Static analysis
  D. Code signing
  D. Code signing