CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 841:

  The analyst wants to move data from production to the UAT server for testing the latest release.

  Which of the following strategies to protect data should the analyst use?

  A. Data masking
  B. Data tokenization
  C. Data obfuscation
  D. Data encryption
  A. Data masking

• Question 842:

  A government official receives a blank envelope containing photos and a note instructing the official to wire a large sum of money by midnight to prevent the photos from being leaked on the internet.

  Which of the following best describes the threat actor's intent?

  A. Organized crime
  B. Philosophical beliefs
  C. Espionage
  D. Blackmail
  D. Blackmail

  ---

  Explanation

  The threat actor's intent in this scenario is best described as blackmail. The official is being threatened with the release of compromising photos unless a large sum of money is paid, which is a classic form of blackmail. The attacker is using the threat of exposing sensitive information to coerce the official into making a payment.

• Question 843:

  A security administrator identifies an application that is storing data using MD5.

  Which of the following best identifies the vulnerability likely present in the application?

  A. Cryptographic
  B. Malicious update
  C. Zero day
  D. Side loading
  A. Cryptographic

  ---

  Explanation

  The vulnerability likely present in the application that is storing data using MD5 is a cryptographic vulnerability. MD5 is considered to be a weak hashing algorithm due to its susceptibility to collision attacks, where two different inputs produce the same hash output, compromising data integrity and security.

  Cryptographic: Refers to vulnerabilities in cryptographic algorithms or implementations, such as the weaknesses in MD5.

  Malicious update: Refers to the intentional injection of harmful updates, not related to the use of MD5.

  Zero day: Refers to previously unknown vulnerabilities for which no patch is available, not specifically related to MD5.

  Side loading: Involves installing software from unofficial sources, not directly related to the use of MD5.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 1.4 - Explain the importance of using appropriate cryptographic solutions (MD5 vulnerabilities).

• Question 844:

  A hacker gained access to a system via a phishing attempt that was a direct result of a user clicking a suspicious link. The link laterally deployed ransomware, which laid dormant for multiple weeks, across the network.

  Which of the following would have mitigated the spread?

  A. IPS
  B. IDS
  C. WAF
  D. UAT
  A. IPS

  ---

  Explanation

  An IPS (Intrusion Prevention System) would have mitigated the spread of the ransomware by actively blocking malicious traffic patterns associated with lateral movement or propagation across the network.

  It is important to clarify scope: the IPS would not necessarily stop the initial phishing event (which is user-driven and typically handled by email security controls or user awareness). Instead, its value is in inline inspection and prevention after initial compromise, where it can detect and block suspicious behaviors such as exploitation attempts, abnormal lateral connections, or known ransomware signatures.

  Why others are incorrect: IDS only detects and alerts but does not block, so it would not mitigate spread.

  WAF protects web applications, not internal lateral movement.

  UAT is unrelated to security controls.

  So the correct reasoning is that IPS mitigates post-compromise propagation, not the phishing entry point.

• Question 845:

  The local administrator account for a company's VPN appliance was unexpectedly used to log in to the remote management interface.

  Which of the following would have most likely prevented this from happening'?

  A. Using least privilege
  B. Changing the default password
  C. Assigning individual user IDs
  D. Reviewing logs more frequently
  B. Changing the default password

  ---

  Explanation

  Changing the default password for the local administrator account on a VPN appliance is a basic security measure that would have most likely prevented the unexpected login to the remote management interface. Default passwords are often easy to guess or publicly available, and attackers can use them to gain unauthorized access to devices and systems. Changing the default password to a strong and unique one reduces the risk of brute-force attacks and credential theft.

  Using least privilege, assigning individual user IDs, and reviewing logs more frequently are also good security practices, but they are not as effective as changing the default password in preventing the unexpected login.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 116

  Local Admin Accounts - Security Risks and Best Practices (Part 1)

• Question 846:

  Which of the following threat actors is the most likely to be motivated by profit?

  A. Hacktivist
  B. Insider threat
  C. Organized crime
  D. Shadow IT
  C. Organized crime

• Question 847:

  The marketing department set up its own project management software without telling the appropriate departments.

  Which of the following describes this scenario?

  A. Shadow IT
  B. Insider threat
  C. Data exfiltration
  D. Service disruption
  A. Shadow IT

  ---

  Explanation

  Shadow IT is the term used to describe the use of unauthorized or unapproved IT resources within an organization. The marketing department set up its own project management software without telling the appropriate departments, such as IT, security, or compliance. This could pose a risk to the organization's security posture, data integrity, and regulatory compliance.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, Chapter 2, page 35.

• Question 848:

  A security analyst receives an alert from a web server that contains the following logs:

  GET /image?filename=../../../etc/passwd Host: AcmeInc.web.net user-agent: python-requests/2.27.1

  GET /image?filename=../../..

  /etc/shadow Host: AcmeInc.web.net user-agent: python-requests/2.27.1 Which of the following attacks is being attempted?

  A. File injection
  B. Privilege escalation
  C. Directory traversal
  D. Cookie forgery
  C. Directory traversal

  ---

  Explanation

  The logs show a request attempting to access sensitive system files using sequences such as ../../../. This technique attempts to move up multiple directory levels in the file system hierarchy in order to access files outside the intended directory.

  The attacker is attempting to access /etc/passwd and /etc/shadow, which are sensitive Linux system files that store user account and password information. This behavior is characteristic of a directory traversal attack (also called path traversal).

  Directory traversal attacks exploit insufficient input validation in web applications that allow user-supplied file paths. By injecting ../ sequences, attackers can traverse the directory structure and access restricted files.

  File injection (A) involves inserting malicious files or code into an application. Privilege escalation (B) occurs when an attacker gains higher permissions than intended. Cookie forgery (D) involves manipulating session cookies.

  Thus, the correct answer is C: Directory traversal.

• Question 849:

  An organization disabled unneeded services and placed a firewall in front of a business-critical legacy system.

  Which of the following best describes the actions taken by the organization?

  A. Exception
  B. Segmentation
  C. Risk transfer
  D. Compensating controls
  D. Compensating controls

  ---

  Explanation

  Compensating controls are alternative security measures that are implemented when the primary controls are not feasible, cost-effective, or sufficient to mitigate the risk. In this case, the organization used compensating controls to protect the legacy system from potential attacks by disabling unneeded services and placing a firewall in front of it. This reduced the attack surface and the likelihood of exploitation.

  References:

  Official CompTIA Security+ Study Guide (SY0-701), page 29 Security Controls - CompTIA Security+ SY0-701 - 1.1 1

• Question 850:

  Which of the following is the best method to reduce the attack surface of an enterprise network?

  A. Disable unused network services on servers.
  B. Use port security for wired connections.
  C. Change default passwords for network printers.
  D. Create a guest wireless network for visitors.
  C. Change default passwords for network printers.