CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 851:

  An unknown source has attacked an organization's network multiple times. The organization has a firewall but no other source of protection against these attacks.

  Which of the following is the best security item to add?

  A. SIEM
  B. Load balancer
  C. UTM
  D. IPS
  D. IPS

  ---

  Explanation

  An Intrusion Prevention System (IPS) is the most effective addition when an organization already has a firewall but continues to face repeated external attacks. Security+ SY0-701 states that an IPS operates inline and automatically blocks malicious traffic in real time based on signatures, anomaly behavior, or heuristics. Whereas a firewall filters traffic by rules, an IPS detects and prevents deeper-level threats such as exploits, malware, and command-and-control attempts.

  A UTM (C) includes IPS features, but it is typically used to replace a firewall with an all-in-one appliance. The question states the organization already has a firewall, so the most efficient addition is a standalone IPS. A SIEM (A) aggregates and analyzes logs but does not block attacks. A load balancer (B) distributes traffic for performance-not security.

  Thus, the best item to stop active inbound attacks is D: IPS.

• Question 852:

  A company is redesigning its infrastructure and wants to reduce the number of physical servers in use.

  Which of the following architectures is best suited for this goal?

  A. Isolation
  B. Segmentation
  C. Virtualization
  D. Redundancy
  C. Virtualization

• Question 853:

  During an investigation, a security analyst discovers traffic going out to a command-and-control server. The analyst must find out if any data exfiltration has occurred.

  Which of the following would best help the analyst determine this?

  A. Application log
  B. Metadata
  C. Network log
  D. Packet capture
  D. Packet capture

  ---

  Explanation

  To determine whether data exfiltration has occurred, the most effective tool is a packet capture (PCAP). Packet captures allow investigators to see exactly what data left the network, including file contents, payloads, headers, protocols, and destination information. PCAP files provide full-fidelity network evidence, enabling analysts to reconstruct sessions and review exfiltrated content byte-by-byte.

  Security+ SY0-701 emphasizes PCAP as the gold standard for forensic network investigations, especially when dealing with:

  Malware beaconing

  Command-and-control (C2) traffic

  Data leakage

  Unauthorized transmissions

  Network logs (C) provide summaries such as IP addresses, ports, and timestamps but do not show actual data contents. Metadata (B) gives descriptive information (e.g., file size, type) but not transmitted payloads. Application logs (A) show application-level events but do not capture network data.

  If the analyst needs to confidently determine if sensitive information was exported to the attacker, only packet capture provides the required depth of visibility.

• Question 854:

  Which of the following best explains how tokenization helps protect sensitive data?

  A. It permanently deletes sensitive information from production systems.
  B. It replaces the original data with reference values that do not hold exploitable meaning.
  C. It stores sensitive data across multiple cloud environments to prevent data loss.
  D. It conceals data by converting it into unreadable ciphertext using symmetric encryption.
  B. It replaces the original data with reference values that do not hold exploitable meaning.

  ---

  Explanation

  The best answer is B. It replaces the original data with reference values that do not hold exploitable meaning.

  Tokenization protects sensitive data by substituting the original value with a token, which is a non-sensitive reference value. The token has no meaningful value to an attacker if it is intercepted or exposed. The real sensitive data is stored separately in a protected system, often called a token vault.

  This is commonly used for: payment card data personally identifiable information sensitive customer records

  Why the other options are incorrect:

  A. It permanently deletes sensitive information from production systems.Tokenization does not necessarily delete the original data permanently. It replaces exposed operational use with tokens while the real data is retained securely elsewhere.

  C. It stores sensitive data across multiple cloud environments to prevent data loss.This is unrelated to tokenization.

  D. It conceals data by converting it into unreadable ciphertext using symmetric encryption.This describes encryption, not tokenization. From a SY0-701 perspective, tokenization reduces exposure by replacing real sensitive values with non-exploitable substitutes, so B is correct.

• Question 855:

  A technician wants to improve the situational and environmental awareness of existing users as they transition from remote to in-office work.

  Which of the following is the best option?

  A. Send out periodic security reminders.
  B. Update the content of new hire documentation.
  C. Modify the content of recurring training.
  D. Implement a phishing campaign
  C. Modify the content of recurring training.

  ---

  Explanation

  Recurring training is a type of security awareness training that is conducted periodically to refresh and update the knowledge and skills of the users. Recurring training can help improve the situational and environmental awareness of existing users as they transition from remote to in-office work, as it can cover the latest threats, best practices, and policies that are relevant to their work environment. Modifying the content of recurring training can ensure that the users are aware of the current security landscape and the expectations of their roles.

  References:

  CompTIA Security+ Study Guide with over 500 Practice Test Questions: Exam SY0-701, 9th Edition, Chapter 5, page 232. CompTIA Security+ (SY0-701) Certification Exam Objectives, Domain 5.1, page 18.

• Question 856:

  Which of the following best practices gives administrators a set period to perform changes to an operational system to ensure availability and minimize business impacts?

  A. Impact analysis
  B. Scheduled downtime
  C. Backout plan
  D. Change management boards
  B. Scheduled downtime

  ---

  Explanation

  Scheduled downtime is a planned period of time when a system or service is unavailable for maintenance, updates, upgrades, or other changes. Scheduled downtime gives administrators a set period to perform changes to an operational system without disrupting the normal business operations or affecting the availability of the system or service. Scheduled downtime also allows administrators to inform the users and stakeholders about the expected duration and impact of the changes.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, Chapter 12: Security Operations and Administration, page 579

• Question 857:

  Which of the following testing techniques uses both defensive and offensive testing methodologies with developers to securely build key applications and software?

  A. Blue
  B. Yellow
  C. Red
  D. Green
  B. Yellow

• Question 858:

  Development team members set up multiple application environments so they can develop, test, and deploy code in a secure and reliable manner. One of the environments is configured with real data that has been obfuscated so the team can adequately assess how the code will work in production.

  Which of the following environments is set up?

  A. Quality assurance
  B. Development
  C. Sandbox
  D. Production
  C. Sandbox

• Question 859:

  Which of the following control types is focused primarily on reducing risk before an incident occurs?

  A. Preventive
  B. Deterrent
  C. Corrective
  D. Detective
  A. Preventive

  ---

  Explanation

  "Preventive controls act before an event, preventing it from advancing". Deterrent - "acts to discourage the attacker by reducing the likelhood of success from the perspective of the attacker".

• Question 860:

  An IT security team is concerned about the confidentiality of documents left unattended in MFPs.

  Which of the following should the security team do to mitigate the situation?

  A. Educate users about the importance of paper shredder devices.
  B. Deploy an authentication factor that requires ln-person action before printing.
  C. Install a software client m every computer authorized to use the MFPs.
  D. Update the management software to utilize encryption.
  B. Deploy an authentication factor that requires ln-person action before printing.

  ---

  Explanation

  To mitigate the risk of confidential documents being left unattended in Multi-Function Printers (MFPs), implementing an authentication factor that requires in-person action before printing (such as PIN codes or badge scanning) is the most effective measure. This ensures that documents are only printed when the authorized user is present to collect them, reducing the risk of sensitive information being exposed.

  References:

  CompTIA Security+ SY0-701 study materials, particularly in the domain of physical security and access control.