CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 861:

  Which of the following is a feature of a next-generation SIEM system?

  A. Virus signatures
  B. Automated response actions
  C. Automated response actions
  D. Vulnerability scanning
  B. Automated response actions

• Question 862:

  Which of the following should be used to select a label for a file based on the file's value, sensitivity, or applicable regulations?

  A. Verification
  B. Certification
  C. Classification
  D. Inventory
  C. Classification

• Question 863:

  Which of the following would be the best way to test resiliency in the event of a primary power failure?

  A. Parallel processing
  B. Tabletop exercise
  C. Simulation testing
  D. Production failover
  D. Production failover

• Question 864:

  Which of the following is the best reason to complete an audit in a banking environment?

  A. Regulatory requirement
  B. Organizational change
  C. Self-assessment requirement
  D. Service-level requirement
  A. Regulatory requirement

  ---

  Explanation

  A regulatory requirement is a mandate imposed by a government or an authority that must be followed by an organization or an individual. In a banking environment, audits are often required by regulators to ensure compliance with laws, standards, and policies related to security, privacy, and financial reporting. Audits help to identify and correct any gaps or weaknesses in the security posture and the internal controls of the organization.

  References:

  Official CompTIA Security+ Study Guide (SY0-701), page 507 Security+ (Plus) Certification | CompTIA IT Certifications 2

• Question 865:

  A company is implementing a vendor's security tool in the cloud. The security director does not want to manage users and passwords specific to this tool but would rather utilize the company's standard user directory.

  Which of the following should the company implement?

  A. 802.1X
  B. SAML
  C. RADIUS
  D. CHAP
  B. SAML

  ---

  Explanation

  The company should implement Security Assertion Markup Language (SAML) to integrate the vendor's security tool with their existing user directory. SAML is an open standard that allows identity providers (IdP) to pass authorization credentials to service providers (SP), enabling Single Sign-On (SSO). This allows the company to use its existing directory services for authentication, avoiding the need to manage a separate set of user credentials for the new tool.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 4: Identity and Access Management, which includes SAML as a key identity federation standard for SSO. CompTIA Security+ Study Guide (SY0-601): Chapter 8, "Identity and Access Management," details the role of SAML in enabling SSO by utilizing an existing identity provider.

• Question 866:

  Which of the following would be used to detect an employee who is emailing a customer list to a personal account before leaving the company?

  A. DLP
  B. FIM
  C. IDS
  D. EDR
  A. DLP

  ---

  Explanation

  To detect an employee who is emailing a customer list to a personal account before leaving the company, a Data Loss Prevention (DLP) system would be used. DLP systems are designed to detect and prevent unauthorized transmission of sensitive data.

  DLP (Data Loss Prevention): Monitors and controls data transfers to ensure sensitive information is not sent to unauthorized recipients.

  FIM (File Integrity Monitoring): Monitors changes to files to detect unauthorized modifications.

  IDS (Intrusion Detection System): Monitors network traffic for suspicious activity but does not specifically prevent data leakage.

  EDR (Endpoint Detection and Response): Monitors and responds to threats on endpoints but is not specifically focused on data leakage.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 4.5 - Modify enterprise capabilities to enhance security (Data Loss Prevention).

• Question 867:

  A few weeks after deploying additional email servers, employees complain that messages are being marked as spam.

  Which needs to be updated?

  A. CNAME
  B. SMTP
  C. DLP
  D. SPF
  D. SPF

  ---

  Explanation

  SPF (Sender Policy Framework) DNS records specify which mail servers are authorized to send email on behalf of a domain. When new email servers are added but SPF records are not updated, recipient mail systems cannot verify the legitimacy of the new servers. As a result, those messages are flagged as spam or rejected altogether.

  CompTIA Security+ SY0-701 highlights SPF as an essential email authentication mechanism used to reduce spoofing, phishing, and spam classification errors. Updating the SPF record to include the new servers ensures email reputation is maintained and messages are delivered properly.

  CNAME (A) maps hostnames but does not affect outbound email legitimacy. SMTP (B) is the mail protocol, not the authentication method. DLP (C) governs sensitive data handling, not spam classification.

  Thus, SPF is the correct answer.

• Question 868:

  Which of the following best describes the main difference between an MOU and an SOW?

  A. An MOU is usually not legally binding, while an SOW is usually legally binding about outcomes.
  B. An MOU identifies engagement details, while an SOW specifies who will engage.
  C. An MOU requires signatures from both parties, while an SOW only requires a signature from the service provider.
  D. An MOU is typically very detailed about tasks, while an SOW is typically high-level.
  A. An MOU is usually not legally binding, while an SOW is usually legally binding about outcomes.

  ---

  Explanation

  The correct answer is A because the primary distinction between a Memorandum of Understanding (MOU) and a Statement of Work (SOW) lies in their legal enforceability and purpose. In the Security+ SY0-701 governance and third-party risk management context, an MOU is generally a formal but nonbinding agreement that outlines mutual expectations, responsibilities, and cooperation between parties. It establishes intent and alignment but typically does not impose enforceable obligations or penalties if terms are not met.

  An SOW, on the other hand, is legally binding and serves as a contractual document that defines specific deliverables, timelines, performance metrics, and acceptance criteria. The SY0-701 study guide emphasizes that SOWs are critical in vendor and service provider relationships because they clearly define what work will be performed, how success is measured, and what happens if requirements are not met. This makes the SOW enforceable in legal and regulatory contexts, especially when dealing with sensitive systems or data.

  Option B is incorrect because both MOUs and SOWs can identify engagement participants, but this is not their defining difference.

  Option C is incorrect because both documents typically require agreement from all involved parties, and signature requirements vary by organization and jurisdiction.

  Option D is incorrect because it reverses the actual level of detail: MOUs are high-level and conceptual, while SOWs are detailed and task-specific.

  In security programs, MOUs are often used for cooperative arrangements, such as information sharing between organizations or government entities. SOWs are used when accountability, compliance, and measurable outcomes are required.

  Understanding this distinction is essential for managing third-party risk, enforcing security requirements, and maintaining compliance with Security+ SY0-701 governance objectives.

• Question 869:

  A smart lighting system is deployed in an office building. The devices connect to the corporate Wi-Fi and are managed via a cloud portal.

  Which of the following security techniques reduces risk for these IoT devices?

  A. Assigning static IP addresses to the devices
  B. Updating default credentials and applying network segmentation
  C. Connecting the devices to the guest Wi-Fi to prevent interactions with corporate IT
  D. Allowing the vendor to have remote access for day-to-day management
  B. Updating default credentials and applying network segmentation

  ---

  Explanation

  The best answer is B. Updating default credentials and applying network segmentation. IoT devices often present increased security risk because they may have weak default settings, limited security features, and persistent network connectivity. Two of the most effective ways to reduce this risk are: Updating default credentialsMany IoT devices come with default usernames and passwords that are widely known or easy to guess. Leaving default credentials unchanged creates a major security weakness. Applying network segmentationSegmenting IoT devices onto a separate network or VLAN limits their ability to interact with critical corporate systems. If one device is compromised, segmentation helps contain the threat and reduces lateral movement.

  Why the other options are incorrect:

  Option A. Assigning static IP addresses to the devicesStatic IP addresses may help with management and inventory, but they do not significantly reduce the core security risk.

  Option C. Connecting the devices to the guest Wi-Fi to prevent interactions with corporate ITThis may seem helpful, but guest Wi-Fi is typically designed for temporary user access, not secured management of business IoT systems. It is not the best practice compared with a properly segmented and controlled IoT network.

  Option D. Allowing the vendor to have remote access for day-to-day managementRoutine vendor remote access can increase risk if not tightly controlled. Third-party access should be limited, monitored, and secured, not broadly allowed as a default control.

  From the SY0-701 perspective, IoT security commonly emphasizes changing insecure defaults, restricting access, segmentation, and reducing exposure. Therefore, B is the strongest and most complete answer.

• Question 870:

  Which of the following considerations is the most important for an organization to evaluate as it establishes and maintains a data privacy program?

  A. Reporting structure for the data privacy officer
  B. Request process for data subject access
  C. Role as controller or processor
  D. Physical location of the company
  C. Role as controller or processor

  ---

  Explanation

  The most important consideration when establishing a data privacy program is defining the organization's role as a controller or processor. These roles, as outlined in privacy regulations such as the General Data Protection Regulation (GDPR), determine the responsibilities regarding the handling of personal data. A controller is responsible for determining the purpose and means of data processing, while a processor acts on behalf of the controller. This distinction is crucial for compliance with data privacy laws. Reporting structure for the data privacy officer is important, but it is a secondary consideration compared to legal roles. Request process for data subject access is essential for compliance but still depends on the organization's role as controller or processor. Physical location of the company can affect jurisdiction, but the role as controller or processor has a broader and more immediate impact.