CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 861:

  Digital signatures use asymmetric encryption. This means the message is encrypted with:

  A. the sender's private key and decrypted with the sender's public key
  B. the sender's public key and decrypted with the sender's private key
  C. the sender's private key and decrypted with the recipient's public key.
  D. the sender's public key and decrypted with the recipient's private key
  A. the sender's private key and decrypted with the sender's public key

  ---

  Explanation

  There are 2 general ways to use asymetric algorithm. 1 - For communication between 2 hosts: If bob sends a message to Alice, bob uses Alice's public key to encrypt the message, and Alice uses her private key to decrypt the message. 2 - For digital signature/Authentication: If ALice need to authenticate Bob, BOB uses his private key to sign the message, and Alice uses the public key of bob to decrypt the message. This process help to make sure the signature is owned by Bob.

  On this example, A is totally correct.

• Question 862:

  Which of the following methods to secure credit card data is best to use when a requirement is to see only the last four numbers on a credit card?

  A. Encryption
  B. Hashing
  C. Masking
  D. Tokenization
  C. Masking

  ---

  Explanation

  Masking is the technique that directly meets the requirement of displaying only the last four digits of a credit card number. It works by obscuring part of the original value (for example, **** **** **** 1234) while leaving a limited portion visible for identification and verification.

  The distinction is important: Masking is a display control. The original data remains unchanged in storage, and only the visible output is partially hidden.

  Tokenization is a data replacement method. It substitutes the entire card number with a non-sensitive token, and the original value is stored separately in a secure token vault. It is not intended for partially revealing digits.

  Encryption and hashing transform the data and are not designed to selectively display only part of the original value.

• Question 863:

  A company's accounting department receives an urgent payment message from the company's bank domain with instructions to wire transfer funds. The sender requests that the transfer be completed as soon as possible.

  Which of the following attacks is described?

  A. Business email compromise
  B. Vishing
  C. Spear phishing
  D. Impersonation
  A. Business email compromise

• Question 864:

  A security administrator recently reset local passwords and the following values were recorded in the system:

  

  Which of the following is the security administrator most likely protecting against?

  A. Account sharing
  B. Weak password complexity
  C. Pass-the-hash attacks
  D. Password compromise
  C. Pass-the-hash attacks

  ---

  Explanation

  The scenario shows stored password hash values for multiple systems after a reset. While the column is labeled "MD5 password values," the key point is not the specific algorithm but that passwords are stored as hashes rather than plaintext.

  This relates directly to pass-the-hash attacks, where an attacker uses a stolen hash to authenticate without needing to know the original password. By resetting passwords and managing stored hashes, the administrator is addressing the risk that previously captured hashes could be reused for unauthorized access.

  Why others are incorrect: Account sharing is unrelated to how passwords are stored.

  Weak password complexity concerns password strength, not hash usage.

  Password compromise is too general and does not specifically relate to the use or abuse of hashed credentials.

  So the best answer is C, without relying on assuming a specific hashing algorithm.

• Question 865:

  An employee fell for a phishing scam, which allowed an attacker to gain access to a company PC. The attacker scraped the PC's memory to find other credentials. Without cracking these credentials, the attacker used them to move laterally through the corporate network.

  Which of the following describes this type of attack?

  A. Privilege escalation
  B. Buffer overflow
  C. SQL injection
  D. Pass-the-hash
  D. Pass-the-hash

  ---

  Explanation

  The scenario describes an attacker who obtained credentials from a compromised system's memory and used them without cracking to move laterally within the network. This technique is known as a "pass-the-hash" attack, where the attacker captures hashed credentials (e.g., NTLM hashes) and uses them to authenticate and gain access to other systems without needing to know the plaintext password. This is a common attack method in environments where weak security practices or outdated protocols are in use.

  References:

  CompTIA Security+ SY0-701 Course Content: The course discusses credential-based attacks like pass-the-hash, emphasizing their impact and the importance of protecting credential stores.

• Question 866:

  An administrator was notified that a user logged in remotely after hours and copied large amounts of data to a personal device.

  Which of the following best describes the user's activity?

  A. Penetration testing
  B. Phishing campaign
  C. External audit
  D. Insider threat
  D. Insider threat

  ---

  Explanation

  An insider threat is a security risk that originates from within the organization, such as an employee, contractor, or business partner, who has authorized access to the organization's data and systems. An insider threat can be malicious, such as stealing, leaking, or sabotaging sensitive data, or unintentional, such as falling victim to phishing or social engineering. An insider threat can cause significant damage to the organization's reputation, finances, operations, and legal compliance. The user's activity of logging in remotely after hours and copying large amounts of data to a personal device is an example of a malicious insider threat, as it violates the organization's security policies and compromises the confidentiality and integrity of the data.

  References:

  Insider Threats -CompTIA Security+ SY0-701: 3.2, video at 0:00

  CompTIA Security+ SY0-701 Certification Study Guide, page 133.

• Question 867:

  Which of the following is the best way to remove personal data from a social media account that is no longer being used?

  A. Exercise the right to be forgotten
  B. Uninstall the social media application
  C. Perform a factory reset
  D. Terminate the social media account
  A. Exercise the right to be forgotten

• Question 868:

  During an annual review of the system design, an engineer identified a few issues with the currently released design.

  Which of the following should be performed next according to best practices?

  A. Risk management process
  B. Product design process
  C. Design review process
  D. Change control process
  C. Design review process

• Question 869:

  Which of the following data types best describes an AI tool developed by a company to automate the ticketing system under a specific contract?

  A. Classified
  B. Regulated information
  C. Open source
  D. Intellectual property
  D. Intellectual property

• Question 870:

  A systems administrator set up a perimeter firewall but continues to notice suspicious connections between internal endpoints.

  Which of the following should be set up in order to mitigate the threat posed by the suspicious activity?

  A. Host-based firewall
  B. Web application firewall
  C. Access control list
  D. Application allow list
  A. Host-based firewall

  ---

  Explanation

  A host-based firewall is a software application that runs on an individual endpoint and filters the incoming and outgoing network traffic based on a set of rules. A host-based firewall can help to mitigate the threat posed by suspicious connections between internal endpoints by blocking or allowing the traffic based on the source, destination, port, protocol, or application. A host-based firewall is different from a web application firewall, which is a type of firewall that protects web applications from common web-based attacks, such as SQL injection, cross-site scripting, and session hijacking. A host-based firewall is also different from an access control list, which is a list of rules that control the access to network resources, such as files, folders, printers, or routers. A host-based firewall is also different from an application allow list, which is a list of applications that are authorized to run on an endpoint, preventing unauthorized or malicious applications from executing.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 254