CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 871:

  Drag Drop

  A security analyst is creating the first draft of a network diagram for the company's new customer-facing payment application that will be hosted by a third-party cloud service provider.

  INSTRUCTIONS

  Click the ? to select the appropriate icons to create a secure, redundant web application. Then use the dropdown menu to select the appropriate subnet type. Every space in the diagram must be filled.

  If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

  Select and Place:

  

  

  Explanation

  The diagram should be filled in the way shown below.

  

  WAF (Web Application Firewall) at the top to handle incoming traffic from the Internet Gateway. Load Balancer for distributing traffic between instances. Instances for handling the application workloads, ensuring multiple instances for redundancy. Autoscaling Instance to adjust the number of instances based on demand dynamically.

  In the middle of the diagram, you should select Private Subnet in the dropdown menu.

  This choice is appropriate because the elements in the lower section, especially the Database instances, are part of the private subnet. Placing databases in a private subnet adds an additional layer of security, as it prevents direct internet access to sensitive data. The private subnet is also typically used for backend resources that don't need to be exposed publicly.

• Question 872:

  An organization requests a third-party full-spectrum analysis of its supply chain.

  Which of the following would the analysis team use to meet this requirement?

  A. Vulnerability scanner
  B. Penetration test
  C. SCAP
  D. Illumination tool
  D. Illumination tool

• Question 873:

  A human resources (HR) employee working from home leaves their company laptop open on the kitchen table. A family member walking through the kitchen reads an email from the Chief Financial Officer addressed to the HR department.

  The email contains information referencing company layoffs. The family member posts the content of the email to social media.

  Which of the following policies will the HR employee most likely need to review after this incident?

  A. Hybrid work environment
  B. Operations security
  C. Data loss prevention
  D. Social engineering
  B. Operations security

  ---

  Explanation

  Operations security (OPSEC) focuses on identifying and protecting sensitive information to prevent unauthorized disclosure. In this scenario, the HR employee failed to safeguard confidential company information, leading to its exposure on social media. Training in OPSEC would reinforce the need to maintain security best practices, such as locking screens when away from a device and ensuring that sensitive data is not exposed in unsecured locations. Hybrid work environment policies relate to managing remote and in-office work but do not specifically cover security risks like unauthorized data exposure. Data loss prevention (DLP) deals with technology-based solutions to prevent unauthorized data transfers but does not address physical security practices. Social engineering refers to deceptive tactics used by attackers to manipulate individuals, which is not applicable to this situation. The HR employee should review operations security policies to prevent similar incidents in the future.

• Question 874:

  A security administrator is implementing encryption on all hard drives in an organization.

  Which of the following security concepts is the administrator applying?

  A. Integrity
  B. Authentication
  C. Zero Trust
  D. Con dentiality
  D. Con dentiality

• Question 875:

  Which of the following is used to conceal credit card information in a database log file?

  A. Tokenization
  B. Masking
  C. Hashing
  D. Obfuscation
  B. Masking

• Question 876:

  A security team purchases a tool for cloud security posture management. The team is quickly overwhelmed by the number of misconfigurations that the tool detects.

  Which of the following should the security team configure to establish workflows for cloud resource security?

  A. CASB
  B. IAM
  C. SOAR
  D. XDR
  C. SOAR

• Question 877:

  Which of the following makes Infrastructure as Code (IaC) a preferred security architecture over traditional infrastructure models?

  A. Common attacks are less likely to be effective.
  B. Configuration can be better managed and replicated.
  C. Outsourcing to a third party with more expertise in network defense is possible.
  D. Optimization can occur across a number of computing instances.
  B. Configuration can be better managed and replicated.

• Question 878:

  Which of the following can automate vulnerability management?

  A. CVE
  B. SCAP
  C. OSINT
  D. CVSS
  B. SCAP

  ---

  Explanation

  SCAP (Security Content Automation Protocol) is designed to automate vulnerability management, configuration assessment, and compliance checking. According to CompTIA Security+ SY0-701, SCAP standardizes how vulnerability information is expressed, measured, and shared, allowing security tools to automatically scan systems, identify weaknesses, and assess compliance against predefined baselines.

  SCAP integrates multiple standards such as CVE, CVSS, CPE, and XCCDF, enabling automated vulnerability scanning, scoring, and reporting across large environments. This makes it a core technology for continuous vulnerability management and compliance automation.

  CVE (A) is a catalog of known vulnerabilities, not an automation framework. OSINT (C) provides publicly available intelligence but does not automate remediation or assessment. CVSS (D) provides severity scoring but does not automate vulnerability management.

  Because SCAP enables automated identification, assessment, and reporting of vulnerabilities, the correct answer is B: SCAP.

• Question 879:

  An administrator is installing an SSL certificate on a new system. During testing, errors indicate that the certificate is not trusted. The administrator has verified with the issuing CA and has validated the private key.

  Which of the following should the administrator check for next?

  A. If the wildcard certificate is configured
  B. If the certificate signing request is valid
  C. If the root certificate is installed
  D. If the public key is configured
  C. If the root certificate is installed

  ---

  Explanation

  If the certificate is not trusted, it's often because the root certificate (or intermediate certificate) from the issuing Certificate Authority (CA) is not installed or not recognized by the system. The root certificate verifies the chain of trust, and without it, the SSL certificate may not be trusted by the system or browser. Installing the root and any necessary intermediate certificates should resolve the trust issue.

• Question 880:

  A healthcare organization wants to provide a web application that allows individuals to digitally report health emergencies.

  Which of the following is the most important consideration during development?

  A. Scalability
  B. Availability
  C. Cost
  D. Ease of deployment
  B. Availability

  ---

  Explanation

  Availability is the ability of a system or service to be accessible and usable when needed. For a web application that allows individuals to digitally report health emergencies, availability is the most important consideration during development, because any downtime or delay could have serious consequences for the health and safety of the users. The web application should be designed to handle high traffic, prevent denial-of-service attacks, and have backup and recovery plans in case of failures.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, Chapter 2, page 41.