CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 881:

  Which of the following best describes the practice of preserving and documenting the handling of forensic evidence?

  A. Acquisition of evidence
  B. E-discovery
  C. Chain of custody
  D. Forensic tabletop exercises
  C. Chain of custody

  ---

  Explanation

  The best answer is C. Chain of custody. Chain of custody is the documented process used to track forensic evidence from the moment it is collected until it is presented, stored, transferred, or disposed of. It records: who handled the evidence when it was handled where it was stored how it was transferred how its integrity was preserved.

  This is critical to ensure the evidence remains credible and admissible. Why the other options are incorrect:

  A. Acquisition of evidenceAcquisition refers to collecting or imaging evidence, but it does not specifically cover the full documentation of handling over time.

  B. E-discoveryE-discovery relates to identifying and producing electronically stored information for legal matters, not specifically preserving forensic handling records.

  D. Forensic tabletop exercisesThese are discussion-based practice activities, not evidence handling procedures. From a Security+ perspective, preserving and documenting forensic evidence handling is the definition of chain of custody.

• Question 882:

  A company web server is initiating outbound traffic to a low-reputation, public IP on non-standard pat. The web server is used to present an unauthenticated page to clients who upload images the company. An analyst notices a suspicious process running on the server hat was not created by the company development team.

  Which of the following is the most likely explanation for his security incident?

  A. A web shell has been deployed to the server through the page.
  B. A vulnerability has been exploited to deploy a worm to the server.
  C. Malicious insiders are using the server to mine cryptocurrency.
  D. Attackers have deployed a rootkit Trojan to the server over an exposed RDP port.
  A. A web shell has been deployed to the server through the page.

• Question 883:

  A systems administrator receives the following alert from a file integrity monitoring tool:

  The hash of the cmd.exe file has changed.

  The systems administrator checks the OS logs and notices that no patches were applied in the last two months.

  Which of the following most likely occurred?

  A. The end user changed the file permissions.
  B. A cryptographic collision was detected.
  C. A snapshot of the file system was taken.
  D. A rootkit was deployed.
  D. A rootkit was deployed.

  ---

  Explanation

  A rootkit is a type of malware that modifies or replaces system files or processes to hide its presence and activity. A rootkit can change the hash of the cmd.exe file, which is a command-line interpreter for Windows systems, to avoid detection by antivirus or file integrity monitoring tools. A rootkit can also grant the attacker remote access and control over the infected system, as well as perform malicious actions such as stealing data, installing backdoors, or launching attacks on other systems. A rootkit is one of the most difficult types of malware to remove, as it can persist even after rebooting or reinstalling the OS.

  References:

  CompTIA Security+ Study Guide with over 500 Practice Test Questions: Exam SY0-701, 9th Edition, Chapter 4, page 147. CompTIA Security+ SY0-701 Exam Objectives, Domain 1.2, page 9.

• Question 884:

  To improve the security at a data center, a security administrator implements a CCTV system and posts several signs about the possibility of being filmed.

  Which of the following best describe these types of controls?

  (Select two).

  A. Preventive
  B. Deterrent
  C. Corrective
  D. Directive
  E. Compensating
  F. Detective
  B. Deterrent
  F. Detective

  ---

  Explanation

  The CCTV system and signs about the possibility of being filmed serve as both deterrent and detective controls.

  Deterrent controls: Aim to discourage potential attackers from attempting unauthorized actions. Posting signs about CCTV serves as a deterrent by warning individuals that their actions are being monitored. Detective controls: Identify and record unauthorized or suspicious activity. The CCTV system itself functions as a detective control by capturing and recording footage that can be reviewed later.

  Preventive controls: Aim to prevent security incidents but are not directly addressed by the CCTV and signs in this context.

  Corrective controls: Aim to correct or mitigate the impact of a security incident. Directive controls: Provide guidelines or instructions but are not directly addressed by the CCTV and signs.

  Compensating controls: Provide alternative measures to compensate for the absence or failure of primary controls.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 1.1 - Compare and contrast various types of security controls (Deterrent and detective controls).

• Question 885:

  Which of the following should be used to select a label for a file based on the file's value, sensitivity, or applicable regulations?

  A. Verification
  B. Certification
  C. Classification
  D. Inventory
  C. Classification

• Question 886:

  Which of the following can best contribute to prioritizing patch applications?

  A. CVSS
  B. SCAP
  C. OSINT
  D. CVE
  A. CVSS

• Question 887:

  While investigating a recent security breach an analyst finds that an attacker gained access by SOL infection through a company website.

  Which of the following should the analyst recommend to the website developers to prevent this from reoccurring?

  A. Secure cookies
  B. Input sanitization
  C. Code signing
  D. Blocklist
  B. Input sanitization

  ---

  Explanation

  Input sanitization is a critical security measure to prevent SQL injection attacks, which occur when an attacker exploits vulnerabilities in a website's input fields to execute malicious SQL code. By properly sanitizing and validating all user inputs, developers can prevent malicious code from being executed, thereby securing the website against such attacks.

  References:

  CompTIA Security+ SY0-701 study materials, particularly in the domain of web application security and common vulnerability mitigation strategies.

• Question 888:

  An administrator needs to protect user passwords and has been advised to hash the passwords.

  Which of the following BEST describes what the administrator is being advised to do?

  A. Perform a mathematical operation on the passwords that will convert them into unique strings.
  B. Add extra data to the passwords so their length is increased, making them harder to brute force.
  C. Store all passwords in the system in a rainbow table that has a centralized location.
  D. Enforce the use of one-time passwords that are changed for every login session.
  A. Perform a mathematical operation on the passwords that will convert them into unique strings.

  ---

  Explanation

  Admin is being advised to hash. A is the definition of hashing

• Question 889:

  Which of the following involves an attempt to take advantage of database misconfigurations?

  A. Buffer overflow
  B. SQL injection
  C. VM escape
  D. Memory injection
  B. SQL injection

  ---

  Explanation

  SQL injection is a type of attack that exploits a database misconfiguration or a flaw in the application code that interacts with the database. An attacker can inject malicious SQL statements into the user input fields or the URL parameters that are sent to the database server. These statements can then execute unauthorized commands, such as reading, modifying, deleting, or creating data, or even taking over the database server. SQL injection can compromise the confidentiality, integrity, and availability of the data and the system.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 215

• Question 890:

  A security analyst investigates an incident in which a PowerShell script was identified as a potential IoC.

  Which of the following will best help the analyst identify an attempt to compromise the system?

  A. SNMP logs
  B. Firewall logs
  C. EDR logs
  D. IPS logs
  C. EDR logs

  ---

  Explanation

  The best answer is C. EDR logs. EDR (Endpoint Detection and Response) tools are designed to monitor endpoint activity in detail, including process execution, command-line usage, script activity, file changes, persistence attempts, and suspicious behavior. Since the incident involves a PowerShell script, EDR logs are the most useful source for identifying whether the script attempted to compromise the system. PowerShell is commonly abused by attackers for fileless malware, persistence, lateral movement, downloading payloads, and privilege escalation. EDR can capture this kind of endpoint-level behavior much more effectively than general network logs. Why the other options are incorrect:

  A. SNMP logsSNMP is mainly used for network device monitoring and management, not detailed endpoint script execution analysis.

  B. Firewall logsFirewall logs can show allowed or blocked traffic, but they usually do not provide deep visibility into local PowerShell execution or endpoint compromise attempts.

  D. IPS logsAn IPS may detect known malicious traffic patterns, but it is focused on network-based activity. It is not the best source for detailed analysis of a PowerShell script running on a host. From a Security+ standpoint, when analyzing suspicious scripts or endpoint behavior, EDR provides the strongest visibility into actual compromise attempts.