CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 81:

  Which of the following describes the maximum allowance of accepted risk?

  A. Risk indicator
  B. Risk level
  C. Risk score
  D. Risk threshold
  D. Risk threshold

  ---

  Explanation

  Risk threshold is the maximum amount of risk that an organization is willing to accept for a given activity or decision. It is also known as risk appetite or risk tolerance. Risk threshold helps an organization to prioritize and allocate resources for risk management. Risk indicator, risk level, and risk score are different ways of measuring or expressing the likelihood and impact of a risk, but they do not describe the maximum allowance of accepted risk.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 34

  Accepting Risk: Definition, How It Works, and Alternatives

• Question 82:

  Which of the following threat actors would most likely target an organization by using a logic bomb within an internally-developed application?

  A. Nation-state
  B. Trusted insider
  C. Organized crime group
  D. Hacktivist
  B. Trusted insider

  ---

  Explanation

  A logic bomb is a malicious code segment hidden inside legitimate software that triggers under specific conditions (dates, system states, user actions). Because logic bombs require direct access to source code or the development environment, the most likely attacker is a trusted insider-especially a disgruntled developer or administrator with the ability to modify internal applications.

  Security+ SY0-701 emphasizes that insider threats have:

  Elevated access

  Knowledge of internal systems

  Ability to manipulate production code

  Motivation driven by revenge, termination, or personal grievances

  These factors make insiders uniquely capable of embedding logic bombs into internally-developed applications.

  Nation-state actors (A) typically target critical infrastructure or advanced espionage, not internal business apps. Organized crime groups (C) seek financial gain and generally do not have internal code access. Hacktivists (D) focus on ideological disruption, typically through external attacks, not internal code manipulation.

  Thus, the threat actor most likely to plant a logic bomb in internal software is B: Trusted insider.

• Question 83:

  Which of the following risks can be mitigated by HTTP headers?

  A. SQLi
  B. XSS
  C. DoS
  D. SSL
  B. XSS

  ---

  Explanation

  HTTP headers can be used to mitigate risks associated with Cross-Site Scripting (XSS). Security-related HTTP headers such as Content Security Policy (CSP) and X-XSS-Protection can be configured to prevent the execution of malicious scripts in the context of a web page.

  XSS (Cross-Site Scripting): A vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. HTTP headers like CSP help prevent XSS attacks by specifying which dynamic resources are allowed to load.

  SQLi (SQL Injection): Typically mitigated by using parameterized queries and input validation, not HTTP headers.

  DoS (Denial of Service): Mitigated by network and application-level defenses rather than HTTP headers.

  SSL (Secure Sockets Layer): Refers to securing communications and is not directly mitigated by HTTP headers; rather, it's implemented using SSL/TLS protocols.

  References:

  CompTIA Security+ SY0-701 Exam Objectives, Domain 3.3 - Protect data (HTTP headers for securing web applications).

• Question 84:

  Which of the following data protection strategies can be used to confirm file integrity?

  A. Masking
  B. Encryption
  C. Hashing
  D. Obfuscation
  C. Hashing

• Question 85:

  A security manager needs an automated solution that will take immediate action to protect an organization against inbound malicious traffic.

  Which of the following is the best solution?

  A. UEM
  B. IPS
  C. WAF
  D. VPN
  B. IPS

  ---

  Explanation

  An Intrusion Prevention System (IPS) is designed to automatically block or mitigate malicious network traffic in real time. Unlike an IDS, which only detects threats, an IPS performs inline traffic inspection and takes active action-such as dropping malicious packets, blocking connections, or updating firewall rules. This matches the requirement for an automated system that responds immediately to inbound threats.

  Security+ SY0-701 highlights IPS as a preventive control that detects signature-based, anomaly-based, and behavioral threats, including exploits, malware, and command-and-control activity. IPS systems are essential in defending against fast-moving attacks where human response time is too slow.

  UEM (A) manages endpoints but does not block inbound network threats.

  WAF (C) protects web applications, not the entire network. VPN (D) provides secure tunnels but does not prevent malicious inbound traffic.

  Thus, B: IPS is the best solution for automatic threat blocking.

• Question 86:

  Which of the following best explains a concern with OS-based vulnerabilities?

  A. An exploit would give an attacker access to system functions that span multiple applications.
  B. The OS vendor's patch cycle is not frequent enough to mitigate the large number of threats.
  C. Most users trust the core operating system features and may not notice if the system has been compromised.
  D. Exploitation of an operating system vulnerability is typically easier than any other vulnerability.
  A. An exploit would give an attacker access to system functions that span multiple applications.

  ---

  Explanation

  Operating system (OS) vulnerabilities can allow attackers to exploit system functions that affect multiple applications, leading to widespread compromise.

  Option B: (patch cycle concerns) is valid but not the primary concern--many OS vendors provide regular patches.

  Option C: (user trust in OS features) is a risk, but the more significant issue is that OS vulnerabilities often affect multiple system components.

  Option D: (ease of exploitation) is not always true, as application and human-related vulnerabilities can be equally exploitable.

  Thus, the main concern is that an OS exploit can impact multiple system functions, leading to broader security risks.

• Question 87:

  A company wants to ensure that only authorized devices can enter an environment.

  Which of the following will the company most likely use to implement the control?

  A. Access lists
  B. Remote connection
  C. Screened subnets
  D. Centralized proxy
  A. Access lists

  ---

  Explanation

  The best answer is A. Access lists. To ensure that only authorized devices can enter or connect to an environment, the organization needs a control that explicitly allows approved devices and denies unapproved ones. Access lists are used to define which devices, systems, or addresses are permitted access.

  This can include allowlists based on: device identifiers

  MAC addresses

  IP addresses

  approved system entries

  predefined access control rules

  Why the other options are incorrect:

  B. Remote connectionThis is a method of connecting, not a control that determines which devices are authorized.

  C. Screened subnetsA screened subnet helps separate public-facing systems from internal systems, but it does not directly ensure only authorized devices can enter.

  D. Centralized proxyA proxy mediates traffic requests, but it is not the primary control for allowing only authorized devices into an environment. From a Security+ perspective, restricting access to only approved devices is best aligned with allow/deny rules through access lists, so A is the strongest answer.

• Question 88:

  A company processes a large volume of business-to-business transactions and prioritizes data confidentiality over transaction availability. The company ' s firewall administrator must configure a new hardware-based firewall to replace the current one.

  Which of the following should the administrator do to best align with the company requirements in case a security event occurs?

  A. Ensure the firewall data plane moves to fail-closed mode.
  B. Implement a deny-all rule as the last firewall ACL rule.
  C. Prioritize business-critical application traffic through the firewall.
  D. Configure rate limiting between the firewall interfaces.
  A. Ensure the firewall data plane moves to fail-closed mode.

  ---

  Explanation

  The best answer is Option A. Ensure the firewall data plane moves to fail-closed mode. The key requirement is that the company prioritizes confidentiality over availability. In a failure or security event, a fail-closed firewall blocks traffic rather than allowing traffic to continue through an untrusted or degraded state. This choice protects sensitive business data, even if it temporarily interrupts transactions.

  Why the other options are incorrect:

  Option

  B. Implement a deny-all rule as the last firewall ACL rule.This is a standard best practice, but it does not specifically address behavior during a security event. Option

  C. Prioritize business-critical application traffic through the firewall.This emphasizes availability and performance, not confidentiality. Option

  D. Configure rate limiting between the firewall interfaces.Rate limiting can help with traffic control, but it is not the best match for the stated priority.

  From a Security+ standpoint, when confidentiality is more important than uptime, fail closed is the correct choice.

• Question 89:

  Which of the following is most likely a security concern when installing and using low-cost IoT devices in infrastructure environments?

  A. Country of origin
  B. Device responsiveness
  C. Ease of deployment
  D. Storage of data
  D. Storage of data

• Question 90:

  An organization implemented cloud-managed IP cameras to monitor building entry points and sensitive areas. The service provider enables direct TCP/IP connection to stream live video footage from each camera. The organization wants to ensure this stream is encrypted and authenticated.

  Which of the following protocols should be implemented to best meet this objective?

  A. SSH
  B. SRTP
  C. S/MIME
  D. PPTP
  B. SRTP

  ---

  Explanation

  Secure Real-Time Transport Protocol (SRTP) is a security protocol used to encrypt and authenticate the streaming of audio and video over IP networks. It ensures that the video streams from the IP cameras are both encrypted to prevent unauthorized access and authenticated to verify the integrity of the stream, making it the ideal choice for securing video surveillance.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 3: Security Architecture, which includes secure communication protocols like SRTP for protecting data in transit.