CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 941:

  Which of the following best represents an application that does not have an on-premises requirement and is accessible from anywhere?

  A. PaaS
  B. Hybrid cloud
  C. Private cloud
  D. IaaS
  E. SaaS
  E. SaaS

  ---

  Explanation

  Software as a Service (SaaS) represents an application that is hosted in the cloud and accessible via the internet from anywhere, with no requirement for on-premises infrastructure. SaaS applications are managed by a third-party provider, allowing users to access them through a web browser, making them highly scalable and flexible for remote access.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 3: Security Architecture, where cloud service models such as SaaS are discussed, highlighting their accessibility and lack of on-premises requirements.

• Question 942:

  A technician is opening ports on a firewall for a new system being deployed and supported by a SaaS provider.

  Which of the following is a risk in the new system?

  A. Default credentials
  B. Non-segmented network
  C. Supply chain vendor
  D. Vulnerable software
  D. Vulnerable software

  ---

  Explanation

  The key phrase is "opening ports on a firewall for a new system being deployed and supported by a SaaS provider." Opening firewall ports to support a new externally supported system increases exposure to the software and services behind those ports. That makes vulnerable software the most direct risk in the new system.

• Question 943:

  A company performs a risk assessment on the information security program each year.

  Which of the following best describes this risk assessment?

  A. Recurring
  B. Ad hoc
  C. One time
  D. Continuous
  A. Recurring

  ---

  Explanation

  Because the organization performs the risk assessment each year, it is being done on a regular, scheduled interval. In Security+ terminology, that makes it a recurring risk assessment, not ad hoc, one-time, or continuous. The Study Guide differentiates these modes and states: "Recurring risk assessments are performed at regular intervals, such as annually or quarterly." This matches the scenario exactly (annually = each year).

  To avoid confusion with the other options: a one-time assessment is described as a "point-in-time view" performed when the organization wants a snapshot (often tied to a specific need), while ad hoc assessments are triggered by a specific event or situation (like a new project or significant change). In contrast, the key distinguishing factor of recurring is the planned cadence used to "track the evolution of risks over time" and ensure risk management adapts. The guide also notes continuous risk assessment involves ongoing monitoring and analysis, often supported by automated scanning and frequent updates, which is different from a once-per-year schedule. Therefore, the annual assessment described is best classified as recurring.

  References:

  Risk assessment types-definition of recurring assessments ("annually or quarterly").

• Question 944:

  A company recently decided to allow employees to work remotely. The company wants to protect us data without using a VPN.

  Which of the following technologies should the company Implement?

  A. Secure web gateway
  B. Virtual private cloud end point
  C. Deep packet Inspection
  D. Next-gene ration firewall
  A. Secure web gateway

  ---

  Explanation

  A Secure Web Gateway (SWG) protects users by filtering unwanted software/malware from user-initiated web traffic and enforcing corporate and regulatory policy compliance. This technology allows the company to secure remote users' data and web traffic without relying on a VPN, making it ideal for organizations supporting remote work.

  References:

  CompTIA Security+ SY0-701 study materials, particularly in the domain of network security and remote access technologies.

• Question 945:

  An administrator finds that all user workstations and servers are displaying a message that is associated with files containing an extension of .ryk.

  Which of the following types of infections is present on the systems?

  A. Virus
  B. Trojan
  C. Spyware
  D. Ransomware
  D. Ransomware

  ---

  Explanation

  Ransomware is a type of malware that encrypts the victim's files and demands a ransom for the decryption key. The ransomware usually displays a message on the infected system with instructions on how to pay the ransom and recover the files. The .ryk extension is associated with a ransomware variant called Ryuk, which targets large organizations and demands high ransoms.

  References:

  CompTIA Security+ Certification Kit: Exam SY0-701, 7th Edition, Chapter 1, page 17.

• Question 946:

  After a security awareness training session, a user called the IT help desk and reported a suspicious call. The suspicious caller stated that the Chief Financial Officer wanted credit card information in order to close an invoice.

  Which of the following topics did the user recognize from the training?

  A. Insider threat
  B. Email phishing
  C. Social engineering
  D. Executive whaling
  C. Social engineering

  ---

  Explanation

  The caller used a deceptive pretext to pressure the user into revealing sensitive credit card information by pretending to act on behalf of the CFO. This is a classic example of social engineering. Executive whaling is a specific phishing attack that targets high-level executives, but in this case the attacker is impersonating an executive to manipulate another employee, so the best answer is social engineering.

• Question 947:

  Which of the following is the greatest advantage that network segmentation provides?

  A. End-to-end encryption
  B. Decreased resource utilization
  C. Enhanced endpoint protection
  D. Configuration enforcement
  E. Security zones
  E. Security zones

  ---

  Explanation

  The greatest advantage of network segmentation is the creation of security zones, which isolate systems into separate logical or physical network sections. According to CompTIA Security+ SY0-701, segmentation is a foundational security architecture practice used to reduce the attack surface, restrict lateral movement, enforce least privilege, and contain breaches. By dividing the network into zones-such as DMZ, internal, restricted, and guest-administrators can apply tailored access controls, firewall rules, IDS/IPS placement, and monitoring boundaries.

  Segmentation provides defense-in-depth by preventing attackers from reaching critical systems even if they compromise a less-secure device. It also limits broadcast domains and improves traffic visibility. End-to-end encryption (A) protects confidentiality but is unrelated to segmentation. Decreased resource utilization (B) is not a primary benefit. Enhanced endpoint protection (C) applies to host controls, not network topology. Configuration enforcement (D) is a benefit of centralized management, not segmentation.

  Therefore, the correct answer is Security zones, the core outcome and highest-value advantage of segmentation.

• Question 948:

  Which of the following is the most likely to be included as an element of communication in a security awareness program?

  A. Reporting phishing attempts or other suspicious activities
  B. Detecting insider threats using anomalous behavior recognition
  C. Verifying information when modifying wire transfer data
  D. Performing social engineering as part of third-party penetration testing
  A. Reporting phishing attempts or other suspicious activities

  ---

  Explanation

  A security awareness program is a set of activities and initiatives that aim to educate and inform the users and employees of an organization about the security policies, procedures, and best practices. A security awareness program can help to reduce the human factor in security risks, such as social engineering, phishing, malware, data breaches, and insider threats. A security awareness program should include various elements of communication, such as newsletters, posters, videos, webinars, quizzes, games, simulations, and feedback mechanisms, to deliver the security messages and reinforce the security culture. One of the most likely elements of communication to be included in a security awareness program is reporting phishing attempts or other suspicious activities, as this can help to raise the awareness of the users and employees about the common types of cyberattacks and how to respond to them. Reporting phishing attempts or other suspicious activities can also help to alert the security team and enable them to take appropriate actions to prevent or mitigate the impact of the attacks. Therefore, this is the best answer among the given options. The other options are not as likely to be included as elements of communication in a security awareness program, because they are either technical or operational tasks that are not directly related to the security awareness of the users and employees. Detecting insider threats using anomalous behavior recognition is a technical task that involves using security tools or systems to monitor and analyze the activities and behaviors of the users and employees and identify any deviations or anomalies that may indicate malicious or unauthorized actions. This task is usually performed by the security team or the security operations center, and it does not require the communication or participation of the users and employees. Verifying information when modifying wire transfer data is an operational task that involves using verification methods, such as phone calls, emails, or digital signatures, to confirm the authenticity and accuracy of the information related to wire transfers, such as the account number, the amount, or the recipient. This task is usually performed by the financial or accounting department, and it does not involve the security awareness of the users and employees. Performing social engineering as part of third-party penetration testing is a technical task that involves using deception or manipulation techniques, such as phishing, vishing, or impersonation, to test the security posture and the vulnerability of the users and employees to social engineering attacks. This task is usually performed by external security professionals or consultants, and it does not require the communication or consent of the users and employees. Therefore, these options are not the best answer for this question.

  References:

  Security Awareness and Training -CompTIA Security+ SY0-701: 5.2, video at 0:00

  CompTIA Security+ SY0-701 Certification Study Guide, page 263.

• Question 949:

  A company prevented direct access from the database administrators' workstations to the network segment that contains database servers.

  Which of the following should a database administrator use to access the database servers?

  A. Jump server
  B. RADIUS
  C. HSM
  D. Load balancer
  A. Jump server

  ---

  Explanation

  A jump server is a device or virtual machine that acts as an intermediary between a user's workstation and a remote network segment. A jump server can be used to securely access servers or devices that are not directly reachable from the user's workstation, such as database servers. A jump server can also provide audit logs and access control for the remote connections. A jump server is also known as a jump box or a jump host. RADIUS is a protocol for authentication, authorization, and accounting of network access. RADIUS is not a device or a method to access remote servers, but rather a way to verify the identity and permissions of users or devices that request network access. HSM is an acronym for Hardware Security Module, which is a physical device that provides secure storage and generation of cryptographic keys. HSMs are used to protect sensitive data and applications, such as digital signatures, encryption, and authentication.

  HSMs are not used to access remote servers, but rather to enhance the security of the data and applications that reside on them. A load balancer is a device or software that distributes network traffic across multiple servers or devices, based on criteria such as availability, performance, or capacity. A load balancer can improve the scalability, reliability, and efficiency of network services, such as web servers, application servers, or database servers. A load balancer is not used to access remote servers, but rather to optimize the delivery of the services that run on them .

  References:

  How to access a remote server using a jump host Jump server RADIUS Remote Authentication Dial-In User Service (RADIUS) Hardware Security Module (HSM) [What is an HSM?] [Load balancing (computing)] [What is Load Balancing?]

• Question 950:

  A security manager wants to reduce the number of steps required to identify and contain basic threats.

  Which of the following will help achieve this goal?

  A. SOAR
  B. SIEM
  C. DMARC
  D. NIDS
  A. SOAR