CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 971:

  A security analyst sees the following entries in web server logs:

  

  Which of the following IP addresses is most likely involved in a malicious attempt?

  A. 105.86.13.11
  B. 118.19.200.55
  C. 132.18.62.144
  D. 200.17.88.121
  B. 118.19.200.55

  ---

  Explanation

  The malicious IP address is 118.19.200.55 because the log entry includes a SQL statement: SELECT * FROM company WHERE keyword = ' VP. That pattern strongly indicates an attempted SQL injection or database query manipulation through a web search endpoint. In Security+ threat and vulnerability analysis, SQL injection is an application attack in which an attacker places database commands into input fields or URL parameters to retrieve, alter, or destroy data. The

  132.18.62.144 entry also shows suspicious directory traversal syntax using../, but the question asks for the most likely malicious attempt among the listed entries; the explicit SQL query in a POST request is the clearest indicator. Normal GET requests and 404 errors alone are less conclusive.

• Question 972:

  During a recent log review, an analyst discovers evidence of successful injection attacks.

  Which of the following will best address this issue?

  A. Authentication
  B. Secure cookies
  C. Static code analysis
  D. Input validation
  D. Input validation

  ---

  Explanation

  Input validation is the primary defense against injection attacks, such as SQL injection or command injection. It ensures that user-supplied data is properly sanitized before processing, preventing attackers from injecting malicious code.

  Authentication (A) helps verify user identity but does not prevent injection attacks.

  Secure cookies (B) improve session security but do not address injection vulnerabilities.

  Static code analysis (C) helps identify vulnerabilities in source code but does not actively prevent attacks in real-time.

  References:

  CompTIA Security+ SY0-701 Official Study Guide, Threats, Vulnerabilities, and Mitigations domain.

• Question 973:

  An IT manager is increasing the security capabilities of an organization after a data classification initiative determined that sensitive data could be exfiltrated from the environment.

  Which of the following solutions would mitigate the risk?

  A. XDR
  B. SPF
  C. DLP
  D. DMARC
  C. DLP

  ---

  Explanation

  To mitigate the risk of sensitive data being exfiltrated from the environment, the IT manager should implement a Data Loss Prevention (DLP) solution. DLP monitors and controls the movement of sensitive data, ensuring that unauthorized transfers are blocked and potential data breaches are prevented. XDR (Extended Detection and Response) is useful for threat detection across multiple environments but doesn't specifically address data exfiltration. SPF (Sender Policy Framework) helps prevent email spoofing, not data exfiltration. DMARC (Domain-based Message Authentication, Reporting & Conformance) also addresses email security and spoofing, not data exfiltration.

• Question 974:

  A security engineer needs to quickly identify a signature from a known malicious file.

  Which of the following analysis methods would the security engineer most likely use?

  A. Static
  B. Sandbox
  C. Network traffic
  D. Package monitoring
  A. Static

• Question 975:

  Which of the following is considered a preventive control?

  A. Configuration auditing
  B. Log correlation
  C. Incident alerts
  D. Segregation of duties
  D. Segregation of duties

• Question 976:

  An administrator is reviewing a single server's security logs and discovers the following:

  

  Which of the following best describes the action captured in this log file?

  A. Brute-force attack
  B. Privilege escalation
  C. Failed password audit
  D. Forgotten password by the user
  A. Brute-force attack

  ---

  Explanation

  A brute-force attack is a type of attack that involves systematically trying all possible combinations of passwords or keys until the correct one is found. The log file shows multiple failed login attempts in a short amount of time, which is a characteristic of a brute-force attack. The attacker is trying to guess the password of the Administrator account on the server. The log file also shows the event ID 4625, which indicates a failed logon attempt, and the status code 0xC000006A, which means the user name is correct but the password is wrong. These are indicators of compromise (IoC) that suggest a brute-force attack is taking place.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 215-216 and 223

• Question 977:

  A company wants to update its disaster recovery plan to include a dedicated location for immediate continued operations if a catastrophic event occurs.

  Which of the following options is best to include in the disaster recovery plan?

  A. Hot site
  B. Warm site
  C. Geolocation
  D. Cold site
  A. Hot site

• Question 978:

  Which of the following threat actors would most likely deface the website of a high-profile music group?

  A. Unskilled attacker
  B. Organized crime
  C. Nation-state
  D. Insider threat
  A. Unskilled attacker

  ---

  Explanation

  An unskilled attacker, often referred to as a script kiddie, is likely to engage in website defacement. This type of attack typically requires minimal expertise and is often conducted for notoriety.

  References:

  CompTIA Security+ SY0-701 Study Guide, Domain 2: Threats, Section: "Threat Actors and Motivations".

• Question 979:

  Which of the following is the best way to prevent data from being leaked from a secure network that does not need to communicate externally?

  A. Air gap
  B. Containerization
  C. Virtualization
  D. Decentralization
  A. Air gap

• Question 980:

  During a security incident, the security operations team identified sustained network traffic from a malicious IP address:

  10.1.4.9. A security analyst is creating an inbound firewall rule to block the IP address from accessing the organization's network.

  Which of the following fulfills this request?

  A. access-list inbound deny ig source 0.0.0.0/0 destination 10.1.4.9/32
  B. access-list inbound deny ig source 10.1.4.9/32 destination 0.0.0.0/0
  C. access-list inbound permit ig source 10.1.4.9/32 destination 0.0.0.0/0
  D. access-list inbound permit ig source 0.0.0.0/0 destination 10.1.4.9/32
  B. access-list inbound deny ig source 10.1.4.9/32 destination 0.0.0.0/0

  ---

  Explanation

  A firewall rule is a set of criteria that determines whether to allow or deny a packet to pass through the firewall. A firewall rule consists of several elements, such as the action, the protocol, the source address, the destination address, and the port number. The syntax of a firewall rule may vary depending on the type and vendor of the firewall, but the basic logic is the same. In this question, the security analyst is creating an inbound firewall rule to block the IP address 10.1.4.9 from

  accessing the organization's network. This means that the action should be deny, the protocol should be any (or ig for IP), the source address should be 10.1.4.9/32 (which means a single IP address), the destination address should be 0.0.0.0/0 (which means any IP address), and the port number should be any.

  Therefore, the correct firewall rule is:

  access-list inbound deny ig source 10.1.4.9/32 destination 0.0.0.0/0 This rule will match any packet that has the source IP address of 10.1.4.9 and drop it. The other options are incorrect because they either have the wrong action, the wrong source address, or the wrong destination address. For example, option A has the source and destination addresses reversed, which means that it will block any packet that has the destination IP address of 10.1.4.9, which is not the intended

  goal.

  Option C has the wrong action, which is permit, which means that it will allow the packet to pass through the firewall, which is also not the intended goal.

  Option D has the same problem as option A, with the source and destination addresses reversed.

  References:

  Firewall Rules -CompTIA Security+ SY0-401: 1.2, Firewalls -SY0-601 CompTIA Security+ : 3.3, Firewalls -CompTIA Security+ SY0-501, Understanding Firewall Rules -CompTIA Network+ N10-005: 5.5, Configuring Windows Firewall - CompTIA A+ 220-1102 -1.6.