CompTIA SY0-701 Online Practice Questions and Exam Preparation

CompTIA SY0-701 Online Questions & Answers

• Question 981:

  A company decided to reduce the cost of its annual cyber insurance policy by removing the coverage for ransomware attacks.

  Which of the following analysis elements did the company most likely use in making this decision?

  A. MTTR
  B. RTO
  C. ARO
  D. MTBF
  C. ARO

  ---

  Explanation

  The company most likely used ARO (Annual Rate of Occurrence) to estimate how often a ransomware event is expected to happen within a year. Insurance coverage decisions are commonly tied to risk frequency and expected annual exposure, so if the organization believed the likelihood of a ransomware incident was low enough, it may have decided to remove that coverage to reduce premium costs. MTTR measures repair time, RTO measures acceptable recovery time, and MTBF measures average time between failures, none of which best explain an insurance coverage decision based on expected annual risk.

• Question 982:

  Which of the following most impacts an administrator's ability to address CVEs discovered on a server?

  A. Rescanning requirements
  B. Patch availability
  C. Organizational impact
  D. Risk tolerance
  B. Patch availability

• Question 983:

  A security analyst is responding to a malware incident at a company. The malware connects to a command-and-control server on the internet in order to function.

  Which of the following should the security analyst implement first?

  A. Network segmentation
  B. IP-based firewall rules
  C. Mobile device management
  D. Content filler
  B. IP-based firewall rules

  ---

  Explanation

  The malware depends on reaching its command-and-control server on the internet, so the first action should be to block that communication path. Implementing IP-based firewall rules can immediately prevent the infected system from contacting the known malicious IP address and can disrupt the malware's operation. Network segmentation is broader and slower to implement, MDM is unrelated, and content filter is not the most direct first response to a known C2 connection.

• Question 984:

  A company's end users are reporting that they are unable to reach external websites. After reviewing the performance data for the DNS severs, the analyst discovers that the CPU, disk, and memory usage are minimal, but the network interface is flooded with inbound traffic. Network logs show only a small number of DNS queries sent to this server.

  Which of the following best describes what the security analyst is seeing?

  A. Concurrent session usage
  B. Secure DNS cryptographic downgrade
  C. On-path resource consumption
  D. Reflected denial of service
  D. Reflected denial of service

  ---

  Explanation

  A reflected denial of service (RDoS) attack is a type of DDoS attack that uses spoofed source IP addresses to send requests to a third-party server, which then sends responses to the victim server. The attacker exploits the difference in size between the request and the response, which can amplify the amount of traffic sent to the victim server. The attacker also hides their identity by using the victim's IP address as the source. A RDoS attack can target DNS servers by sending forged DNS queries that generate large DNS responses. This can flood the network interface of the DNS server and prevent it from serving legitimate requests from end users.

  References:

  CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 215-216

• Question 985:

  Which of the following should a security team use to document persistent vulnerabilities with related recommendations?

  A. Audit report
  B. Risk register
  C. Compliance report
  D. Penetration test
  B. Risk register

  ---

  Explanation

  A risk register is a document used to track and manage risks, including persistent vulnerabilities. It includes details about each vulnerability, its potential impact, the likelihood of its occurrence, and recommendations for mitigating or managing the risk. The risk register serves as a tool to prioritize and address ongoing security issues systematically.

• Question 986:

  A company hired an external consultant to assist with required system upgrades to a critical business application. A systems administrator needs to secure the consultant's access without sharing passwords to critical systems.

  Which of the following solutions should most likely be utilized?

  A. TACACS+
  B. SAML
  C. An SSO platform
  D. Role-based access control
  E. PAM software
  E. PAM software

• Question 987:

  Which of the following describes a security alerting and monitoring tool that collects system, application, and network logs from multiple sources in a centralized system?

  A. SIEM
  B. DLP
  C. IDS
  D. SNMP
  A. SIEM

  ---

  Explanation

  SIEM stands for Security Information and Event Management. It is a security alerting and monitoring tool that collects system, application, and network logs from multiple sources in a centralized system. SIEM can analyze the collected data, correlate events, generate alerts, and provide reports and dashboards. SIEM can also integrate with other security tools and support compliance requirements. SIEM helps organizations to detect and respond to cyber threats, improve security posture, and reduce operational costs.

  References:

  10: Monitoring and Auditing, page 393. CompTIA Security+ Practice Tests: Exam SY0-701, 3rd Edition, Chapter

  10: Monitoring and Auditing, page 397.

• Question 988:

  Which of the following best protects sensitive data in transit across a geographically dispersed Infrastructure?

  A. Encryption
  B. Masking
  C. Tokenization
  D. Obfuscation
  A. Encryption

• Question 989:

  A company is concerned with supply chain compromise of new servers and wants to limit this risk.

  Which of the following should the company review first?

  A. Sanitization procedure
  B. Acquisition process
  C. Change management
  D. Asset tracking
  B. Acquisition process

• Question 990:

  A company expects its provider to ensure servers and networks maintain 97% uptime.

  Which of the following would most likely list this expectation?

  A. BPA
  B. MOU
  C. NDA
  D. SLA
  D. SLA

  ---

  Explanation

  An SLA (Service-Level Agreement) defines the expected performance, availability, uptime, response times, and responsibilities between a provider and a client. The requirement in the scenario-"97% uptime"-is a classic example of an SLA metric. Security+ SY0-701 emphasizes that SLAs outline measurable service expectations so the client can assess compliance and performance.

  A BPA (A) outlines business partnership terms, not performance uptime. An MOU (B) documents mutual understanding but is not legally binding and does not include uptime metrics. An NDA (C) protects confidentiality, not availability or service guarantees.

  Thus, the correct answer is D: SLA.