CompTIA CompTIA Security+ SY0-701 Questions & Answers

• Question 1:

  A security analyst needs to propose a remediation plan for each item in a risk register. The item with the highest priority requires employees to have separate logins for SaaS solutions and different password complexity requirements for each solution. Which of the following implementation plans will most likely resolve this security issue?

  A. Creating a unified password complexity standard

  B. Integrating each SaaS solution with the Identity provider

  C. Securing access to each SaaS by using a single wildcard certificate

  D. Configuring geofencing on each SaaS solution

  Correct Answer: B

  Integrating each SaaS solution with an Identity Provider (IdP) is the most effective way to address the security issue. This approach allows for Single Sign-On (SSO) capabilities, where users can access multiple SaaS applications with a

  single set of credentials while maintaining strong password policies across all services. It simplifies the user experience and ensures consistent security enforcement across different SaaS platforms.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 05 Security Program Management and Oversight.

  CompTIA Security+ SY0-601 Study Guide: Chapter on Identity and Access Management.

• Question 2:

  Which of the following would best explain why a security analyst is running daily vulnerability scans on all corporate endpoints?

  A. To track the status of patching installations

  B. To find shadow IT cloud deployments

  C. To continuously the monitor hardware inventory

  D. To hunt for active attackers in the network

  Correct Answer: A

  Running daily vulnerability scans on all corporate endpoints is primarily done to track the status of patching installations. These scans help identify any missing security patches or vulnerabilities that could be exploited by attackers. Keeping

  the endpoints up-to-date with the latest patches is critical for maintaining security. Finding shadow IT cloud deployments and monitoring hardware inventory are better achieved through other tools.

  Hunting for active attackers would typically involve more real-time threat detection methods than daily vulnerability scans.

• Question 3:

  During a recent company safety stand-down, the cyber-awareness team gave a presentation on the importance of cyber hygiene. One topic the team covered was best practices for printing centers. Which of the following describes an attack method that relates to printing centers?

  A. Whaling

  B. Credential harvesting

  C. Prepending

  D. Dumpster diving

  Correct Answer: D

  Dumpster diving is an attack method where attackers search through physical waste, such as discarded documents and printouts, to find sensitive information that has not been properly disposed of. In the context of printing centers, this could

  involve attackers retrieving printed documents containing confidential data that were improperly discarded without shredding or other secure disposal methods. This emphasizes the importance of proper disposal and physical security

  measures in cyber hygiene practices.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 04 Security Operations. CompTIA Security+ SY0-601 Study Guide: Chapter on Physical Security and Cyber Hygiene.

• Question 4:

  Which of the following is the first step to take when creating an anomaly detection process?

  A. Selecting events

  B. Building a baseline

  C. Selecting logging options

  D. Creating an event log

  Correct Answer: B

  The first step in creating an anomaly detection process is building a baseline of normal behavior within the system. This baseline serves as a reference point to identify deviations or anomalies that could indicate a security incident. By

  understanding what normal activity looks like, security teams can more effectively detect and respond to suspicious behavior.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 04 Security Operations. CompTIA Security+ SY0-601 Study Guide: Chapter on Monitoring and Baselines.

• Question 5:

  Which of the following phases of an incident response involves generating reports?

  A. Recovery

  B. Preparation

  C. Lessons learned

  D. Containment

  Correct Answer: C

  The lessons learned phase of an incident response process involves reviewing the incident and generating reports. This phase helps identify what went well, what needs improvement, and what changes should be made to prevent future

  incidents. Documentation and reporting are essential parts of this phase to ensure that the findings are recorded and used for future planning. Recovery focuses on restoring services and normal operations. Preparation involves creating plans

  and policies for potential incidents, not reporting.

  Containment deals with isolating and mitigating the effects of the incident, not generating reports.

• Question 6:

  Which of the following can a security director use to prioritize vulnerability patching within a company's IT environment?

  A. SOAR

  B. CVSS

  C. SIEM

  D. CVE

  Correct Answer: B

  The Common Vulnerability Scoring System (CVSS) is a standardized framework for assessing the severity of security vulnerabilities. It helps organizations prioritize vulnerability patching by providing a numerical score that reflects the

  potential impact and exploitability of a vulnerability. CVSS scores are used to gauge the urgency of patching vulnerabilities within a company's IT environment.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 05 Security Program Management and Oversight.

  CompTIA Security+ SY0-601 Study Guide: Chapter on Vulnerability Management.

• Question 7:

  An IT manager is increasing the security capabilities of an organization after a data classification initiative determined that sensitive data could be exfiltrated from the environment. Which of the following solutions would mitigate the risk?

  A. XDR

  B. SPF

  C. DLP

  D. DMARC

  Correct Answer: C

  To mitigate the risk of sensitive data being exfiltrated from the environment, the IT manager should implement a Data Loss Prevention (DLP) solution. DLP monitors and controls the movement of sensitive data, ensuring that unauthorized transfers are blocked and potential data breaches are prevented. XDR (Extended Detection and Response) is useful for threat detection across multiple environments but doesn't specifically address data exfiltration. SPF (Sender Policy Framework) helps prevent email spoofing, not data exfiltration. DMARC (Domain-based Message Authentication, Reporting and Conformance) also addresses email security and spoofing, not data exfiltration.

• Question 8:

  A systems administrator wants to implement a backup solution. The solution needs to allow recovery of the entire system, including the operating system, in case of a disaster. Which of the following backup types should the administrator consider?

  A. Incremental

  B. Storage area network

  C. Differential

  D. Image

  Correct Answer: D

  An image backup, also known as a full system backup, captures the entire contents of a system, including the operating system, applications, settings, and all data. This type of backup allows for a complete recovery of the system in case of a

  disaster, as it includes everything needed to restore the system to its previous state. This makes it the ideal choice for a systems administrator who needs to ensure the ability to recover the entire system, including the OS.

  References: CompTIA Security+ SY0-701 study materials, domain on Security Operations.

• Question 9:

  A website user is locked out of an account after clicking an email link and visiting a different website. Web server logs show the user's password was changed, even though the user did not change the password. Which of the following is the most likely cause?

  A. Cross-sue request forgery

  B. Directory traversal

  C. ARP poisoning

  D. SQL injection

  Correct Answer: A

  The scenario describes a situation where a user unknowingly triggers an unwanted action, such as changing their password, by clicking a malicious link. This is indicative of a Cross-Site Request Forgery (CSRF) attack, where an attacker

  tricks the user into executing actions they did not intend to perform on a web application in which they are authenticated.

  References: CompTIA Security+ SY0-701 study materials, particularly in the domain of web application security and common attack vectors like CSRF.

• Question 10:

  Which of the following is the final step of the modern response process?

  A. Lessons learned

  B. Eradication

  C. Containment D. Recovery

  Correct Answer: A

  The final step in the incident response process is "Lessons learned." This step involves reviewing and analyzing the incident to understand what happened, how it was handled, and what could be improved. The goal is to improve future

  response efforts and prevent similar incidents from occurring. It's essential for refining the incident response plan and enhancing overall security posture.

  References: CompTIA Security+ SY0-701 study materials, particularly in the domain of incident response and recovery.