CompTIA CompTIA Certifications SY0-701 Questions & Answers

• Question 91:

  The security operations center is researching an event concerning a suspicious IP address. A security analyst looks at the following event logs and discovers that a significant portion of the user accounts have experienced faded log-In attempts when authenticating from the same IP address:

  

  Which of the following most likely describes attack that took place?

  A. Spraying

  B. Brute-force

  C. Dictionary

  D. Rainbow table

  Correct Answer: A

  Password spraying is a type of attack where an attacker tries a small number of commonly used passwords across a large number of accounts. The event logs showing failed login attempts for many user accounts from the same IP address

  are indicative of a password spraying attack, where the attacker is attempting to gain access by guessing common passwords.

  References: CompTIA Security+ SY0-701 study materials, particularly in the domain of identity and access management and common attack vectors like password spraying.

• Question 92:

  A systems administrator is working on a defense-in-depth strategy and needs to restrict activity from employees after hours. Which of the following should the systems administrator implement?

  A. Role-based restrictions

  B. Attribute-based restrictions

  C. Mandatory restrictions

  D. Time-of-day restrictions

  Correct Answer: D

  To restrict activity from employees after hours, the systems administrator should implement time-of-day restrictions. This method allows access to network resources to be limited to specific times, ensuring that employees can only access

  systems during approved working hours. This is an effective part of a defense-in-depth strategy to mitigate risks associated with unauthorized access during off-hours, which could be a time when security monitoring might be less stringent.

  Time-of-day restrictions: These control access based on the time of day, preventing users from logging in or accessing certain systems outside of designated hours.

  Role-based restrictions: Control access based on a user's role within the organization.

  Attribute-based restrictions: Use various attributes (such as location, department, or project) to determine access rights.

  Mandatory restrictions: Typically refer to non-discretionary access controls, such as those based on government or organizational policy. Reference: CompTIA Security+ SY0-701 Exam Objectives, Domain 4.6 - Implement and maintain

  identity and access management (Access controls: Time-of-day restrictions).

• Question 93:

  To improve the security at a data center, a security administrator implements a CCTV system and posts several signs about the possibility of being filmed. Which of the following best describe these types of controls? (Select two).

  A. Preventive

  B. Deterrent

  C. Corrective

  D. Directive

  E. Compensating

  F. Detective

  Correct Answer: BF

  The CCTV system and signs about the possibility of being filmed serve as both deterrent and detective controls.

  Deterrent controls: Aim to discourage potential attackers from attempting unauthorized actions. Posting signs about CCTV serves as a deterrent by warning individuals that their actions are being monitored. Detective controls: Identify and

  record unauthorized or suspicious activity. The CCTV system itself functions as a detective control by capturing and recording footage that can be reviewed later.

  Preventive controls: Aim to prevent security incidents but are not directly addressed by the CCTV and signs in this context.

  Corrective controls: Aim to correct or mitigate the impact of a security incident. Directive controls: Provide guidelines or instructions but are not directly addressed by the CCTV and signs.

  Compensating controls: Provide alternative measures to compensate for the absence or failure of primary controls.

  Reference: CompTIA Security+ SY0-701 Exam Objectives, Domain 1.1 - Compare and contrast various types of security controls (Deterrent and detective controls).

• Question 94:

  A company is utilizing an offshore team to help support the finance department. The company wants to keep the data secure by keeping it on a company device but does not want to provide equipment to the offshore team. Which of the following should the company implement to meet this requirement?

  A. VDI

  B. MDM

  C. VPN

  D. VPC

  Correct Answer: A

  Virtual Desktop Infrastructure (VDI) allows a company to host desktop environments on a centralized server. Offshore teams can access these virtual desktops remotely, ensuring that sensitive data stays within the company's infrastructure

  without the need to provide physical devices to the team. This solution is ideal for maintaining data security while enabling remote work, as all data processing occurs on the company's secure servers.

  References:

  CompTIA Security+ SY0-701 Course Content: VDI is discussed as a method for securely managing remote access to company resources without compromising data security.

• Question 95:

  An external vendor recently visited a company's headquarters tor a presentation. Following the visit a member of the hosting team found a file that the external vendor left behind on a server. The file contained detailed architecture information and code snippets. Which of the following data types best describes this file?

  A. Government

  B. Public

  C. Proprietary

  D. Critical

  Correct Answer: C

  The file left by the external vendor, containing detailed architecture information and code snippets, is best described as proprietary data. Proprietary data is information that is owned by a company and is essential to its competitive advantage. It includes sensitive business information such as trade secrets, intellectual property, and confidential data that should be protected from unauthorized access. References: CompTIA Security+ SY0-701 study materials, particularly in the domain of data classification and protection.

• Question 96:

  A systems administrator notices that one of the systems critical for processing customer transactions is running an end-of-life operating system. Which of the following techniques would increase enterprise security?

  A. Installing HIDS on the system

  B. Placing the system in an isolated VLAN

  C. Decommissioning the system

  D. Encrypting the system's hard drive

  Correct Answer: B

  To enhance security for a system running an end-of-life operating system, placing the system in an isolated VLAN is the most effective approach. By isolating the system from the rest of the network, you can limit its exposure to potential threats while maintaining its functionality. This segmentation helps protect the rest of the network from any vulnerabilities in the outdated system. Installing HIDS (Host-based Intrusion Detection System) can help detect intrusions but won't mitigate the risks posed by an unsupported OS. Decommissioning may not be feasible if the system is critical. Encrypting the system's hard drive protects data at rest but doesn't address vulnerabilities from an outdated OS.

• Question 97:

  An organization recently started hosting a new service that customers access through a web portal. A security engineer needs to add to the existing security devices a new solution to protect this new service. Which of the following is the engineer most likely to deploy?

  A. Layer 4 firewall

  B. NGFW

  C. WAF

  D. UTM

  Correct Answer: C

  The security engineer is likely to deploy a Web Application Firewall (WAF) to protect the new web portal service. A WAF specifically protects web applications by filtering, monitoring, and blocking HTTP requests based on a set of rules. This is crucial for preventing common attacks such as SQL injection, cross-site scripting (XSS), and other web-based attacks that could compromise the web service. Layer 4 firewall operates primarily at the transport layer, focusing on IP address and port filtering, making it unsuitable for web application-specific threats. NGFW (Next-Generation Firewall) provides more advanced filtering than traditional firewalls, including layer 7 inspection, but the WAF is tailored specifically for web traffic. UTM (Unified Threat Management) offers a suite of security tools in one package (like antivirus, firewall, and content filtering), but for web application-specific protection, a WAF is the best fit.

• Question 98:

  A security audit of an organization revealed that most of the IT staff members have domain administrator credentials and do not change the passwords regularly. Which of the following solutions should the security learn propose to resolve the findings in the most complete way?

  A. Creating group policies to enforce password rotation on domain administrator credentials

  B. Reviewing the domain administrator group, removing all unnecessary administrators, and rotating all passwords

  C. Integrating the domain administrator's group with an IdP and requiring SSO with MFA for all access

  D. Securing domain administrator credentials in a PAM vault and controlling access with role-based access control

  Correct Answer: D

  Using a Privileged Access Management (PAM) vault to secure domain administrator credentials and enforcing role-based access control (RBAC) is the most comprehensive solution. PAM systems help manage and control access to

  privileged accounts, ensuring that only authorized personnel can access sensitive credentials. This approach also facilitates password rotation, auditing, and ensures that credentials are not misused or left unchanged. Integrating PAM with

  RBAC ensures that access is granted based on the user's role, further enhancing security.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 05 Security Program Management and Oversight.

  CompTIA Security+ SY0-601 Study Guide: Chapter on Identity and Access Management.

• Question 99:

  An IT security team is concerned about the confidentiality of documents left unattended in MFPs. Which of the following should the security team do to mitigate the situation?

  A. Educate users about the importance of paper shredder devices.

  B. Deploy an authentication factor that requires ln-person action before printing.

  C. Install a software client m every computer authorized to use the MFPs.

  D. Update the management software to utilize encryption.

  Correct Answer: B

  To mitigate the risk of confidential documents being left unattended in Multi- Function Printers (MFPs), implementing an authentication factor that requires in-person action before printing (such as PIN codes or badge scanning) is the most effective measure. This ensures that documents are only printed when the authorized user is present to collect them, reducing the risk of sensitive information being exposed. References: CompTIA Security+ SY0-701 study materials, particularly in the domain of physical security and access control.

• Question 100:

  Which of the following explains why an attacker cannot easily decrypt passwords using a rainbow table attack?

  A. Digital signatures

  B. Salting

  C. Hashing

  D. Perfect forward secrecy

  Correct Answer: B

  Salting is a technique used to enhance the security of hashed passwords by adding a unique, random value (salt) to each password before hashing it. This prevents attackers from easily decrypting passwords using rainbow tables, which are

  precomputed tables for reversing cryptographic hash functions. Since each password has a unique salt, the same password will produce different hash values, making rainbow table attacks ineffective.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 04 Security Operations. CompTIA Security+ SY0-601 Study Guide: Chapter on Cryptography and Hashing Techniques.