CompTIA CompTIA Certifications SY0-701 Questions & Answers

• Question 21:

  A security analyst discovers that a large number of employee credentials had been stolen and were being sold on the dark web. The analyst investigates and discovers that some hourly employee credentials were compromised, but salaried employee credentials were not affected.

  Most employees clocked in and out while they were inside the building using one of the kiosks connected to the network. However, some clocked out and recorded their time after leaving to go home. Only those who clocked in and out while inside the building had credentials stolen. Each of the kiosks are on different floors, and there are multiple routers, since the business segments environments for certain business functions.

  Hourly employees are required to use a website called acmetimekeeping.com to clock in and out. This website is accessible from the internet. Which of the following is the most likely reason for this compromise?

  A. A brute-force attack was used against the time-keeping website to scan for common passwords.

  B. A malicious actor compromised the time-keeping website with malicious code using an unpatched vulnerability on the site, stealing the credentials.

  C. The internal DNS servers were poisoned and were redirecting acmetimekeeping.com to a malicious domain that intercepted the credentials and then passed them through to the real site.

  D. ARP poisoning affected the machines in the building and caused the kiosks to send a copy of all the submitted credentials to a malicious machine.

  Correct Answer: B

  The scenario suggests that only the employees who used the kiosks inside the building had their credentials compromised. Since the time-keeping website is accessible from the internet, it is possible that a malicious actor exploited an

  unpatched vulnerability in the site, allowing them to inject malicious code that captured the credentials of those who logged in from the kiosks. This is a common attack vector for stealing credentials from web applications.

  References:

  CompTIA Security+ SY0-701 Course Content: The course discusses web application vulnerabilities and how attackers can exploit them to steal credentials.

• Question 22:

  A growing company would like to enhance the ability of its security operations center to detect threats but reduce the amount of manual work required tor the security analysts. Which of the following would best enable the reduction in manual work?

  A. SOAR

  B. SIEM

  C. MDM

  D. DLP

  Correct Answer: A

  Security Orchestration, Automation, and Response (SOAR) systems help organizations automate repetitive security tasks, reduce manual intervention, and improve the efficiency of security operations. By integrating with various security tools, SOAR can automatically respond to incidents, helping to enhance threat detection while reducing the manual workload on security analysts. References: CompTIA Security+ SY0-701 study materials, particularly in the domain of security operations and automation technologies.

• Question 23:

  A manager receives an email that contains a link to receive a refund. After hovering over the link, the manager notices that the domain's URL points to a suspicious link. Which of the following security practices helped the manager to identify the attack?

  A. End user training

  B. Policy review

  C. URL scanning

  D. Plain text email

  Correct Answer: A

  The security practice that helped the manager identify the suspicious link is end-user training. Training users to recognize phishing attempts and other social engineering attacks, such as hovering over links to check the actual URL, is a

  critical component of an organization's security awareness program. End user training: Educates employees on how to identify and respond to security threats, including suspicious emails and phishing attempts. Policy review: Ensures that

  policies are understood and followed but does not directly help in identifying specific attacks.

  URL scanning: Automatically checks URLs for threats, but the manager identified the issue manually.

  Plain text email: Ensures email content is readable without executing scripts, but the identification in this case was due to user awareness.

  Reference: CompTIA Security+ SY0-701 Exam Objectives, Domain 5.6 - Implement security awareness practices (End-user training).

• Question 24:

  Which of the following is the most important security concern when using legacy systems to provide production service?

  A. Instability

  B. Lack of vendor support

  C. Loss of availability

  D. Use of insecure protocols

  Correct Answer: B

  The most important security concern when using legacy systems is the lack of vendor support. Without support from the vendor, systems may not receive critical security patches and updates, leaving them vulnerable to exploitation. This lack of support can result in increased risk of security breaches, as vulnerabilities discovered in the software may never be addressed. References: CompTIA Security+ SY0-701 study materials, particularly in the context of risk management and the challenges posed by legacy systems.

• Question 25:

  Which of the following security concepts is being followed when implementing a product that offers protection against DDoS attacks?

  A. Availability

  B. Non-repudiation

  C. Integrity

  D. Confidentiality

  Correct Answer: A

  When implementing a product that offers protection against Distributed Denial of Service (DDoS) attacks, the security concept being followed is availability. DDoS protection ensures that systems and services remain accessible to legitimate

  users even under attack, maintaining the availability of network resources. Availability: Ensures that systems and services are accessible when needed, which is directly addressed by DDoS protection. Non-repudiation: Ensures that actions or

  transactions cannot be denied by the involved parties, typically achieved through logging and digital signatures. Integrity: Ensures that data is accurate and has not been tampered with. Confidentiality:

  Ensures that information is accessible only to authorized individuals.

  Reference: CompTIA Security+ SY0-701 Exam Objectives, Domain 1.2 - Summarize fundamental security concepts (Availability).

• Question 26:

  A recent penetration test identified that an attacker could flood the MAC address table of network switches. Which of the following would best mitigate this type of attack?

  A. Load balancer

  B. Port security

  C. IPS

  D. NGFW

  Correct Answer: B

  Port security is the best mitigation technique for preventing an attacker from flooding the MAC address table of network switches. Port security can limit the number of MAC addresses learned on a port, preventing an attacker from

  overwhelming the switch's MAC table (a form of MAC flooding attack). When the allowed number of MAC addresses is exceeded, port security can block additional devices or trigger alerts. Load balancer distributes network traffic but does

  not address MAC flooding attacks.

  IPS (Intrusion Prevention System) detects and prevents attacks but isn't specifically designed for MAC flooding mitigation. NGFW (Next-Generation Firewall) offers advanced traffic inspection but is not directly involved in MAC table security.

• Question 27:

  Which of the following is the most effective way to protect an application server running software that is no longer supported from network threats?

  A. Air gap

  B. Barricade

  C. Port security

  D. Screen subnet

  Correct Answer: A

  Air-gapping is the most effective way to protect an application server running unsupported software from network threats. By physically isolating the server from any network connection (no wired or wireless communication), it is protected

  from external cyber threats. While other options like port security or a screened subnet can provide some level of protection, an air gap offers the highest level of security by preventing any network- based attacks entirely.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 03 Security Architecture. CompTIA Security+ SY0-601 Study Guide: Chapter on Secure System Design.

• Question 28:

  The Chief Information Security Officer of an organization needs to ensure recovery from ransomware would likely occur within the organization's agreed-upon RPOs end RTOs. Which of the following backup scenarios would best ensure recovery?

  A. Hourly differential backups stored on a local SAN array

  B. Dally full backups stored on premises in magnetic offline media

  C. Daly differential backups maintained by a third-party cloud provider

  D. Weekly full backups with daily incremental stored on a NAS drive

  Correct Answer: D

  A backup strategy that combines weekly full backups with daily incremental backups stored on a NAS (Network Attached Storage) drive is likely to meet an organization's Recovery Point Objectives (RPOs) and Recovery Time Objectives

  (RTOs). This approach ensures that recent data is regularly backed up and that recovery can be done efficiently, without significant data loss or lengthy downtime.

  References:

  CompTIA Security+ SY0-701 Course Content: Domain 05 Security Program Management and Oversight.

  CompTIA Security+ SY0-601 Study Guide: Chapter on Disaster Recovery and Backup Strategies.

• Question 29:

  Which of the following enables the use of an input field to run commands that can view or manipulate data?

  A. Cross-site scripting

  B. Side loading

  C. Buffer overflow

  D. SQL injection

  Correct Answer: D

  SQL injection is a type of attack that enables the use of an input field to run commands that can view or manipulate data in a database. SQL stands for Structured Query Language, which is a language used to communicate with databases.

  By injecting malicious SQL statements into an input field, an attacker can bypass authentication, access sensitive information, modify or delete data, or execute commands on the server. SQL injection is one of the most common and

  dangerous web application vulnerabilities.

  References: CompTIA Security+ Study Guide with over 500 Practice Test Questions: Exam SY0-701, 9th Edition, Chapter 5, page 195. CompTIA Security+ SY0-701 Exam Objectives, Domain 1.1, page 8.

• Question 30:

  Which of the following describes the understanding between a company and a client about what will be provided and the accepted time needed to provide the company with the resources?

  A. SLA

  B. MOU

  C. MOA

  D. BPA

  Correct Answer: A

  A Service Level Agreement (SLA) is a formal document between a service provider and a client that defines the expected level of service, including what resources will be provided and the agreed-upon time frames. It typically includes metrics to evaluate performance, uptime guarantees, and response times. MOU (Memorandum of Understanding) and MOA (Memorandum of Agreement) are less formal and may not specify the exact level of service. BPA (Business Partners Agreement) focuses more on the long-term relationship between partners.