View Full CompTIA SY0-701 Exam Dumps and Practice Test Dumps.

 

Question 101

Which security principle requires access decisions to be continuously evaluated rather than automatically trusted?

1. Zero Trust
2. Open access
3. Implicit trust
4. Network neutrality

Correct Answer: 1

Explanation

Zero Trust requires organizations to verify and authorize access requests rather than automatically trusting users or devices based on their location. Access can be evaluated using identity, device status, authentication strength, and other contextual information. This approach helps reduce the risk of unauthorized access following a compromised account or device.

Question 102

Which protocol is commonly used to securely retrieve email messages from a mail server?

1. FTP
2. IMAPS
3. Telnet
4. TFTP

Correct Answer: 2

Explanation

Internet Message Access Protocol Secure (IMAPS) provides encrypted communication between an email client and an IMAP server. It helps protect email credentials and message contents while they are transmitted across a network. Secure email protocols are important when users access organizational mail services over untrusted networks.

Question 103

Which type of attack attempts to overwhelm a wireless access point by sending a large number of authentication requests?

1. Wireless deauthentication attack
2. SQL injection
3. Credential stuffing
4. Directory traversal

Correct Answer: 1

Explanation

A wireless deauthentication attack sends forged deauthentication frames to disconnect clients from a wireless network. Attackers may use this technique to disrupt wireless communications or encourage clients to reconnect so that authentication traffic can be observed. Strong wireless security configurations and monitoring can help identify suspicious wireless activity.

Question 104

Which security control provides a duplicate system that can immediately take over when the primary system fails?

1. Redundancy
2. Tokenization
3. Obfuscation
4. Sandboxing

Correct Answer: 1

Explanation

Redundancy uses additional systems or components to maintain availability when a primary component fails. Examples include redundant servers, network links, power supplies, and storage devices. Redundancy reduces the risk that a single point of failure will cause a service interruption.

Question 105

Which type of malware secretly provides an attacker with privileged access to an operating system?

1. Rootkit
2. Adware
3. Worm
4. Logic bomb

Correct Answer: 1

Explanation

A rootkit is malware designed to maintain unauthorized access while hiding its presence from users and security tools. Rootkits can modify system components or use privileged access to conceal malicious processes and files. Detecting rootkits may require specialized security tools, integrity monitoring, and analysis of system behavior.

Question 106

Which security practice involves removing unnecessary services and applications from a system to reduce its attack surface?

1. System hardening
2. Data replication
3. Network tunneling
4. Load balancing

Correct Answer: 1

Explanation

System hardening reduces the attack surface by disabling unnecessary services, removing unused applications, changing default configurations, and applying appropriate security settings. A hardened system provides fewer opportunities for attackers to exploit weaknesses. Hardening should be performed consistently and reviewed whenever system requirements change.

Question 107

Which type of attack involves secretly observing a person entering sensitive information into a device?

1. Shoulder surfing
2. Tailgating
3. Pretexting
4. Pharming

Correct Answer: 1

Explanation

Shoulder surfing occurs when an attacker observes a user entering sensitive information such as a password, PIN, or authentication code. This attack can occur in public areas, offices, or other locations where screens and keyboards are visible. Privacy screens, careful positioning, and awareness of nearby individuals can help reduce this risk.

Question 108

Which technology can be used to create an isolated environment for executing potentially malicious software?

1. Sandbox
2. Proxy server
3. Load balancer
4. VPN gateway

Correct Answer: 1

Explanation

A sandbox provides an isolated environment in which applications or files can be executed without directly affecting the primary operating environment. Security teams can use sandboxes to analyze suspicious files and observe their behavior. Isolation helps reduce the potential damage caused by malicious code during analysis.

Question 109

Which security control can detect suspicious email attachments before they reach an organization’s users?

1. Secure email gateway
2. Network switch
3. DHCP server
4. File server

Correct Answer: 1

Explanation

A secure email gateway examines incoming and outgoing email traffic for threats such as malware, phishing messages, malicious attachments, and suspicious links. It can apply filtering policies and quarantine potentially dangerous messages before they reach users. This provides an important layer of protection against email-based attacks.

Question 110

Which type of attack involves an attacker impersonating an authorized employee to gain physical access to a restricted facility?

1. Impersonation
2. SQL injection
3. Credential stuffing
4. DNS poisoning

Correct Answer: 1

Explanation

Impersonation occurs when an attacker pretends to be another person in order to obtain access, information, or assistance. In a physical security scenario, an attacker may pretend to be an employee, contractor, or technician. Strong identification procedures, access badges, visitor controls, and employee awareness can help prevent impersonation attacks.

Question 111

Which security control is used to identify abnormal patterns of behavior that may indicate a compromised account?

1. User and Entity Behavior Analytics
2. Network address translation
3. Data compression
4. RAID

Correct Answer: 1

Explanation

User and Entity Behavior Analytics (UEBA) analyzes the normal behavior of users and systems and identifies unusual activity. For example, an account that suddenly accesses large amounts of sensitive data or logs in from unusual locations may generate an alert. UEBA can help security teams identify compromised accounts and insider threats.

Question 112

Which type of vulnerability allows an attacker to access resources by modifying a URL or object identifier?

1. Insecure direct object reference
2. Buffer overflow
3. Race condition
4. Cross-site scripting

Correct Answer: 1

Explanation

An insecure direct object reference (IDOR) occurs when an application exposes a reference to an internal object without properly verifying whether the requesting user is authorized to access it. An attacker may modify an identifier in a URL or request and access another user’s information. Proper authorization checks must be performed for every protected resource.

Question 113

Which security mechanism allows a user to prove possession of a private key without revealing the private key itself?

1. Digital signature
2. Password hash
3. Data masking
4. Tokenization

Correct Answer: 1

Explanation

A digital signature is created using a private key and can be verified using the corresponding public key. The private key remains secret while the signature provides evidence that the signer possessed the associated private key. Digital signatures can provide authentication, integrity, and non-repudiation for digitally signed information.

Question 114

Which type of attack attempts to make a legitimate user access a malicious website by compromising the user’s local DNS information?

1. Pharming
2. Smishing
3. Vishing
4. Tailgating

Correct Answer: 1

Explanation

Pharming redirects users to fraudulent websites even when they believe they are accessing a legitimate destination. Attackers may manipulate DNS information or other name-resolution mechanisms to redirect traffic. Secure DNS practices, endpoint protection, and certificate validation can help reduce the risk of pharming attacks.

Question 115

Which security control is specifically intended to detect changes to a system’s configuration from an approved baseline?

1. Configuration monitoring
2. Load balancing
3. Network translation
4. Data deduplication

Correct Answer: 1

Explanation

Configuration monitoring compares a system’s current configuration against an established secure baseline. Unexpected changes can indicate unauthorized activity, malware, or accidental misconfiguration. Continuous configuration monitoring allows administrators to identify deviations and restore systems to approved security settings.

Question 116

Which type of authentication uses a physical device such as a smart card or hardware security key?

1. Something you have
2. Something you know
3. Something you are
4. Somewhere you are

Correct Answer: 1

Explanation

A physical authentication device represents the “something you have” authentication factor. Examples include smart cards, hardware security keys, and certain authentication tokens. Combining a possession factor with another factor, such as a password or biometric characteristic, can provide multifactor authentication.

Question 117

Which security technique separates sensitive workloads from less trusted workloads using virtualization or other isolation mechanisms?

1. Segmentation
2. Password synchronization
3. Data compression
4. Credential federation

Correct Answer: 1

Explanation

Segmentation separates systems, workloads, or network resources into controlled security boundaries. This can limit communication between sensitive and less trusted environments and reduce lateral movement during an attack. Segmentation may be implemented through VLANs, firewalls, virtual networks, or other isolation technologies.

Question 118

Which incident response activity focuses on determining the underlying reason a security incident occurred?

1. Root cause analysis
2. Data destruction
3. User provisioning
4. Network addressing

Correct Answer: 1

Explanation

Root cause analysis identifies the underlying condition or weakness that allowed an incident to occur. Security teams may examine logs, configurations, vulnerabilities, and attacker activity to determine the cause. Identifying the root cause helps organizations implement corrective measures and reduce the likelihood of similar incidents happening again.

Question 119

Which security control is designed to deceive attackers by presenting an attractive but monitored target?

1. Honeypot
2. Firewall
3. Proxy
4. VPN

Correct Answer: 1

Explanation

A honeypot is a deliberately configured system or resource designed to attract and monitor attackers. It does not normally contain legitimate business functions, making activity against it potentially suspicious. Security teams can use honeypots to gather information about attack techniques and detect unauthorized activity.

Question 120

Which business continuity metric measures the average time required to repair a system after a failure?

1. RPO
2. RTO
3. MTTR
4. MTBF

Correct Answer: 3

Explanation

Mean Time to Repair (MTTR) measures the average amount of time required to restore a failed system or component to working condition. A lower MTTR generally indicates that an organization can recover from failures more quickly. Organizations use MTTR as a performance metric when evaluating maintenance procedures, incident response, and recovery capabilities.