View Full CompTIA SY0-701 Exam Dumps and Practice Test Dumps.

 

Question 261

Which security technology is designed to identify and respond to suspicious activity across endpoints such as laptops and workstations?

1. DNS
2. EDR
3. DHCP
4. NAT

Correct Answer: 2

Explanation

Endpoint Detection and Response (EDR) is a security technology designed to continuously monitor and protect endpoints such as laptops, desktops, and workstations. It collects information about activities occurring on these devices, including processes, files, network connections, and user behavior. EDR can identify unusual or suspicious activities that may indicate malware, ransomware, or unauthorized access. Once a threat is detected, it helps security teams investigate the incident and take appropriate action, such as isolating the affected device or stopping a malicious process. This makes EDR an important tool for detecting, investigating, and responding to security threats on endpoint devices.

Question 262

Which type of attack attempts to make a legitimate website unavailable by exhausting its resources?

1. Credential stuffing
2. Phishing
3. Directory traversal
4. Denial-of-service

Correct Answer: 4

Explanation

A Denial-of-Service (DoS) attack is a type of cyberattack designed to make a legitimate website, server, or online service unavailable to its intended users. The attacker sends a large number of requests or excessive traffic to the target system, consuming its available resources such as bandwidth, processing power, memory, or connection capacity. As these resources become exhausted, the system may slow down, stop responding, or become completely unavailable. This prevents legitimate users from accessing the website or service normally. DoS attacks mainly target the availability of information systems and are an important concern in cybersecurity because they can disrupt businesses and online services.

Question 263

Which security method uses a one-time code that becomes invalid after it is used?

1. SSO
2. RBAC
3. OTP
4. LDAP

Correct Answer: 3

Explanation

A One-Time Password (OTP) is a security method that provides a temporary code for authentication. The code is usually generated by an authentication system and is valid for only one login attempt or for a short period. Once the OTP is successfully used, it becomes invalid and cannot be reused. This helps protect accounts from unauthorized access, even if someone manages to obtain a previous code. OTPs are commonly sent through SMS, email, or generated by authentication applications and hardware tokens. Unlike a permanent password, an OTP changes regularly or expires quickly, making it much harder for attackers to use stolen authentication information.

Question 264

Which access control model allows resource owners to determine who can access their resources?

1. MAC
2. RBAC
3. Rule-based access
4. DAC

Correct Answer: 4

Explanation

Discretionary Access Control (DAC) is an access control model where the owner of a resource has the authority to decide who can access it and what permissions they receive. For example, a file owner can allow specific users to read, modify, or delete a file. DAC provides flexibility because permissions can be changed by the resource owner based on their requirements. However, this flexibility can also create security risks if permissions are assigned incorrectly. In contrast, Mandatory Access Control (MAC) uses centrally enforced security policies and classifications. Role-Based Access Control (RBAC) assigns permissions according to a user’s role or job responsibilities.

Question 265

Which security control can detect unauthorized changes to critical operating system files?

1. FIM
2. VPN
3. NAC
4. Proxy

Correct Answer: 1

Explanation

File Integrity Monitoring (FIM) is a security control used to detect unauthorized or unexpected changes to important files and directories. It monitors critical operating system files, configuration files, and other sensitive data by checking their attributes, contents, or cryptographic hashes. When a monitored file is modified, deleted, or replaced, FIM can generate an alert for security teams to investigate. This helps identify activities such as malware infections, unauthorized system modifications, or attempts to compromise a system. FIM is especially useful for protecting critical files because legitimate changes can be distinguished from suspicious modifications. Therefore, FIM is the correct answer for detecting unauthorized changes to critical operating system files.

Question 266

Which attack involves sending a fraudulent email that appears to come from a trusted organization?

1. Tailgating
2. Phishing
3. Wardriving
4. Shoulder surfing

Correct Answer: 2

Explanation

Phishing is a social engineering attack in which an attacker sends a fraudulent email or message that appears to come from a trusted organization, person, or service. The goal is to trick the victim into taking an unsafe action, such as revealing passwords, entering financial information, downloading a malicious attachment, or clicking a harmful link. Phishing messages often use urgent language, fake logos, or convincing websites to appear legitimate. Attackers may impersonate banks, companies, government agencies, or online services. Users should carefully check the sender’s address, links, and message content before responding. Phishing is one of the most common methods used to steal sensitive information.

Question 267

Which security technology can automatically isolate an infected endpoint from the network?

1. DNS server
2. Load balancer
3. EDR
4. DHCP server

Correct Answer: 3

Explanation

Endpoint Detection and Response (EDR) is a security technology that continuously monitors endpoint devices such as laptops, desktops, and workstations for suspicious or malicious activity. When an EDR system detects that an endpoint may be infected or compromised, it can automatically take response actions, including isolating the device from the network. Network isolation helps prevent malware from spreading to other systems or communicating with attackers. Security teams can then investigate the affected endpoint and remove the threat safely. EDR combines monitoring, detection, investigation, and response capabilities, making it an important security solution for protecting endpoint devices and limiting the impact of security incidents.

Question 268

Which type of encryption uses the same secret key for both encryption and decryption?

1. Asymmetric
2. Hashing
3. Tokenization
4. Symmetric

Correct Answer: 4

Explanation

Symmetric encryption is a type of encryption that uses the same secret key for both encrypting and decrypting data. The sender uses the key to convert readable information into encrypted ciphertext, while the receiver uses the same key to convert it back into its original form. Because the encryption and decryption processes are generally fast and efficient, symmetric encryption is commonly used to protect large amounts of data. However, the secret key must be securely shared and protected because anyone who obtains it may be able to decrypt the protected information. Common symmetric encryption algorithms include AES and ChaCha20, which are widely used in modern security systems.

Question 269

An attacker places malicious code into a website input field, causing the code to execute in another user’s browser. What attack is this?

1. XSS
2. SQL injection
3. Buffer overflow
4. Replay attack

Correct Answer: 1

Explanation

Cross-Site Scripting (XSS) is a web security attack in which an attacker injects malicious scripts into a vulnerable website or web application. These scripts are often inserted through input fields, comments, search boxes, or other areas that accept user-supplied content. When another user visits the affected page, the malicious code may execute in their browser as if it were trusted content from the website. Depending on the situation, XSS can be used to steal session information, capture sensitive data, modify webpage content, or perform actions on behalf of the victim. Proper input validation, output encoding, and security controls can help prevent XSS attacks in web applications.

Question 270

Which security practice establishes a known secure configuration that systems should be compared against?

1. Data masking
2. Security baseline
3. Tokenization
4. Network tunneling

Correct Answer: 2

Explanation

A security baseline is a predefined set of approved and secure configuration settings that systems should follow. It provides administrators with a standard for configuring operating systems, applications, network devices, and other systems securely. Once a baseline is established, administrators can compare the current configuration of a system against it to identify unauthorized changes, missing security settings, or other deviations. This helps organizations maintain consistent security across their environment and reduce potential vulnerabilities. Security baselines may include settings related to passwords, user permissions, firewalls, services, software, and system updates. Regular comparisons against the baseline help identify configuration problems before they create security risks.

Question 271

Which attack attempts to obtain access by trying a limited number of commonly used passwords against many accounts?

1. Password spraying
2. Brute force
3. Credential stuffing
4. Rainbow table attack

Correct Answer: 1

Explanation

Password spraying is an attack in which an attacker attempts a small number of commonly used or weak passwords against many different user accounts. The goal is to avoid account lockouts while finding accounts that use predictable passwords. For example, an attacker may try one common password against hundreds of accounts instead of repeatedly attacking a single account. This makes password spraying different from a traditional brute-force attack, which attempts many different password combinations against one account. Organizations can reduce the risk of password spraying by enforcing strong password policies, using multi-factor authentication (MFA), monitoring authentication attempts, and detecting unusual login patterns across multiple accounts.

Question 272

Which security protocol is commonly used to protect web traffic through encryption and authentication?

1. FTP
2. Telnet
3. TFTP
4. TLS

Correct Answer: 4

Explanation

Transport Layer Security (TLS) is a security protocol designed to protect data transmitted between systems over a network. It provides encryption, which prevents unauthorized parties from reading sensitive information while it is being transmitted. TLS also provides integrity protection, helping detect whether data has been modified during transmission. In addition, it supports authentication through digital certificates, allowing users to verify the identity of the communicating server. TLS is commonly used to secure websites through HTTPS, protecting information such as login credentials, payment details, and personal data. Modern web browsers and servers use current versions of TLS to provide secure communication over the internet.

Question 273

Which physical security control can prevent an unauthorized person from following an authorized employee through a secure entrance?

1. Bollard
2. Fence
3. Camera
4. Mantrap

Correct Answer: 4

Explanation

A mantrap is a physical security control designed to prevent unauthorized individuals from entering a restricted area by following an authorized person. It normally consists of a small controlled space with two doors. Typically, the first door must close before the second door can be opened, allowing security personnel or access-control systems to verify the person before entry. This helps prevent tailgating or piggybacking, where an unauthorized individual attempts to enter a secure facility by following someone with valid access. Mantraps are commonly used in locations that require strong physical security, such as data centers, government facilities, laboratories, and other restricted areas.

Question 274

Which security approach divides a network into smaller isolated sections to limit the spread of an attack?

1. Data aggregation
2. Load balancing
3. Network segmentation
4. Port forwarding

Correct Answer: 3

Explanation

Network segmentation is a security approach that divides a network into smaller, separate sections or zones. Each segment can contain systems with similar security requirements or functions, while access between segments can be controlled using firewalls, access control lists, or other security mechanisms. If an attacker successfully compromises one segment, segmentation can limit their ability to move laterally to other parts of the network. This helps reduce the potential impact of malware, ransomware, and other security incidents. Network segmentation is commonly used to separate servers, employee devices, guest networks, and sensitive systems. Proper segmentation improves security by limiting unnecessary communication between different network areas.

Question 275

Which type of malicious software disguises itself as legitimate software to trick a user into installing it?

1. Worm
2. Rootkit
3. Trojan
4. Spyware

Correct Answer: 3

Explanation

A Trojan, also known as a Trojan horse, is a type of malicious software that disguises itself as legitimate, useful, or harmless software. Attackers often rely on social engineering to convince users to download and install the Trojan. Once installed, the malware can perform various malicious activities depending on its design. It may steal sensitive information, monitor user activity, download additional malware, modify system settings, or provide unauthorized access to attackers. Unlike worms, Trojans generally do not automatically spread themselves from one system to another. Users can reduce the risk of Trojans by downloading software only from trusted sources, keeping security software updated, and avoiding suspicious links or attachments.

Question 276

Which security mechanism securely stores and manages cryptographic keys?

1. IDS
2. NAC
3. WAF
4. HSM

Correct Answer: 4

Explanation

A Hardware Security Module (HSM) is a specialized hardware device designed to securely generate, store, manage, and use cryptographic keys. Cryptographic keys are essential for protecting sensitive information through encryption and digital signatures, so keeping them secure is extremely important. An HSM provides dedicated hardware-based protection that helps prevent unauthorized access to or extraction of these keys. It can also perform cryptographic operations without exposing sensitive keys to normal applications or users. HSMs are commonly used by banks, governments, cloud services, and large organizations to protect important encryption keys and support secure authentication, digital certificates, encryption, and digital signing operations.

Question 277

Which type of attack exploits a vulnerability where the outcome depends on the timing or sequence of events?

1. Phishing
2. Race condition
3. DDoS
4. Pharming

Correct Answer: 2

Explanation

A race condition is a security or programming issue that occurs when the outcome of a system depends on the timing or order in which multiple operations are performed. If two or more processes access or modify the same resource at nearly the same time, an attacker may attempt to manipulate the timing to produce an unintended result. For example, an attacker could exploit a race condition to bypass an authorization check or modify data between the time it is checked and the time it is used. Race conditions can be difficult to detect because the problem may occur only under specific timing conditions. Secure synchronization and proper resource handling can help prevent them.

Question 278

Which security control helps ensure that employees cannot access systems after their accounts have been disabled?

1. Data classification
2. Network segmentation
3. File hashing
4. Account termination

Correct Answer: 4

Explanation

Account termination is a security practice that removes or disables a user’s access when the account is no longer required. This is especially important when an employee leaves an organization, changes roles, or no longer needs access to particular systems. Promptly disabling accounts helps prevent former employees or unauthorized individuals from using old credentials to access company resources. Effective account termination may include disabling the user’s account, revoking access permissions, removing authentication tokens, and recovering company devices or credentials. Organizations should have a formal offboarding process to ensure access is removed promptly and consistently. This reduces the risk of unauthorized access caused by inactive or forgotten accounts.

Question 279

Which security technology can identify suspicious network traffic by comparing it against known attack patterns?

1. UPS
2. VPN
3. RAID
4. IDS

Correct Answer: 4

Explanation

An Intrusion Detection System (IDS) is a security technology that monitors network or system activity to identify suspicious or potentially malicious behavior. A signature-based IDS can compare observed network traffic or activity against a database of known attack patterns, also called signatures. When traffic matches a known malicious pattern, the IDS can generate an alert for security personnel to investigate. IDS solutions can help detect activities such as known malware communication, exploitation attempts, and other recognized attacks. Unlike an Intrusion Prevention System (IPS), an IDS generally focuses on detection and alerting rather than automatically blocking the suspicious traffic. Regularly updating signatures helps an IDS recognize newer known threats.

Question 280

Which security objective is primarily concerned with preventing unauthorized disclosure of information?

1. Integrity
2. Confidentiality
3. Availability
4. Non-repudiation

Correct Answer: 2

Explanation

Confidentiality is a core security objective that focuses on preventing unauthorized individuals, systems, or processes from accessing or disclosing information. It ensures that sensitive data is available only to authorized parties who have a legitimate need to access it. Organizations use various security controls to maintain confidentiality, including encryption, access controls, authentication, permissions, and data classification. For example, encrypting sensitive files can prevent unauthorized people from reading the information even if they obtain the file. Confidentiality is one of the three main principles of the CIA triad, along with Integrity and Availability. Protecting confidentiality is especially important for personal, financial, business, and other sensitive information.