View Full CompTIA SY0-701 Exam Dumps and Practice Test Dumps.

Question 361

Which security control is designed to identify unauthorized changes to critical system files?

1. DLP
2. FIM
3. NAC
4. WAF

Correct Answer: 2

Explanation

File Integrity Monitoring (FIM) is a security control used to detect changes made to important system files, configuration files, and other critical resources. FIM establishes a known baseline or trusted state and continuously monitors files for modifications. If a file is changed unexpectedly, the system can generate an alert for security personnel to investigate. This is useful for detecting malware activity, unauthorized configuration changes, tampering, or compromised systems. DLP focuses on preventing sensitive data loss, NAC controls network access, and WAF protects web applications. Therefore, FIM is the correct answer because its primary purpose is identifying unauthorized or unexpected changes to critical files.

Question 362

An attacker sends a large number of requests to a server until legitimate users can no longer access it. Which attack is this?

1. DDoS
2. Phishing
3. Credential stuffing
4. SQL injection

Correct Answer: 1

Explanation

A Distributed Denial-of-Service (DDoS) attack attempts to make a system, application, or network service unavailable to legitimate users by overwhelming it with excessive traffic or requests. In a typical DDoS attack, traffic may originate from many compromised devices, often called a botnet, making the attack difficult to block using a single source-based rule. The targeted server can become overloaded with requests and may be unable to process legitimate connections. Phishing targets users, credential stuffing uses stolen credentials, and SQL injection targets vulnerable applications and databases. Therefore, DDoS is the correct answer because the goal is to disrupt service availability.

Question 363

Which access control model allows resource owners to determine who can access their resources?

1. MAC
2. RBAC
3. DAC
4. ABAC

Correct Answer: 3

Explanation

Discretionary Access Control (DAC) allows the owner or creator of a resource to decide which users or groups can access that resource. The owner can typically assign permissions such as read, write, modify, or execute based on organizational requirements. DAC provides flexibility because resource owners have direct control over access decisions. Mandatory Access Control (MAC) uses centrally defined security classifications and policies, while Role-Based Access Control (RBAC) assigns permissions according to job roles. Attribute-Based Access Control (ABAC) uses attributes and conditions to make access decisions. Therefore, DAC is correct because it specifically gives resource owners discretion over permissions.

Question 364

Which protocol provides secure remote command-line access to a system?

1. FTP
2. Telnet
3. SSH
4. HTTP

Correct Answer: 3

Explanation

Secure Shell (SSH) is a network protocol designed to provide secure remote access to systems, especially for command-line administration. SSH encrypts communication between the client and server, helping protect usernames, passwords, commands, and other information from interception. It is commonly used by administrators to securely manage Linux and Unix-based servers and can also be used for secure file transfers and tunneling. Telnet also provides remote command-line access, but it transmits information without strong encryption and is therefore insecure for sensitive administration. FTP is primarily used for file transfers, while HTTP is used for web communication. Therefore, SSH is the correct answer.

Question 365

An attacker uses stolen usernames and passwords from a previous breach to access multiple unrelated websites. What attack is occurring?

1. Password spraying
2. Credential stuffing
3. Brute force
4. Shoulder surfing

Correct Answer: 2

Explanation

Credential stuffing is an attack in which criminals use previously stolen username and password combinations to attempt authentication against other websites or services. The attack depends on password reuse, because users sometimes use the same credentials across multiple accounts. If a username and password were exposed during one breach, an attacker may try those credentials on email, banking, shopping, social media, or corporate services. Password spraying is different because it attempts a small number of commonly used passwords against many accounts. Brute-force attacks systematically try many possible passwords, while shoulder surfing involves observing someone entering credentials. Therefore, credential stuffing is the correct answer.

Question 366

Which security concept requires organizations to use multiple layers of security controls?

1. Zero Trust
2. Defense in depth
3. Least privilege
4. Separation of duties

Correct Answer: 2

Explanation

Defense in depth is a security strategy that uses multiple layers of different security controls to protect systems, networks, applications, and data. The purpose is to ensure that if one security control fails or is bypassed, additional controls remain available to reduce the chance of compromise. For example, an organization may use firewalls, endpoint protection, network segmentation, access controls, encryption, monitoring, and user authentication together. Zero Trust focuses on continuous verification rather than automatic trust, least privilege limits permissions to what is necessary, and separation of duties divides responsibilities among individuals. Therefore, defense in depth is correct because it specifically emphasizes layered security protection.

Question 367

Which technology can prevent sensitive information such as credit card numbers from leaving an organization’s network?

1. DLP
2. IDS
3. VPN
4. HSM

Correct Answer: 1

Explanation

Data Loss Prevention (DLP) technology is designed to identify, monitor, and protect sensitive information from unauthorized disclosure or transmission. DLP solutions can inspect data in use, in motion, or at rest and may use predefined rules to identify sensitive information such as credit card numbers, Social Security numbers, confidential documents, or intellectual property. When a policy violation is detected, the system may alert administrators, block the transmission, quarantine the data, or require additional authorization. An IDS primarily detects suspicious activity, a VPN provides protected network communication, and an HSM securely manages cryptographic keys. Therefore, DLP is the correct answer because it focuses on preventing sensitive data loss.

Question 368

Which type of malware can replicate itself across networks without requiring a user to execute an infected file?

1. Trojan
2. Worm
3. Spyware
4. Rootkit

Correct Answer: 2

Explanation

A worm is a type of malware that can automatically replicate itself and spread from one system to another, often through network vulnerabilities or other weaknesses. Unlike many traditional malware infections, a worm does not necessarily require a user to manually execute an infected file. Once it gains access to a vulnerable system, it can continue scanning for additional targets and reproduce across the network. A Trojan disguises itself as legitimate software and generally relies on user execution. Spyware focuses on secretly collecting information, while a rootkit is designed to hide malicious activity and maintain privileged access. Therefore, worm is the correct answer because self-replication and autonomous network propagation are key characteristics.

Question 369

Which security solution monitors endpoint activity and can isolate a compromised device?

1. EDR
2. WAF
3. NAC
4. SIEM

Correct Answer: 1

Explanation

Endpoint Detection and Response (EDR) is a security solution designed to continuously monitor activity on endpoints such as workstations, laptops, and servers. EDR collects information about processes, files, network connections, and other endpoint behavior to identify suspicious or malicious activity. When a compromise is detected, EDR can provide response actions, including terminating malicious processes, removing threats, or isolating the affected endpoint from the network. A WAF protects web applications, NAC controls whether devices can connect to a network, and SIEM primarily collects and correlates security events from multiple sources. Therefore, EDR is correct because it specifically provides endpoint monitoring, detection, investigation, and response capabilities.

Question 370

Which attack occurs when an attacker secretly intercepts and potentially modifies communication between two parties?

1. MITM
2. DDoS
3. Buffer overflow
4. Password spraying

Correct Answer: 1

Explanation

A Man-in-the-Middle (MITM) attack occurs when an attacker secretly positions themselves between two communicating parties and intercepts the information being exchanged. Depending on the attack, the attacker may simply monitor communication or actively modify messages before forwarding them to the intended recipient. MITM attacks can target network connections, wireless communications, or other forms of data exchange when authentication or encryption is weak or improperly implemented. DDoS attacks focus on availability, buffer overflow attacks exploit memory-handling vulnerabilities, and password spraying targets authentication systems. Therefore, MITM is the correct answer because its defining characteristic is intercepting communication between two parties.

Question 371

Which security principle requires an organization to verify access requests rather than automatically trusting internal users?

1. Zero Trust
2. Open access
3. Implicit trust
4. Single sign-on

Correct Answer: 1

Explanation

Zero Trust is a security model based on the principle that no user, device, or connection should automatically be trusted simply because it is inside an organization’s network. Access requests should be continuously evaluated using factors such as identity, authentication status, device security, location, application, and organizational policy. Users receive only the access they are authorized to have, and access may be reevaluated when conditions change. This approach helps reduce the risk of compromised accounts and lateral movement by attackers. Open access and implicit trust assume fewer restrictions, while SSO is an authentication convenience rather than a complete security model. Therefore, Zero Trust is correct.

Question 372

Which control helps prevent unauthorized physical access to a restricted area by requiring an employee to present an identification credential?

1. Access badge
2. Bollard
3. Honeypot
4. Firewall

Correct Answer: 1

Explanation

An access badge is a physical security control used to identify and authorize employees or other approved individuals before they enter restricted areas. Badge systems commonly work with electronic readers that verify the credential and determine whether the person has permission to access a particular location. Organizations can also record badge activity to create an audit trail of physical access. A bollard is mainly used to block or control vehicles, a honeypot is a cybersecurity deception mechanism, and a firewall controls network traffic rather than physical entry. Therefore, an access badge is the correct answer because it provides identification and authorization for controlled physical access to secured areas.

Question 373

Which type of malware is designed to hide its presence by modifying or controlling low-level system functions?

1. Rootkit
2. Worm
3. Trojan
4. Adware

Correct Answer: 1

Explanation

A rootkit is a type of malicious software designed to hide its presence and maintain unauthorized privileged access to a system. Rootkits may modify operating system components, system processes, drivers, or other low-level functions so that malicious activity becomes difficult for users and security tools to detect. Some rootkits can hide files, processes, network connections, or other evidence of compromise. Worms are primarily known for self-replication and spreading, Trojans disguise malicious software as legitimate applications, and adware displays unwanted advertisements. Therefore, rootkit is the correct answer because stealth and concealment at a low system level are major characteristics of this malware type.

Question 374

Which authentication method provides users with a single set of credentials to access multiple authorized applications?

1. MFA
2. SSO
3. PAM
4. NAC

Correct Answer: 2

Explanation

Single Sign-On (SSO) allows a user to authenticate once and then access multiple authorized applications or services without repeatedly entering separate usernames and passwords. SSO can improve user convenience and productivity while also helping organizations centrally manage authentication policies. When properly implemented, it can reduce password fatigue and encourage stronger authentication practices. Multi-Factor Authentication (MFA) requires multiple authentication factors, but it does not necessarily provide access to multiple applications with one login. PAM manages privileged accounts and access, while NAC controls network access for devices and users. Therefore, SSO is the correct answer because its primary purpose is allowing one authentication session to access multiple authorized resources.

Question 375

Which technology is primarily used to protect email systems from malicious messages, phishing attempts, and spam?

1. Secure email gateway
2. HSM
3. VPN concentrator
4. Network switch

Correct Answer: 1

Explanation

A secure email gateway is a security solution that filters and analyzes email traffic entering and leaving an organization. It can identify and block common email-based threats such as spam, phishing messages, malicious attachments, dangerous links, and malware. Organizations can configure email security policies to quarantine suspicious messages, scan attachments, inspect URLs, and prevent certain types of sensitive information from being transmitted. An HSM is primarily used for cryptographic key protection, a VPN concentrator manages secure remote VPN connections, and a network switch connects devices within a network. Therefore, a secure email gateway is correct because it is specifically designed to protect email communication from malicious and unwanted content.

Question 376

An attacker sends a fake message pretending to be the user’s bank and asks for account information. Which social engineering attack is this?

1. Phishing
2. Tailgating
3. Shoulder surfing
4. Dumpster diving

Correct Answer: 1

Explanation

Phishing is a social engineering attack in which an attacker sends a deceptive message designed to appear as if it came from a trusted organization, person, or service. In this example, the attacker impersonates the user’s bank and attempts to convince the victim to provide sensitive account information. Phishing messages may also contain malicious links, attachments, or instructions that lead to credential theft or malware infection. Tailgating involves gaining unauthorized physical access by following an authorized person, shoulder surfing involves observing someone entering sensitive information, and dumpster diving involves searching discarded materials for useful information. Therefore, phishing is the correct answer.

Question 377

Which security assessment actively attempts to exploit vulnerabilities in a controlled environment?

1. Vulnerability scan
2. Penetration test
3. Risk assessment
4. Configuration review

Correct Answer: 2

Explanation

A penetration test is a controlled security assessment in which authorized security professionals actively attempt to exploit vulnerabilities in systems, applications, networks, or other environments. The goal is to determine whether identified weaknesses can actually be exploited and to understand their potential impact. Penetration testers may use techniques similar to those used by real attackers while following defined rules of engagement. A vulnerability scan primarily identifies and reports potential vulnerabilities without necessarily exploiting them. A risk assessment evaluates threats, vulnerabilities, likelihood, and impact, while a configuration review examines system settings. Therefore, penetration testing is correct because it actively attempts controlled exploitation.

Question 378

Which recovery metric defines the maximum acceptable amount of data that can be lost after an incident?

1. RTO
2. RPO
3. MTTR
4. MTBF

Correct Answer: 2

Explanation

Recovery Point Objective (RPO) defines the maximum amount of data an organization can afford to lose after a disruption, usually measured in time. For example, an organization with an RPO of one hour should have recovery mechanisms that allow it to restore data to a point no more than approximately one hour before the incident. RPO is closely related to backup and replication frequency. Recovery Time Objective (RTO) focuses on how quickly systems must be restored, while MTTR measures average repair or recovery time and MTBF measures the average time between failures. Therefore, RPO is correct because it specifically addresses acceptable data loss.

Question 379

Which recovery metric specifies how quickly a service should be restored after an outage?

1. RPO
2. RTO
3. MTBF
4. SLA

Correct Answer: 2

Explanation

Recovery Time Objective (RTO) specifies the maximum acceptable amount of time an organization can take to restore a system, application, or service after a disruption. It is an important business continuity and disaster recovery measurement because it helps organizations determine how quickly critical services must become operational again. For example, an application with an RTO of two hours should be restored within approximately two hours after an outage. RPO is concerned with the amount of acceptable data loss, not restoration speed. MTBF measures the average time between failures, while an SLA defines agreed service expectations. Therefore, RTO is the correct answer because it focuses on recovery time.

Question 380

Which security technology can inspect encrypted web traffic to detect malicious content when properly configured?

1. SSL/TLS inspection
2. MAC filtering
3. Port security
4. Tokenization

Correct Answer: 1

Explanation

SSL/TLS inspection is a security technology that allows an organization to inspect encrypted web traffic for malicious content, suspicious activity, or policy violations. Because HTTPS traffic is encrypted, security devices normally cannot examine the contents directly. With properly configured SSL/TLS inspection, the security system temporarily decrypts the traffic, analyzes it using security policies and inspection tools, and then re-encrypts it before sending it to the destination. This can help detect malware, malicious websites, and other threats hidden inside encrypted connections. MAC filtering controls device access, port security protects switch ports, and tokenization replaces sensitive data with tokens. Therefore, SSL/TLS inspection is correct.