View Full CompTIA SY0-701 Exam Dumps and Practice Test Dumps.

 

Question 301

Which security control is designed to detect and prevent unauthorized changes to system configurations?

1. Data masking
2. Network segmentation
3. Configuration monitoring
4. Tokenization

Correct Answer: 3

Explanation

Configuration monitoring compares current system settings against approved or predefined configurations and identifies unauthorized or unexpected changes. It can monitor operating systems, applications, network devices, and security settings. When a configuration deviates from the approved baseline, administrators can receive alerts and investigate the change. This control helps maintain system security, supports compliance requirements, and can identify potentially malicious modifications before they create larger security problems or system failures.

Question 302

Which type of attack attempts to use previously captured authentication information to gain unauthorized access?

1. DDoS attack
2. Phishing attack
3. Directory traversal
4. Replay attack

Correct Answer: 4

Explanation

A replay attack occurs when an attacker captures valid authentication information and retransmits it later to gain unauthorized access. The captured information might include authentication messages, session information, or other valid credentials. Attackers attempt to make the system believe the repeated information is a legitimate request. Security mechanisms such as timestamps, nonces, session expiration, and multifactor authentication can help reduce the effectiveness of replay attacks.

Question 303

Which security control can limit communication between devices based on their MAC addresses?

1. DNS filtering
2. MAC filtering
3. Content filtering
4. URL rewriting

Correct Answer: 2

Explanation

MAC filtering allows or denies network access based on the Media Access Control address assigned to a network device. It is commonly associated with wireless networks and can provide an additional layer of access control by specifying which devices are permitted to connect. However, MAC addresses can potentially be spoofed by attackers, so MAC filtering should not be considered a complete security solution. It works best alongside stronger authentication mechanisms.

Question 304

Which type of malware encrypts files and demands payment in exchange for restoring access?

1. Ransomware
2. Spyware
3. Rootkit
4. Adware

Correct Answer: 1

Explanation

Ransomware is malware that encrypts files or otherwise prevents victims from accessing important data and then demands payment for recovery. Ransomware can affect individual computers, servers, and entire organizational networks. Strong endpoint protection, security awareness, regular patching, and reliable backups can reduce its impact. Offline or immutable backups are particularly valuable because they can allow organizations to restore affected systems without depending on the attacker’s promises.

Question 305

Which security concept ensures that an organization’s systems remain operational despite the failure of individual components?

1. Confidentiality
2. Tokenization
3. Non-repudiation
4. Redundancy

Correct Answer: 4

Explanation

Redundancy involves providing duplicate or alternative components so that the failure of one component does not necessarily interrupt an organization’s services. Examples include redundant servers, network connections, power supplies, storage devices, and internet connections. Redundancy is an important part of maintaining availability and business continuity. If one component fails, another component can continue providing the required service, reducing downtime and helping organizations maintain critical operations.

Question 306

Which type of social engineering attack uses a fraudulent email that specifically targets a particular individual or organization?

1. Smishing
2. Spear phishing
3. Vishing
4. Tailgating

Correct Answer: 2

Explanation

Spear phishing is a targeted form of phishing in which attackers research a specific individual, department, or organization before creating a fraudulent message. Attackers may use the victim’s name, job title, company information, or current projects to make the email appear legitimate. The goal may be stealing credentials, delivering malware, or convincing the victim to transfer information or money. Awareness training and careful verification can reduce this risk.

Question 307

Which security technology provides centralized control and monitoring of privileged administrator credentials?

1. NAC
2. IDS
3. PAM
4. WAF

Correct Answer: 3

Explanation

Privileged Access Management (PAM) is designed to secure accounts that have elevated permissions within an organization. PAM solutions can securely store administrator credentials, control privileged access, monitor administrative sessions, rotate passwords, and provide temporary access when required. These capabilities help reduce the risk associated with compromised administrator accounts. Because privileged accounts can make significant system changes, controlling and monitoring their use is an important security practice.

Question 308

Which security control can help prevent unauthorized users from connecting removable storage devices to corporate endpoints?

1. Device control
2. DNSSEC
3. Load balancing
4. Network address translation

Correct Answer: 1

Explanation

Device control allows organizations to manage and restrict the use of peripheral devices connected to corporate endpoints. For example, administrators can block unauthorized USB storage devices or allow only approved devices to connect. This helps reduce the risk of sensitive data being copied to removable media and prevents malware from being introduced through untrusted devices. Device control is especially useful when combined with endpoint security and organizational data protection policies.

Question 309

Which cryptographic function creates a unique digest that can be used to verify whether data has changed?

1. Encryption
2. Tokenization
3. Encoding
4. Hashing

Correct Answer: 4

Explanation

Hashing converts input data into a fixed-length value known as a hash or digest. When the original data changes, its resulting hash will normally also change, making hashing useful for verifying data integrity. Hashing is commonly used to verify downloaded files, store passwords securely when appropriate algorithms are used, and detect unauthorized modifications. Unlike encryption, hashing is generally designed as a one-way function rather than reversible protection.

Question 310

Which security technology can block access to websites categorized as malicious, inappropriate, or unauthorized?

1. HSM
2. Web content filter
3. RAID
4. KVM

Correct Answer: 2

Explanation

A web content filter examines website requests and can block access based on categories, reputation scores, URLs, domains, or organizational security policies. Organizations can use content filtering to prevent users from accessing malicious websites, inappropriate material, phishing pages, or other unauthorized destinations. This technology can reduce exposure to web-based threats and support acceptable-use policies. It is commonly deployed through security gateways, endpoint agents, DNS services, or network security platforms.

Question 311

Which attack attempts to exploit a web application by accessing files outside the application’s intended directory?

1. SQL injection
2. Password spraying
3. Directory traversal
4. Credential stuffing

Correct Answer: 3

Explanation

A directory traversal attack attempts to manipulate file paths so that a vulnerable application accesses files or directories outside its intended location. Attackers may try specially crafted path information to reach sensitive operating system or application files. Proper input validation, secure file-handling practices, access controls, and restricting application permissions can help prevent this vulnerability. Applications should never assume that user-supplied file paths are safe without appropriate validation and controls.

Question 312

Which security mechanism allows users to authenticate once and access multiple authorized services?

1. SSO
2. NAC
3. FIM
4. DLP

Correct Answer: 1

Explanation

Single Sign-On (SSO) allows users to authenticate through a centralized identity provider and then access multiple authorized applications without repeatedly entering their credentials. This can improve user convenience while allowing organizations to manage authentication centrally. SSO can also simplify account management and support centralized security policies. However, protecting the primary identity account is extremely important because compromise of that account could potentially provide access to multiple connected services.

Question 313

Which security control is primarily used to protect a network from unauthorized inbound and outbound traffic?

1. File server
2. Patch panel
3. Load balancer
4. Firewall

Correct Answer: 4

Explanation

A firewall evaluates network traffic against configured security rules and determines whether connections should be allowed or denied. Firewalls can control traffic based on factors such as source and destination addresses, ports, protocols, applications, and other characteristics. They are commonly deployed at network boundaries and between internal security zones. Proper firewall configuration helps reduce unauthorized access, limit unnecessary communication, and provide an important layer of network security.

Question 314

Which attack involves an attacker secretly positioning themselves between two communicating parties?

1. Brute force
2. Man-in-the-middle
3. Logic bomb
4. Dumpster diving

Correct Answer: 2

Explanation

A man-in-the-middle attack occurs when an attacker secretly intercepts communication between two parties. The attacker may attempt to monitor, capture, or modify information while making each party believe they are communicating directly with the other. Encryption, certificate validation, secure protocols, and proper authentication can help protect against these attacks. Users should also avoid connecting to untrusted networks when transmitting sensitive information.

Question 315

Which security objective ensures that information is protected from unauthorized modification?

1. Availability
2. Confidentiality
3. Integrity
4. Authentication

Correct Answer: 3

Explanation

Integrity ensures that information remains accurate, complete, and protected from unauthorized modification or destruction. Security mechanisms such as cryptographic hashes, digital signatures, access controls, and file integrity monitoring can help maintain data integrity. Confidentiality focuses on preventing unauthorized disclosure, while availability ensures that authorized users can access resources when needed. Maintaining integrity is especially important for financial records, system configurations, databases, and other critical organizational information.

Question 316

Which type of security control is designed to discourage an individual from attempting unauthorized activity?

1. Deterrent
2. Corrective
3. Recovery
4. Compensating

Correct Answer: 1

Explanation

Deterrent controls are designed to discourage individuals from attempting unauthorized or malicious activities. Examples include visible security cameras, warning signs, security guards, and clearly communicated security policies. These controls may not physically prevent an action, but they can influence behavior by increasing the perceived likelihood of detection or consequences. Deterrent controls are often combined with preventive, detective, and corrective controls to provide a more comprehensive security strategy.

Question 317

Which process determines the underlying reason why a security incident or system failure occurred?

1. Data classification
2. Account provisioning
3. Vulnerability scanning
4. Root cause analysis

Correct Answer: 4

Explanation

Root cause analysis is a structured process used to identify the fundamental reason behind a security incident, system failure, or recurring problem. Instead of focusing only on the immediate symptoms, analysts investigate what allowed the issue to occur. Identifying the root cause helps organizations implement corrective measures and prevent similar incidents from happening again. It can involve reviewing logs, configurations, processes, vulnerabilities, user actions, and other contributing factors.

Question 318

Which type of authentication uses a physical security key or smart card?

1. Something you know
2. Something you have
3. Something you are
4. Somewhere you are

Correct Answer: 2

Explanation

A physical security key or smart card represents the “something you have” authentication factor because successful authentication depends on possession of a physical object. Other authentication factors include “something you know,” such as a password or PIN, and “something you are,” such as a fingerprint or facial characteristic. Combining multiple factor types provides multifactor authentication, which can significantly improve security compared with relying on a password alone.

Question 319

Which security control provides a copy of critical data that can be used to restore systems after data loss?

1. Backup
2. Firewall
3. IDS
4. Proxy

Correct Answer: 1

Explanation

A backup creates a separate copy of important data that can be used to restore information after accidental deletion, hardware failure, malware infection, corruption, or another destructive event. Organizations should establish appropriate backup schedules based on business requirements and regularly test restoration procedures. Backups should also be protected from unauthorized access and ransomware. Maintaining multiple backup copies, including offline or immutable copies, can improve recovery capabilities.

Question 320

Which metric defines the maximum amount of acceptable data loss following a disruption?

1. RTO
2. MTTR
3. RPO
4. MTBF

Correct Answer: 3

Explanation

The Recovery Point Objective (RPO) defines the maximum amount of data loss an organization can tolerate after a disruption, usually expressed as a period of time. For example, an RPO of one hour means the organization should be prepared to lose no more than approximately one hour of data. A shorter RPO generally requires more frequent backups or replication. RTO instead defines the acceptable time required to restore operations.