View Full CompTIA SY0-701 Exam Dumps and Practice Test Dumps.

 

Question 341

Which security solution is primarily designed to collect and correlate logs from multiple systems to identify suspicious activity?

1. DLP
2. NAC
3. SIEM
4. HSM

Correct Answer: 3

Explanation

A Security Information and Event Management (SIEM) solution is designed to collect, centralize, and analyze security logs and events from multiple systems and devices. These sources can include servers, firewalls, applications, endpoints, and network devices. SIEM correlates information from different sources to identify patterns that may indicate suspicious or malicious activity. It can generate alerts when predefined rules or unusual behaviors are detected, helping security teams investigate potential incidents. SIEM also supports security monitoring, incident response, reporting, and compliance requirements. By providing a centralized view of security events, SIEM helps organizations detect threats more efficiently and respond to incidents quickly.

Question 342

An attacker repeatedly attempts different passwords against one user account. Which attack is most likely occurring?

1. Password spraying
2. Brute-force attack
3. Phishing
4. Credential stuffing

Correct Answer: 2

Explanation

A brute-force attack occurs when an attacker repeatedly tries different passwords or password combinations against a specific user account until the correct credential is discovered. The attacker may use automated tools to test a large number of possible combinations. This differs from password spraying, where attackers typically try one or a few common passwords against many different accounts. Brute-force attacks can be made more difficult through account lockout policies, strong password requirements, multi-factor authentication, and login monitoring. Organizations can also detect repeated failed authentication attempts and investigate suspicious activity. The key characteristic of this attack is trying many passwords against one account.

Question 343

Which security principle ensures that a user receives only the permissions required to perform assigned duties?

1. Separation of duties
2. Non-repudiation
3. Defense in depth
4. Least privilege

Correct Answer: 4

Explanation

The principle of least privilege ensures that users, applications, and systems receive only the minimum permissions necessary to perform their required tasks. This reduces the potential damage caused by compromised accounts, malware, insider threats, or accidental actions. For example, an employee who only needs to view certain files should not receive permission to modify or delete them. Least privilege should be applied to user accounts, administrator accounts, applications, services, and devices. Organizations can enforce this principle by regularly reviewing permissions and removing unnecessary access. By limiting privileges, organizations reduce the attack surface and make unauthorized access or privilege abuse more difficult.

Question 344

Which technology can prevent unauthorized devices from connecting to a corporate network based on security policies?

1. NAC
2. SIEM
3. WAF
4. HIDS

Correct Answer: 1

Explanation

Network Access Control (NAC) is a security technology that controls which devices are allowed to connect to a corporate network. NAC can evaluate devices based on security policies such as device identity, authentication status, operating system, security software, and patch level. If a device does not meet the required security standards, NAC can deny access, place the device in a restricted network, or require remediation before allowing normal access. This helps organizations prevent unauthorized or noncompliant devices from connecting to sensitive resources. NAC is commonly used in enterprise environments to improve network security and ensure that only approved and properly configured devices receive network access.

Question 345

An employee receives a fraudulent text message asking them to verify their banking credentials through a link. What type of attack is this?

1. Vishing
2. Pharming
3. Pretexting
4. Smishing

Correct Answer: 4

Explanation

Smishing is a form of phishing that uses SMS messages or other text-based messaging services to deceive victims. In this scenario, the attacker sends a fraudulent message pretending to represent a trusted bank or organization and asks the employee to verify their credentials through a link. The link may lead to a fake website designed to steal usernames, passwords, banking details, or other sensitive information. Attackers often use urgency or threatening messages to encourage victims to act quickly. Users should avoid clicking suspicious links and should verify requests through official channels. Smishing is specifically associated with phishing attacks delivered through text messages.

Question 346

Which mechanism is used to verify that a file has not been altered since its original hash value was recorded?

1. Encryption
2. Hash comparison
3. Tokenization
4. Steganography

Correct Answer: 2

Explanation

Hash comparison is a method used to determine whether a file has been changed since a trusted hash value was created. A hashing algorithm processes the file and produces a unique-looking fixed-length value called a hash. If the file is modified, even slightly, its new hash will normally be different from the original value. By calculating the file’s current hash and comparing it with the previously recorded trusted hash, administrators can identify unauthorized or unexpected changes. Hash comparison is commonly used for file integrity monitoring, software verification, and security investigations. However, a hash by itself does not provide confidentiality because it does not encrypt the original data.

Question 347

A security administrator separates a company’s accounting network from its guest wireless network. Which security technique is being implemented?

1. Network segmentation
2. Data masking
3. Tokenization
4. Password rotation

Correct Answer: 1

Explanation

Network segmentation is a security technique that divides a larger network into separate logical or physical sections. In this example, separating the accounting network from the guest wireless network prevents unnecessary communication between sensitive internal systems and untrusted guest devices. Access between network segments can be controlled using firewalls, access control lists, or other security technologies. Segmentation helps reduce the attack surface and can limit an attacker’s ability to move laterally if one part of the network becomes compromised. It is commonly used to separate sensitive systems, employee devices, guest networks, servers, and other resources according to their security requirements and business functions.

Question 348

Which encryption approach uses a public key and a private key for secure communication?

1. Hashing
2. Tokenization
3. Asymmetric encryption
4. Symmetric encryption

Correct Answer: 3

Explanation

Asymmetric encryption uses a mathematically related pair of cryptographic keys: a public key and a private key. The public key can be shared openly, while the private key must be kept secret and securely protected. Depending on the cryptographic process, information encrypted with one key can be processed using the corresponding key. Asymmetric cryptography is commonly used for secure communication, digital signatures, authentication, and exchanging information securely. It differs from symmetric encryption, which uses the same secret key for encryption and decryption. Asymmetric encryption generally requires more computational resources than symmetric encryption, so it is often combined with symmetric encryption in secure communication systems.

Question 349

Which security technology is specifically designed to inspect and filter HTTP and HTTPS requests sent to a web application?

1. VPN
2. SIEM
3. NAC
4. WAF

Correct Answer: 4

Explanation

A Web Application Firewall (WAF) is a security technology specifically designed to monitor, inspect, and filter HTTP and HTTPS traffic directed toward web applications. It can analyze web requests and responses to identify potentially malicious activity. A WAF can help protect applications against common attacks such as SQL injection, Cross-Site Scripting (XSS), malicious requests, and other application-layer threats. Security administrators can configure rules that allow legitimate traffic while blocking or alerting on suspicious requests. Unlike a traditional network firewall, which primarily controls network traffic based on addresses and ports, a WAF focuses specifically on protecting web applications and their associated HTTP or HTTPS traffic.

Question 350

An organization allows only preapproved applications to execute on company endpoints. Which control is being used?

1. Application allowlisting
2. Data masking
3. Port mirroring
4. Network address translation

Correct Answer: 1

Explanation

Application allowlisting is a security control that permits only specifically approved applications to execute on company systems. Instead of allowing all software to run by default, the organization creates a list of trusted applications and prevents unauthorized programs from executing. This can reduce the risk of malware, ransomware, unauthorized software, and other potentially harmful programs running on endpoints. Allowlisting can be especially useful in environments where systems perform specific business functions and only a limited number of applications are required. Administrators should regularly review and update the approved application list to ensure legitimate software can operate while unnecessary or suspicious programs remain blocked.

Question 351

Which type of attack attempts to manipulate a vulnerable application by inserting malicious SQL statements into input fields?

1. Directory traversal
2. Buffer overflow
3. Session hijacking
4. SQL injection

Correct Answer: 4

Explanation

SQL injection is a web application attack in which an attacker inserts malicious SQL statements into application input fields or other user-controlled data. If the application does not properly validate or handle the input, the injected commands may be interpreted by the database as legitimate SQL instructions. Depending on the vulnerability, an attacker may be able to access, modify, delete, or manipulate database information. SQL injection can also expose sensitive data stored by the application. Secure coding practices such as parameterized queries, prepared statements, proper input validation, and least-privilege database accounts can help prevent this type of attack and reduce its potential impact.

Question 352

Which authentication factor category does a fingerprint represent?

1. Something you are
2. Something you know
3. Something you have
4. Somewhere you are

Correct Answer: 1

Explanation

A fingerprint represents the “something you are” category of authentication because it is a biometric characteristic that is physically associated with an individual. Other examples of this factor include facial recognition, iris patterns, voice characteristics, and other measurable biological traits. In comparison, “something you know” includes passwords or PINs, while “something you have” includes security tokens, smart cards, or mobile devices. Authentication systems may combine different factor categories to provide stronger security through multi-factor authentication. Biometric authentication can make unauthorized access more difficult because biometric characteristics are generally harder to share or guess than traditional passwords.

Question 353

A company requires two employees to approve a high-value financial transaction. Which security principle does this demonstrate?

1. Zero trust
2. Job rotation
3. Separation of duties
4. Least privilege

Correct Answer: 3

Explanation

Separation of duties is a security principle that divides important or sensitive responsibilities among multiple individuals. In this example, requiring two employees to approve a high-value financial transaction prevents a single person from independently completing the entire operation. This reduces the risk of fraud, misuse of authority, and unauthorized transactions. It also creates an additional verification step because more than one person must participate in the process. Separation of duties is commonly used in financial systems, administrative processes, security operations, and other environments involving sensitive activities. The principle helps provide accountability and ensures that critical actions receive appropriate oversight before they are completed.

Question 354

Which backup type contains all changes made since the last full backup?

1. Snapshot
2. Mirror
3. Differential
4. Incremental

Correct Answer: 3

Explanation

A differential backup stores all data that has changed since the most recent full backup. Each new differential backup continues to include changes made after that original full backup, so its size generally increases over time until another full backup is created. During restoration, a full backup and the latest differential backup are typically required. This differs from an incremental backup, which stores only the changes made since the previous backup of any type. Differential backups can make restoration simpler than a sequence of multiple incremental backups, although they may require more storage as they grow. Organizations choose backup methods based on recovery requirements, storage capacity, and operational needs.

Question 355

Which security device can actively block malicious network traffic after detecting an intrusion?

1. IPS
2. IDS
3. Proxy
4. SIEM

Correct Answer: 1

Explanation

An Intrusion Prevention System (IPS) is a security device or technology that can detect malicious network activity and automatically take action to block or prevent the detected threat. An IPS can analyze traffic for known attack signatures, suspicious patterns, or policy violations and then block harmful connections or packets. This helps prevent attacks from reaching protected systems. An Intrusion Detection System (IDS), in contrast, primarily monitors activity and generates alerts when suspicious behavior is detected but does not normally block the traffic itself. IPS solutions are commonly deployed at network boundaries or other strategic locations where they can inspect traffic and respond to threats in real time.

Question 356

A user is redirected to a fraudulent website after entering the correct domain name into a browser. Which attack could cause this behavior by manipulating DNS information?

1. DNS poisoning
2. Password spraying
3. Shoulder surfing
4. Tailgating

Correct Answer: 1

Explanation

DNS poisoning is an attack in which an attacker corrupts or manipulates Domain Name System (DNS) information so that legitimate domain requests can resolve to an incorrect or malicious destination. As a result, a user may enter the correct website address but be redirected to a fraudulent website controlled by the attacker. The fake website may attempt to steal usernames, passwords, financial information, or other sensitive data. DNS poisoning can affect users who rely on the compromised DNS information. Organizations can reduce this risk through secure DNS practices, monitoring, DNS security mechanisms, and proper network protection. The attack targets the process used to translate domain names into IP addresses.

Question 357

Which control is most appropriate for preventing unauthorized individuals from physically following employees through a secured entrance?

1. Bollard
2. Cable lock
3. Security camera
4. Mantrap

Correct Answer: 4

Explanation

A mantrap is a physical security control designed to prevent unauthorized individuals from following authorized personnel through a secured entrance. It typically consists of a small enclosed area with two controlled doors. The first door must normally close and lock before the second door can open, allowing the access-control system to verify the person before granting entry. This helps prevent tailgating, also known as piggybacking, where an unauthorized person attempts to enter a restricted area by following an authorized employee. Mantraps are commonly used in locations requiring strong physical security, including data centers, government facilities, financial institutions, and other sensitive environments.

Question 358

Which technology can securely store cryptographic keys and perform sensitive cryptographic operations?

1. DLP
2. HSM
3. NAC
4. WAF

Correct Answer: 2

Explanation

A Hardware Security Module (HSM) is a specialized security device designed to protect cryptographic keys and perform sensitive cryptographic operations. HSMs can securely generate, store, manage, and use encryption keys while helping prevent unauthorized access to the keys themselves. They can also perform operations such as encryption, decryption, digital signing, and certificate-related functions within a protected hardware environment. HSMs are commonly used by banks, governments, cloud providers, and large organizations where strong protection of cryptographic keys is required. By providing dedicated hardware-based security, an HSM can reduce the risk of sensitive keys being exposed through ordinary software or operating system environments.

Question 359

An attacker gains control of a legitimate user’s active web session by stealing the session identifier. What type of attack is this?

1. Credential stuffing
2. Pharming
3. Replay attack
4. Session hijacking

Correct Answer: 4

Explanation

Session hijacking is an attack in which an attacker obtains a valid session identifier or session token and uses it to impersonate an authenticated user. Web applications commonly create session identifiers after a user successfully logs in, allowing the user to remain authenticated without repeatedly entering their password. If an attacker steals this identifier, they may be able to take control of the active session and access resources as the legitimate user. Attackers may obtain session information through various security weaknesses, including insecure applications or compromised devices. Secure session management, HTTPS, protected cookies, session expiration, and other controls can help reduce the risk of session hijacking.

Question 360

Which security approach assumes that no user or device should automatically be trusted, even when connecting from inside the corporate network?

1. Defense in depth
2. Zero Trust
3. Open access
4. Implicit trust

Correct Answer: 2

Explanation

Zero Trust is a security approach based on the principle that users, devices, applications, and network connections should not be automatically trusted simply because they are inside a corporate network. Instead, access requests should be continuously evaluated and verified based on factors such as identity, device security, location, requested resource, and risk. Zero Trust commonly follows the principle of “never trust, always verify” and applies least-privilege access to reduce unnecessary permissions. This approach helps limit the impact of compromised accounts or devices and reduces opportunities for attackers to move through internal networks. Zero Trust is increasingly used to protect modern cloud, hybrid, and enterprise environments.