View Full CompTIA SY0-701 Exam Dumps and Practice Test Dumps.

 

Question 1

A security administrator wants to prevent unauthorized users from accessing sensitive company resources even if a user’s password has been compromised. Which of the following would BEST address this requirement?

1. Multifactor authentication
2. Network segmentation
3. Data masking
4. Load balancing

Correct Answer: 1

Explanation: Multifactor authentication (MFA) adds an additional verification factor beyond a password, such as a security token, authenticator application, or biometric characteristic. If an attacker obtains a user’s password, they still need the additional authentication factor to gain access. Network segmentation separates networks, data masking hides sensitive information, and load balancing distributes network traffic. Although these technologies can improve security or performance, they do not directly provide the additional identity verification required when credentials are compromised.

Question 2

Which security concept ensures that a user is given only the permissions necessary to perform their assigned duties?

1. Separation of duties
2. Least privilege
3. Job rotation
4. Mandatory vacation

Correct Answer: 2

Explanation: The principle of least privilege requires users, applications, and systems to receive only the minimum permissions necessary to complete their required tasks. This limits the potential damage if an account becomes compromised or is misused. Separation of duties divides sensitive responsibilities among multiple individuals, while job rotation changes employee responsibilities periodically. Mandatory vacation can help uncover fraudulent activity. However, none of these directly defines the restriction of permissions to the minimum required level, making least privilege the correct choice.

Question 3

A company wants to ensure that employees cannot access internal servers directly from an untrusted external network. Which security control would BEST accomplish this?

1. Firewall
2. File compression
3. RAID
4. Printer encryption

Correct Answer: 1

Explanation: A firewall controls network traffic based on predefined security rules and can block unauthorized connections between trusted internal networks and untrusted external networks. It can restrict traffic by source address, destination address, port, protocol, and other criteria. File compression reduces file size, RAID provides storage redundancy, and printer encryption protects information associated with printing. These controls do not directly regulate network connections between external and internal environments. Therefore, a properly configured firewall is the best choice for controlling this type of network access.

Question 4

Which type of malware can replicate itself across a network without requiring a user to execute an infected file?

1. Trojan
2. Worm
3. Spyware
4. Rootkit

Correct Answer: 2

Explanation: A worm is malware capable of self-replication and can spread from one system to another, often by exploiting vulnerabilities in operating systems, applications, or network services. Unlike a worm, a Trojan typically disguises itself as legitimate software and depends on a user or process to execute it. Spyware is primarily designed to monitor or collect information, while a rootkit attempts to hide malicious activity and maintain privileged access. Worms can spread rapidly because they do not necessarily require users to manually execute infected files.

Question 5

A security analyst receives an email that appears to come from the company’s CEO. The message urgently requests a wire transfer to an external account. Which attack is MOST likely occurring?

1. Phishing
2. Business email compromise
3. DDoS
4. Password spraying

Correct Answer: 2

Explanation: Business email compromise (BEC) involves attackers impersonating executives, employees, or trusted business partners to manipulate victims into performing unauthorized actions, such as transferring money or revealing sensitive information. In this scenario, the attacker is using the identity of the CEO to create urgency and convince an employee to transfer funds. Phishing is a broader category involving deceptive communications, but the specific financial impersonation scenario is characteristic of BEC. DDoS targets availability, while password spraying attempts authentication using common passwords against multiple accounts.

Question 6

Which security control is MOST appropriate for detecting suspicious activity by examining network traffic?

1. IDS
2. UPS
3. HSM
4. RAID

Correct Answer: 1

Explanation: An intrusion detection system (IDS) monitors network or system activity and generates alerts when it identifies potentially malicious or suspicious behavior. A network-based IDS can inspect traffic for known attack patterns, unusual activity, or policy violations. A UPS provides backup electrical power, an HSM securely manages cryptographic keys and operations, and RAID provides storage redundancy. An IDS is therefore the control specifically designed to detect suspicious network activity. Detection does not necessarily mean the system automatically blocks the traffic; prevention is typically associated with an IPS.

Question 7

Which technology is designed to actively block malicious network traffic after detecting an attack?

1. IDS
2. IPS
3. SIEM
4. Packet sniffer

Correct Answer: 2

Explanation: An intrusion prevention system (IPS) can detect malicious or suspicious traffic and take automated action to prevent the activity, such as dropping packets or blocking connections. An IDS primarily detects and alerts on suspicious activity without necessarily blocking it. A SIEM collects and correlates security logs and events from multiple sources for analysis. A packet sniffer captures and examines network traffic but is not inherently designed to prevent attacks. Therefore, an IPS is the best answer when the requirement specifically calls for active blocking of malicious traffic.

Question 8

An organization wants to collect security logs from firewalls, servers, applications, and endpoints and correlate the events to identify potential attacks. Which solution should be implemented?

1. SIEM
2. VPN
3. NAC
4. DLP

Correct Answer: 1

Explanation: A Security Information and Event Management (SIEM) system collects logs and security events from multiple sources and can correlate that information to identify suspicious patterns. For example, a SIEM might detect repeated failed logins followed by successful authentication and unusual access to sensitive resources. A VPN provides encrypted remote connectivity, NAC controls network access based on device or user conditions, and DLP helps prevent sensitive information from leaving an organization. SIEM is therefore the most appropriate technology for centralized security event collection, correlation, monitoring, and analysis.

Question 9

Which type of attack attempts to make a service unavailable by overwhelming it with traffic from many compromised systems?

1. Brute-force attack
2. Distributed denial-of-service attack
3. SQL injection
4. Credential stuffing

Correct Answer: 2

Explanation: A distributed denial-of-service (DDoS) attack uses many compromised systems, commonly called a botnet, to generate large volumes of requests or traffic toward a target. The objective is to consume network bandwidth, processing resources, memory, or application capacity so legitimate users cannot access the service normally. A brute-force attack attempts to guess credentials, SQL injection targets vulnerable database queries, and credential stuffing uses previously stolen username and password combinations. Because the scenario involves many systems overwhelming a service, DDoS is the correct answer.

Question 10

Which authentication factor is represented by a fingerprint?

1. Something you know
2. Something you have
3. Something you are
4. Somewhere you are

Correct Answer: 3

Explanation: A fingerprint is a biometric characteristic and therefore represents the authentication factor “something you are.” Authentication factors are commonly categorized as something you know, something you have, and something you are. Passwords and PINs are examples of something you know, while smart cards and security tokens represent something you have. Fingerprints, facial recognition, and iris scans represent something you are. Using multiple different factor categories provides stronger authentication because compromising one factor does not necessarily give an attacker access to the others.

Question 11

A company wants to prevent sensitive customer information from being transmitted outside the organization through email and cloud services. Which security solution is MOST appropriate?

1. DLP
2. DHCP
3. NAT
4. RAID

Correct Answer: 1

Explanation: Data Loss Prevention (DLP) technologies are designed to identify, monitor, and protect sensitive information from unauthorized disclosure or transmission. DLP can inspect data in use, in motion, and at rest and may block or alert when sensitive information is being sent through email, uploaded to cloud services, or copied to unauthorized locations. DHCP automatically assigns network configuration information, NAT translates network addresses, and RAID provides storage redundancy. Since the requirement focuses on preventing sensitive data from leaving the organization, DLP is the most appropriate solution.

Question 12

Which cryptographic method uses the same key to encrypt and decrypt data?

1. Asymmetric encryption
2. Symmetric encryption
3. Hashing
4. Digital signing

Correct Answer: 2

Explanation: Symmetric encryption uses the same secret key for both encryption and decryption. Because the same key must be shared securely between authorized parties, key management is an important consideration. Asymmetric encryption uses a mathematically related public and private key pair. Hashing is a one-way process normally used for integrity verification or password storage rather than reversible encryption. Digital signatures typically use asymmetric cryptography to provide authenticity and integrity. Therefore, when the same key is used for both encryption and decryption, the method is symmetric encryption.

Question 13

A security professional needs to verify that a downloaded file has not been modified during transmission. Which method is MOST appropriate?

1. Hashing
2. Tokenization
3. Steganography
4. Data masking

Correct Answer: 1

Explanation: Hashing generates a fixed-length value based on the contents of a file. If the file changes, even slightly, its resulting hash value should normally change. By comparing the downloaded file’s hash with a trusted hash published by the original source, a user can determine whether the file was altered or corrupted. Tokenization replaces sensitive data with tokens, steganography hides information within other media, and data masking obscures sensitive information. Hashing is therefore the appropriate method for verifying file integrity.

Question 14

An attacker sends a specially crafted input to an application in an attempt to manipulate database queries. Which attack is this?

1. SQL injection
2. ARP poisoning
3. DNS tunneling
4. Shoulder surfing

Correct Answer: 1

Explanation: SQL injection occurs when an attacker provides malicious SQL-related input to an application that improperly handles user-supplied data. If the application constructs database queries insecurely, the attacker may manipulate those queries to access, modify, or delete database information. Secure coding practices, parameterized queries, input validation, and proper database permissions can reduce the risk. ARP poisoning targets local network address resolution, DNS tunneling abuses DNS communications, and shoulder surfing involves visually observing sensitive information. The database-query manipulation described here is SQL injection.

Question 15

Which type of vulnerability occurs when an application accepts more data than the allocated memory space can hold?

1. Buffer overflow
2. Race condition
3. Privilege escalation
4. Directory traversal

Correct Answer: 1

Explanation: A buffer overflow occurs when an application writes more data into a memory buffer than the space allocated for that buffer. Excess data may overwrite adjacent memory areas and potentially cause application crashes or, in some cases, allow attackers to execute malicious code. A race condition occurs when the outcome depends on the timing of concurrent operations. Privilege escalation involves obtaining higher permissions than authorized, while directory traversal attempts to access files or directories outside the intended location. Therefore, excessive data written beyond a buffer’s capacity describes a buffer overflow.

Question 16

A company separates its accounting systems from general employee systems so that a compromise in one network does not easily spread to the other. Which security technique is being used?

1. Network segmentation
2. Data aggregation
3. Password spraying
4. Port mirroring

Correct Answer: 1

Explanation: Network segmentation divides a larger network into separate logical or physical segments with controlled communication between them. Organizations commonly use segmentation to isolate sensitive systems, limit attack propagation, and reduce the potential impact of a compromise. For example, accounting systems can be placed on a restricted network segment that only authorized users and services can access. Data aggregation combines information from multiple sources, password spraying attempts common passwords against multiple accounts, and port mirroring copies network traffic for monitoring. Therefore, network segmentation best matches the scenario.

Question 17

Which security principle requires two or more individuals to participate in a sensitive process to reduce the risk of fraud?

1. Least privilege
2. Separation of duties
3. Zero trust
4. Defense in depth

Correct Answer: 2

Explanation: Separation of duties divides critical responsibilities among multiple individuals so that one person cannot independently complete a sensitive or potentially fraudulent process. For example, one employee might create a purchase order while another approves it. This reduces the opportunity for unauthorized actions or fraud because multiple people must participate. Least privilege limits permissions, zero trust requires continuous verification rather than automatic trust, and defense in depth uses multiple layers of security controls. Since the scenario specifically requires multiple people to participate in a sensitive process, separation of duties is correct.

Question 18

Which security model assumes that no user or device should be automatically trusted, even when the device is connected to the internal corporate network?

1. Zero trust
2. Open trust
3. Implicit trust
4. Perimeter trust

Correct Answer: 1

Explanation: Zero trust is a security approach based on the principle that users and devices should not receive automatic trust simply because they are inside an organization’s network. Access should be continuously evaluated using factors such as identity, device security, location, risk, and requested resources. Zero trust commonly follows principles such as verifying explicitly, using least privilege, and assuming breach. Traditional perimeter-based security often treated internal networks as more trusted than external networks. Zero trust reduces this assumption by requiring appropriate verification and authorization for access.

Question 19

A security analyst discovers that an employee’s account has successfully authenticated from two geographically distant locations within a few minutes. What type of suspicious activity is this MOST likely to indicate?

1. Impossible travel
2. Data masking
3. Tokenization
4. Load balancing

Correct Answer: 1

Explanation: Impossible travel is a security analytics concept used when authentication events indicate that a user appears to have traveled between geographically distant locations faster than physically possible. For example, a successful login from Pakistan followed by another successful login from the United States only a few minutes later may indicate that credentials have been compromised. Security monitoring systems can use location and authentication timestamps to detect this anomaly. Data masking and tokenization protect information, while load balancing distributes workloads. Therefore, impossible travel is the appropriate answer.

Question 20

A company wants to ensure that a user cannot deny having digitally approved an important transaction. Which security mechanism is MOST appropriate?

1. Digital signature
2. Data compression
3. Network address translation
4. Screen lock

Correct Answer: 1

Explanation: A digital signature can provide authentication, integrity, and non-repudiation for digitally signed information. A properly implemented digital signature allows recipients to verify that the signature was created using the signer’s private key and that the signed data has not been altered. This can provide evidence that the signer approved or signed the transaction, subject to the organization’s legal and technical framework. Data compression reduces file size, NAT translates network addresses, and screen locks protect unattended devices. Therefore, a digital signature is the best choice for non-repudiation.