{"id":11763,"date":"2026-09-14T11:56:57","date_gmt":"2026-09-14T11:56:57","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=11763"},"modified":"2026-09-14T11:57:05","modified_gmt":"2026-09-14T11:57:05","slug":"comptia-security-sy0-701-practice-test-questions-and-exam-dumps-part-19-q361-380","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/comptia-security-sy0-701-practice-test-questions-and-exam-dumps-part-19-q361-380\/","title":{"rendered":"CompTIA Security+ SY0-701 Practice Test Questions and Exam Dumps \u2014 Part 19 (Q361\u2013380)"},"content":{"rendered":"

View Full\u00a0CompTIA SY0-701 Exam Dumps<\/a>\u00a0and Practice Test Dumps.<\/h3>\n

Question 361<\/b><\/h3>\n

Which security control is designed to identify unauthorized changes to critical system files?<\/b><\/p>\n

    \n
  1. DLP<\/span><\/li>\n
  2. FIM<\/span><\/li>\n
  3. NAC<\/span><\/li>\n
  4. WAF<\/span><\/li>\n<\/ol>\n

    Correct Answer: 2<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    File Integrity Monitoring (FIM) is a security control used to detect changes made to important system files, configuration files, and other critical resources. FIM establishes a known baseline or trusted state and continuously monitors files for modifications. If a file is changed unexpectedly, the system can generate an alert for security personnel to investigate. This is useful for detecting malware activity, unauthorized configuration changes, tampering, or compromised systems. DLP focuses on preventing sensitive data loss, NAC controls network access, and WAF protects web applications. Therefore, FIM is the correct answer because its primary purpose is identifying unauthorized or unexpected changes to critical files.<\/span><\/p>\n

    Question 362<\/b><\/h3>\n

    An attacker sends a large number of requests to a server until legitimate users can no longer access it. Which attack is this?<\/b><\/p>\n

      \n
    1. DDoS<\/span><\/li>\n
    2. Phishing<\/span><\/li>\n
    3. Credential stuffing<\/span><\/li>\n
    4. SQL injection<\/span><\/li>\n<\/ol>\n

      Correct Answer: 1<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      A Distributed Denial-of-Service (DDoS) attack attempts to make a system, application, or network service unavailable to legitimate users by overwhelming it with excessive traffic or requests. In a typical DDoS attack, traffic may originate from many compromised devices, often called a botnet, making the attack difficult to block using a single source-based rule. The targeted server can become overloaded with requests and may be unable to process legitimate connections. Phishing targets users, credential stuffing uses stolen credentials, and SQL injection targets vulnerable applications and databases. Therefore, DDoS is the correct answer because the goal is to disrupt service availability.<\/span><\/p>\n

      Question 363<\/b><\/h3>\n

      Which access control model allows resource owners to determine who can access their resources?<\/b><\/p>\n

        \n
      1. MAC<\/span><\/li>\n
      2. RBAC<\/span><\/li>\n
      3. DAC<\/span><\/li>\n
      4. ABAC<\/span><\/li>\n<\/ol>\n

        Correct Answer: 3<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        Discretionary Access Control (DAC) allows the owner or creator of a resource to decide which users or groups can access that resource. The owner can typically assign permissions such as read, write, modify, or execute based on organizational requirements. DAC provides flexibility because resource owners have direct control over access decisions. Mandatory Access Control (MAC) uses centrally defined security classifications and policies, while Role-Based Access Control (RBAC) assigns permissions according to job roles. Attribute-Based Access Control (ABAC) uses attributes and conditions to make access decisions. Therefore, DAC is correct because it specifically gives resource owners discretion over permissions.<\/span><\/p>\n

        Question 364<\/b><\/h3>\n

        Which protocol provides secure remote command-line access to a system?<\/b><\/p>\n

          \n
        1. FTP<\/span><\/li>\n
        2. Telnet<\/span><\/li>\n
        3. SSH<\/span><\/li>\n
        4. HTTP<\/span><\/li>\n<\/ol>\n

          Correct Answer: 3<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          Secure Shell (SSH) is a network protocol designed to provide secure remote access to systems, especially for command-line administration. SSH encrypts communication between the client and server, helping protect usernames, passwords, commands, and other information from interception. It is commonly used by administrators to securely manage Linux and Unix-based servers and can also be used for secure file transfers and tunneling. Telnet also provides remote command-line access, but it transmits information without strong encryption and is therefore insecure for sensitive administration. FTP is primarily used for file transfers, while HTTP is used for web communication. Therefore, SSH is the correct answer.<\/span><\/p>\n

          Question 365<\/b><\/h3>\n

          An attacker uses stolen usernames and passwords from a previous breach to access multiple unrelated websites. What attack is occurring?<\/b><\/p>\n

            \n
          1. Password spraying<\/span><\/li>\n
          2. Credential stuffing<\/span><\/li>\n
          3. Brute force<\/span><\/li>\n
          4. Shoulder surfing<\/span><\/li>\n<\/ol>\n

            Correct Answer: 2<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            Credential stuffing is an attack in which criminals use previously stolen username and password combinations to attempt authentication against other websites or services. The attack depends on password reuse, because users sometimes use the same credentials across multiple accounts. If a username and password were exposed during one breach, an attacker may try those credentials on email, banking, shopping, social media, or corporate services. Password spraying is different because it attempts a small number of commonly used passwords against many accounts. Brute-force attacks systematically try many possible passwords, while shoulder surfing involves observing someone entering credentials. Therefore, credential stuffing is the correct answer.<\/span><\/p>\n

            Question 366<\/b><\/h3>\n

            Which security concept requires organizations to use multiple layers of security controls?<\/b><\/p>\n

              \n
            1. Zero Trust<\/span><\/li>\n
            2. Defense in depth<\/span><\/li>\n
            3. Least privilege<\/span><\/li>\n
            4. Separation of duties<\/span><\/li>\n<\/ol>\n

              Correct Answer: 2<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              Defense in depth is a security strategy that uses multiple layers of different security controls to protect systems, networks, applications, and data. The purpose is to ensure that if one security control fails or is bypassed, additional controls remain available to reduce the chance of compromise. For example, an organization may use firewalls, endpoint protection, network segmentation, access controls, encryption, monitoring, and user authentication together. Zero Trust focuses on continuous verification rather than automatic trust, least privilege limits permissions to what is necessary, and separation of duties divides responsibilities among individuals. Therefore, defense in depth is correct because it specifically emphasizes layered security protection.<\/span><\/p>\n

              Question 367<\/b><\/h3>\n

              Which technology can prevent sensitive information such as credit card numbers from leaving an organization’s network?<\/b><\/p>\n

                \n
              1. DLP<\/span><\/li>\n
              2. IDS<\/span><\/li>\n
              3. VPN<\/span><\/li>\n
              4. HSM<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                Data Loss Prevention (DLP) technology is designed to identify, monitor, and protect sensitive information from unauthorized disclosure or transmission. DLP solutions can inspect data in use, in motion, or at rest and may use predefined rules to identify sensitive information such as credit card numbers, Social Security numbers, confidential documents, or intellectual property. When a policy violation is detected, the system may alert administrators, block the transmission, quarantine the data, or require additional authorization. An IDS primarily detects suspicious activity, a VPN provides protected network communication, and an HSM securely manages cryptographic keys. Therefore, DLP is the correct answer because it focuses on preventing sensitive data loss.<\/span><\/p>\n

                Question 368<\/b><\/h3>\n

                Which type of malware can replicate itself across networks without requiring a user to execute an infected file?<\/b><\/p>\n

                  \n
                1. Trojan<\/span><\/li>\n
                2. Worm<\/span><\/li>\n
                3. Spyware<\/span><\/li>\n
                4. Rootkit<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 2<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  A worm is a type of malware that can automatically replicate itself and spread from one system to another, often through network vulnerabilities or other weaknesses. Unlike many traditional malware infections, a worm does not necessarily require a user to manually execute an infected file. Once it gains access to a vulnerable system, it can continue scanning for additional targets and reproduce across the network. A Trojan disguises itself as legitimate software and generally relies on user execution. Spyware focuses on secretly collecting information, while a rootkit is designed to hide malicious activity and maintain privileged access. Therefore, worm is the correct answer because self-replication and autonomous network propagation are key characteristics.<\/span><\/p>\n

                  Question 369<\/b><\/h3>\n

                  Which security solution monitors endpoint activity and can isolate a compromised device?<\/b><\/p>\n

                    \n
                  1. EDR<\/span><\/li>\n
                  2. WAF<\/span><\/li>\n
                  3. NAC<\/span><\/li>\n
                  4. SIEM<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    Endpoint Detection and Response (EDR) is a security solution designed to continuously monitor activity on endpoints such as workstations, laptops, and servers. EDR collects information about processes, files, network connections, and other endpoint behavior to identify suspicious or malicious activity. When a compromise is detected, EDR can provide response actions, including terminating malicious processes, removing threats, or isolating the affected endpoint from the network. A WAF protects web applications, NAC controls whether devices can connect to a network, and SIEM primarily collects and correlates security events from multiple sources. Therefore, EDR is correct because it specifically provides endpoint monitoring, detection, investigation, and response capabilities.<\/span><\/p>\n

                    Question 370<\/b><\/h3>\n

                    Which attack occurs when an attacker secretly intercepts and potentially modifies communication between two parties?<\/b><\/p>\n

                      \n
                    1. MITM<\/span><\/li>\n
                    2. DDoS<\/span><\/li>\n
                    3. Buffer overflow<\/span><\/li>\n
                    4. Password spraying<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 1<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      A Man-in-the-Middle (MITM) attack occurs when an attacker secretly positions themselves between two communicating parties and intercepts the information being exchanged. Depending on the attack, the attacker may simply monitor communication or actively modify messages before forwarding them to the intended recipient. MITM attacks can target network connections, wireless communications, or other forms of data exchange when authentication or encryption is weak or improperly implemented. DDoS attacks focus on availability, buffer overflow attacks exploit memory-handling vulnerabilities, and password spraying targets authentication systems. Therefore, MITM is the correct answer because its defining characteristic is intercepting communication between two parties.<\/span><\/p>\n

                      Question 371<\/b><\/h3>\n

                      Which security principle requires an organization to verify access requests rather than automatically trusting internal users?<\/b><\/p>\n

                        \n
                      1. Zero Trust<\/span><\/li>\n
                      2. Open access<\/span><\/li>\n
                      3. Implicit trust<\/span><\/li>\n
                      4. Single sign-on<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        Zero Trust is a security model based on the principle that no user, device, or connection should automatically be trusted simply because it is inside an organization’s network. Access requests should be continuously evaluated using factors such as identity, authentication status, device security, location, application, and organizational policy. Users receive only the access they are authorized to have, and access may be reevaluated when conditions change. This approach helps reduce the risk of compromised accounts and lateral movement by attackers. Open access and implicit trust assume fewer restrictions, while SSO is an authentication convenience rather than a complete security model. Therefore, Zero Trust is correct.<\/span><\/p>\n

                        Question 372<\/b><\/h3>\n

                        Which control helps prevent unauthorized physical access to a restricted area by requiring an employee to present an identification credential?<\/b><\/p>\n

                          \n
                        1. Access badge<\/span><\/li>\n
                        2. Bollard<\/span><\/li>\n
                        3. Honeypot<\/span><\/li>\n
                        4. Firewall<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 1<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          An access badge is a physical security control used to identify and authorize employees or other approved individuals before they enter restricted areas. Badge systems commonly work with electronic readers that verify the credential and determine whether the person has permission to access a particular location. Organizations can also record badge activity to create an audit trail of physical access. A bollard is mainly used to block or control vehicles, a honeypot is a cybersecurity deception mechanism, and a firewall controls network traffic rather than physical entry. Therefore, an access badge is the correct answer because it provides identification and authorization for controlled physical access to secured areas.<\/span><\/p>\n

                          Question 373<\/b><\/h3>\n

                          Which type of malware is designed to hide its presence by modifying or controlling low-level system functions?<\/b><\/p>\n

                            \n
                          1. Rootkit<\/span><\/li>\n
                          2. Worm<\/span><\/li>\n
                          3. Trojan<\/span><\/li>\n
                          4. Adware<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            A rootkit is a type of malicious software designed to hide its presence and maintain unauthorized privileged access to a system. Rootkits may modify operating system components, system processes, drivers, or other low-level functions so that malicious activity becomes difficult for users and security tools to detect. Some rootkits can hide files, processes, network connections, or other evidence of compromise. Worms are primarily known for self-replication and spreading, Trojans disguise malicious software as legitimate applications, and adware displays unwanted advertisements. Therefore, rootkit is the correct answer because stealth and concealment at a low system level are major characteristics of this malware type.<\/span><\/p>\n

                            Question 374<\/b><\/h3>\n

                            Which authentication method provides users with a single set of credentials to access multiple authorized applications?<\/b><\/p>\n

                              \n
                            1. MFA<\/span><\/li>\n
                            2. SSO<\/span><\/li>\n
                            3. PAM<\/span><\/li>\n
                            4. NAC<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 2<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              Single Sign-On (SSO) allows a user to authenticate once and then access multiple authorized applications or services without repeatedly entering separate usernames and passwords. SSO can improve user convenience and productivity while also helping organizations centrally manage authentication policies. When properly implemented, it can reduce password fatigue and encourage stronger authentication practices. Multi-Factor Authentication (MFA) requires multiple authentication factors, but it does not necessarily provide access to multiple applications with one login. PAM manages privileged accounts and access, while NAC controls network access for devices and users. Therefore, SSO is the correct answer because its primary purpose is allowing one authentication session to access multiple authorized resources.<\/span><\/p>\n

                              Question 375<\/b><\/h3>\n

                              Which technology is primarily used to protect email systems from malicious messages, phishing attempts, and spam?<\/b><\/p>\n

                                \n
                              1. Secure email gateway<\/span><\/li>\n
                              2. HSM<\/span><\/li>\n
                              3. VPN concentrator<\/span><\/li>\n
                              4. Network switch<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                A secure email gateway is a security solution that filters and analyzes email traffic entering and leaving an organization. It can identify and block common email-based threats such as spam, phishing messages, malicious attachments, dangerous links, and malware. Organizations can configure email security policies to quarantine suspicious messages, scan attachments, inspect URLs, and prevent certain types of sensitive information from being transmitted. An HSM is primarily used for cryptographic key protection, a VPN concentrator manages secure remote VPN connections, and a network switch connects devices within a network. Therefore, a secure email gateway is correct because it is specifically designed to protect email communication from malicious and unwanted content.<\/span><\/p>\n

                                Question 376<\/b><\/h3>\n

                                An attacker sends a fake message pretending to be the user’s bank and asks for account information. Which social engineering attack is this?<\/b><\/p>\n

                                  \n
                                1. Phishing<\/span><\/li>\n
                                2. Tailgating<\/span><\/li>\n
                                3. Shoulder surfing<\/span><\/li>\n
                                4. Dumpster diving<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 1<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  Phishing is a social engineering attack in which an attacker sends a deceptive message designed to appear as if it came from a trusted organization, person, or service. In this example, the attacker impersonates the user’s bank and attempts to convince the victim to provide sensitive account information. Phishing messages may also contain malicious links, attachments, or instructions that lead to credential theft or malware infection. Tailgating involves gaining unauthorized physical access by following an authorized person, shoulder surfing involves observing someone entering sensitive information, and dumpster diving involves searching discarded materials for useful information. Therefore, phishing is the correct answer.<\/span><\/p>\n

                                  Question 377<\/b><\/h3>\n

                                  Which security assessment actively attempts to exploit vulnerabilities in a controlled environment?<\/b><\/p>\n

                                    \n
                                  1. Vulnerability scan<\/span><\/li>\n
                                  2. Penetration test<\/span><\/li>\n
                                  3. Risk assessment<\/span><\/li>\n
                                  4. Configuration review<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 2<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    A penetration test is a controlled security assessment in which authorized security professionals actively attempt to exploit vulnerabilities in systems, applications, networks, or other environments. The goal is to determine whether identified weaknesses can actually be exploited and to understand their potential impact. Penetration testers may use techniques similar to those used by real attackers while following defined rules of engagement. A vulnerability scan primarily identifies and reports potential vulnerabilities without necessarily exploiting them. A risk assessment evaluates threats, vulnerabilities, likelihood, and impact, while a configuration review examines system settings. Therefore, penetration testing is correct because it actively attempts controlled exploitation.<\/span><\/p>\n

                                    Question 378<\/b><\/h3>\n

                                    Which recovery metric defines the maximum acceptable amount of data that can be lost after an incident?<\/b><\/p>\n

                                      \n
                                    1. RTO<\/span><\/li>\n
                                    2. RPO<\/span><\/li>\n
                                    3. MTTR<\/span><\/li>\n
                                    4. MTBF<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 2<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      Recovery Point Objective (RPO) defines the maximum amount of data an organization can afford to lose after a disruption, usually measured in time. For example, an organization with an RPO of one hour should have recovery mechanisms that allow it to restore data to a point no more than approximately one hour before the incident. RPO is closely related to backup and replication frequency. Recovery Time Objective (RTO) focuses on how quickly systems must be restored, while MTTR measures average repair or recovery time and MTBF measures the average time between failures. Therefore, RPO is correct because it specifically addresses acceptable data loss.<\/span><\/p>\n

                                      Question 379<\/b><\/h3>\n

                                      Which recovery metric specifies how quickly a service should be restored after an outage?<\/b><\/p>\n

                                        \n
                                      1. RPO<\/span><\/li>\n
                                      2. RTO<\/span><\/li>\n
                                      3. MTBF<\/span><\/li>\n
                                      4. SLA<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 2<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        Recovery Time Objective (RTO) specifies the maximum acceptable amount of time an organization can take to restore a system, application, or service after a disruption. It is an important business continuity and disaster recovery measurement because it helps organizations determine how quickly critical services must become operational again. For example, an application with an RTO of two hours should be restored within approximately two hours after an outage. RPO is concerned with the amount of acceptable data loss, not restoration speed. MTBF measures the average time between failures, while an SLA defines agreed service expectations. Therefore, RTO is the correct answer because it focuses on recovery time.<\/span><\/p>\n

                                        Question 380<\/b><\/h3>\n

                                        Which security technology can inspect encrypted web traffic to detect malicious content when properly configured?<\/b><\/p>\n

                                          \n
                                        1. SSL\/TLS inspection<\/span><\/li>\n
                                        2. MAC filtering<\/span><\/li>\n
                                        3. Port security<\/span><\/li>\n
                                        4. Tokenization<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 1<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          SSL\/TLS inspection is a security technology that allows an organization to inspect encrypted web traffic for malicious content, suspicious activity, or policy violations. Because HTTPS traffic is encrypted, security devices normally cannot examine the contents directly. With properly configured SSL\/TLS inspection, the security system temporarily decrypts the traffic, analyzes it using security policies and inspection tools, and then re-encrypts it before sending it to the destination. This can help detect malware, malicious websites, and other threats hidden inside encrypted connections. MAC filtering controls device access, port security protects switch ports, and tokenization replaces sensitive data with tokens. Therefore, SSL\/TLS inspection is correct.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full\u00a0CompTIA SY0-701 Exam Dumps\u00a0and Practice Test Dumps. Question 361 Which security control is designed to identify unauthorized changes to critical system files? DLP FIM NAC WAF Correct Answer: 2 Explanation File Integrity Monitoring (FIM) is a security control used to detect changes made to important system files, configuration files, and other critical resources. FIM […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/11763"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=11763"}],"version-history":[{"count":2,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/11763\/revisions"}],"predecessor-version":[{"id":11765,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/11763\/revisions\/11765"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=11763"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=11763"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=11763"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}