{"id":11766,"date":"2026-09-14T11:58:10","date_gmt":"2026-09-14T11:58:10","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=11766"},"modified":"2026-09-14T11:58:10","modified_gmt":"2026-09-14T11:58:10","slug":"comptia-security-sy0-701-practice-test-questions-and-exam-dumps-part-20-q381-400","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/comptia-security-sy0-701-practice-test-questions-and-exam-dumps-part-20-q381-400\/","title":{"rendered":"CompTIA Security+ SY0-701 Practice Test Questions and Exam Dumps \u2014 Part 20 (Q381\u2013400)"},"content":{"rendered":"

View Full\u00a0CompTIA SY0-701 Exam Dumps<\/a>\u00a0and Practice Test Dumps.<\/h3>\n

 <\/p>\n

Question 381<\/b><\/h3>\n

Which security control can restrict network access based on the physical address of a network interface?<\/b><\/p>\n

    \n
  1. MAC filtering<\/span><\/li>\n
  2. DNS filtering<\/span><\/li>\n
  3. Content filtering<\/span><\/li>\n
  4. URL filtering<\/span><\/li>\n<\/ol>\n

    Correct Answer: 1<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    MAC filtering allows network administrators to control network access based on the Media Access Control (MAC) address assigned to a network interface. A MAC address is a unique hardware identifier associated with a network adapter. Administrators can configure a wireless access point or network device to allow only approved MAC addresses or deny specific addresses. This can provide an additional layer of access control, although MAC addresses can sometimes be spoofed by attackers. DNS filtering focuses on controlling domain-name resolution, content and URL filtering focus on web resources, and neither directly uses the physical network interface address for access decisions. Therefore, MAC filtering is the correct answer.<\/span><\/p>\n

    Question 382<\/b><\/h3>\n

    Which attack involves sending a fraudulent email that appears to come from a trusted executive within an organization?<\/b><\/p>\n

      \n
    1. Spear phishing<\/span><\/li>\n
    2. Tailgating<\/span><\/li>\n
    3. Pharming<\/span><\/li>\n
    4. Wardriving<\/span><\/li>\n<\/ol>\n

      Correct Answer: 1<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      Spear phishing is a targeted form of phishing that uses personalized and convincing messages to target a specific person or organization. In this scenario, an attacker may impersonate a CEO, manager, or other trusted executive and send an email requesting sensitive information, money transfers, or another unauthorized action. Because the message appears to come from someone with authority, employees may be more likely to follow the instructions. Tailgating is a physical security attack, pharming redirects users to fraudulent websites, and wardriving involves searching for wireless networks. Therefore, spear phishing is correct because the fraudulent email is specifically targeted and uses impersonation of a trusted individual.<\/span><\/p>\n

      Question 383<\/b><\/h3>\n

      Which security technology is designed to detect unusual behavior by comparing activities against established user and entity behavior patterns?<\/b><\/p>\n

        \n
      1. UEBA<\/span><\/li>\n
      2. DLP<\/span><\/li>\n
      3. NAC<\/span><\/li>\n
      4. WAF<\/span><\/li>\n<\/ol>\n

        Correct Answer: 1<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        User and Entity Behavior Analytics (UEBA) is a security technology that analyzes normal behavior patterns associated with users, devices, applications, and other entities. After establishing a baseline, UEBA can identify unusual activities that may indicate compromised accounts, insider threats, privilege abuse, or other suspicious behavior. For example, if an employee normally logs in from one location during business hours but suddenly accesses large amounts of sensitive information at an unusual time, UEBA may identify the activity as abnormal. DLP focuses on preventing data loss, NAC controls network access, and WAF protects web applications. Therefore, UEBA is the correct answer because it specifically focuses on behavioral analysis and anomaly detection.<\/span><\/p>\n

        Question 384<\/b><\/h3>\n

        Which type of attack attempts to execute unauthorized commands by inserting operating system commands into application input?<\/b><\/p>\n

          \n
        1. Command injection<\/span><\/li>\n
        2. SQL injection<\/span><\/li>\n
        3. XSS<\/span><\/li>\n
        4. Directory traversal<\/span><\/li>\n<\/ol>\n

          Correct Answer: 1<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          Command injection occurs when an attacker provides malicious operating system commands through application input that is not properly validated or sanitized. If the vulnerable application passes the attacker-controlled input to the underlying operating system, the injected commands may execute with the application’s privileges. This can allow attackers to access files, modify configurations, run programs, or perform other unauthorized actions. SQL injection is specifically designed to manipulate database queries, while XSS injects malicious scripts that execute in a user’s browser. Directory traversal attempts to access files outside an application’s intended directory. Therefore, command injection is correct because it directly targets operating system command execution through application input.<\/span><\/p>\n

          Question 385<\/b><\/h3>\n

          Which security mechanism replaces sensitive data with a non-sensitive equivalent value?<\/b><\/p>\n

            \n
          1. Hashing<\/span><\/li>\n
          2. Tokenization<\/span><\/li>\n
          3. Encryption<\/span><\/li>\n
          4. Compression<\/span><\/li>\n<\/ol>\n

            Correct Answer: 2<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            Tokenization is a security mechanism that replaces sensitive information with a randomly generated or otherwise controlled token that has little or no useful meaning outside the authorized system. For example, a payment system may replace a customer’s actual credit card number with a token for use in applications and databases. The original sensitive information is stored separately in a secure tokenization system or vault. Hashing creates a fixed representation of data that is generally designed to be one-way, while encryption transforms data into ciphertext that can be decrypted with the appropriate key. Compression reduces data size. Therefore, tokenization is correct because it substitutes sensitive information with a non-sensitive equivalent value.<\/span><\/p>\n

            Question 386<\/b><\/h3>\n

            Which attack uses a fake login page designed to capture a victim’s username and password?<\/b><\/p>\n

              \n
            1. Phishing<\/span><\/li>\n
            2. DDoS<\/span><\/li>\n
            3. Logic bomb<\/span><\/li>\n
            4. Race condition<\/span><\/li>\n<\/ol>\n

              Correct Answer: 1<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              Phishing is a social engineering attack that attempts to trick victims into revealing sensitive information by using deceptive messages, websites, or other communications. Attackers may create a fake login page that closely resembles a legitimate website, such as an email provider, banking service, or corporate portal. When the victim enters their username and password, the information can be captured by the attacker. Phishing pages may be delivered through emails, text messages, social media, or malicious advertisements. DDoS attacks target availability, logic bombs execute malicious actions based on specific conditions, and race conditions involve timing issues. Therefore, phishing is the correct answer.<\/span><\/p>\n

              Question 387<\/b><\/h3>\n

              Which security control is intended to discourage unauthorized individuals from attempting to access a protected facility?<\/b><\/p>\n

                \n
              1. Deterrent control<\/span><\/li>\n
              2. Corrective control<\/span><\/li>\n
              3. Recovery control<\/span><\/li>\n
              4. Compensating control<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                A deterrent control is designed to discourage individuals from attempting unauthorized or unwanted activities. The purpose is to make potential attackers or intruders think twice before attempting to violate security policies. Examples include visible security cameras, warning signs, security guards, fences, lighting, and other noticeable security measures. These controls may not physically prevent an attack, but they can reduce the likelihood that someone will attempt one. Corrective controls are used to repair problems after an incident, recovery controls help restore operations, and compensating controls provide an alternative safeguard when a primary control cannot be implemented. Therefore, deterrent control is the correct answer because its main purpose is discouragement.<\/span><\/p>\n

                Question 388<\/b><\/h3>\n

                Which type of control is used to restore a system to normal operation after a security incident?<\/b><\/p>\n

                  \n
                1. Preventive<\/span><\/li>\n
                2. Detective<\/span><\/li>\n
                3. Corrective<\/span><\/li>\n
                4. Deterrent<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 3<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  Corrective controls are security measures designed to fix or reduce the effects of a security incident after it has occurred. Their purpose is to restore systems, applications, or processes to an acceptable and secure operational state. Examples include malware removal, restoring data from backups, repairing damaged systems, resetting compromised credentials, and correcting security configurations. Preventive controls attempt to stop incidents before they occur, while detective controls identify or alert personnel about suspicious activity. Deterrent controls discourage unwanted behavior but do not necessarily correct damage. Therefore, corrective control is the correct answer because it is specifically intended to repair problems and restore normal operation following a security event.<\/span><\/p>\n

                  Question 389<\/b><\/h3>\n

                  Which security model assigns access permissions according to a user’s organizational role?<\/b><\/p>\n

                    \n
                  1. DAC<\/span><\/li>\n
                  2. RBAC<\/span><\/li>\n
                  3. MAC<\/span><\/li>\n
                  4. Rule-based access control<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 2<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    Role-Based Access Control (RBAC) assigns permissions according to a user’s organizational role or job responsibilities. Instead of assigning individual permissions to every employee separately, administrators create roles such as accountant, manager, administrator, or human resources employee and assign appropriate permissions to each role. Users then receive access based on the role assigned to them. This approach simplifies access management and helps enforce least privilege because users can receive only the permissions required for their job. DAC gives resource owners control over permissions, MAC uses centrally defined security classifications, and rule-based access control relies on specific predefined rules. Therefore, RBAC is correct because permissions are based on organizational roles.<\/span><\/p>\n

                    Question 390<\/b><\/h3>\n

                    Which protocol is commonly used to securely retrieve email from a mail server?<\/b><\/p>\n

                      \n
                    1. IMAPS<\/span><\/li>\n
                    2. FTP<\/span><\/li>\n
                    3. TFTP<\/span><\/li>\n
                    4. HTTP<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 1<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      IMAPS is the secure version of the Internet Message Access Protocol (IMAP) and is used by email clients to securely retrieve and manage messages stored on a mail server. IMAPS uses TLS encryption to protect communication between the email client and server, helping prevent attackers from intercepting usernames, passwords, email content, and other information. Unlike POP3, IMAP is designed to keep messages stored on the server and synchronize them across multiple devices. FTP and TFTP are file transfer protocols, while HTTP is primarily used for web communication. Therefore, IMAPS is the correct answer because it provides encrypted and secure access to email stored on a mail server.<\/span><\/p>\n

                      Question 391<\/b><\/h3>\n

                      Which attack attempts to gain access by trying commonly used passwords against many different accounts?<\/b><\/p>\n

                        \n
                      1. Brute force<\/span><\/li>\n
                      2. Password spraying<\/span><\/li>\n
                      3. Credential stuffing<\/span><\/li>\n
                      4. Rainbow table attack<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 2<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        Password spraying is an authentication attack in which an attacker attempts a small number of commonly used passwords against many different user accounts. Instead of repeatedly attacking one account with numerous passwords, the attacker spreads attempts across multiple accounts. This technique can help avoid account lockout policies that may trigger after several failed attempts against a single account. Commonly guessed passwords may include seasonal passwords, simple patterns, or widely used credentials. Brute-force attacks generally try many password combinations against a target, while credential stuffing uses previously stolen username and password combinations. Therefore, password spraying is correct because it uses common passwords across many accounts.<\/span><\/p>\n

                        Question 392<\/b><\/h3>\n

                        Which security practice removes unnecessary services and applications from a system to reduce its attack surface?<\/b><\/p>\n

                          \n
                        1. System hardening<\/span><\/li>\n
                        2. Data masking<\/span><\/li>\n
                        3. Tokenization<\/span><\/li>\n
                        4. Load balancing<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 1<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          System hardening is the process of securing a system by reducing unnecessary functionality, services, applications, accounts, and configuration weaknesses. Removing unused software and disabling unnecessary services reduces the number of potential entry points attackers could exploit. Hardening may also include applying security patches, enforcing strong authentication, changing default credentials, configuring secure permissions, disabling unused ports, and following approved security baselines. Data masking protects sensitive information by hiding or altering its visible representation, tokenization replaces sensitive data with tokens, and load balancing distributes traffic across systems. Therefore, system hardening is the correct answer because it specifically focuses on reducing a system’s attack surface and improving its overall security configuration.<\/span><\/p>\n

                          Question 393<\/b><\/h3>\n

                          Which type of attack occurs when malicious JavaScript is injected into a trusted web page and executed in a victim’s browser?<\/b><\/p>\n

                            \n
                          1. XSS<\/span><\/li>\n
                          2. SQL injection<\/span><\/li>\n
                          3. Buffer overflow<\/span><\/li>\n
                          4. Command injection<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            Cross-Site Scripting (XSS) is a web application vulnerability that allows attackers to inject malicious scripts into content that is delivered to users through a trusted website. When a victim visits the affected page, the browser may execute the injected JavaScript in the context of the trusted website. Depending on the situation, an attacker may use XSS to steal session information, manipulate page content, perform actions as the victim, or collect sensitive information. SQL injection targets database queries, buffer overflow attacks involve improper memory handling, and command injection attempts to execute operating system commands. Therefore, XSS is correct because it involves malicious scripts executing in a victim’s browser.<\/span><\/p>\n

                            Question 394<\/b><\/h3>\n

                            Which security technology provides centralized management of privileged accounts and their credentials?<\/b><\/p>\n

                              \n
                            1. PAM<\/span><\/li>\n
                            2. SSO<\/span><\/li>\n
                            3. NAC<\/span><\/li>\n
                            4. IDS<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 1<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              Privileged Access Management (PAM) is a security technology used to control, secure, monitor, and manage accounts that have elevated privileges. Privileged accounts can perform sensitive actions such as changing system configurations, managing users, installing software, or accessing protected data. PAM solutions can securely store privileged credentials, control when administrators can use them, record privileged sessions, rotate passwords, and enforce approval processes. SSO simplifies authentication across multiple applications, NAC controls network access, and IDS detects suspicious activity. Therefore, PAM is the correct answer because it specifically provides centralized management and protection of privileged accounts and their credentials, helping reduce the risk of privileged account misuse or compromise.<\/span><\/p>\n

                              Question 395<\/b><\/h3>\n

                              Which type of vulnerability occurs when a program writes more data into a memory area than it can hold?<\/b><\/p>\n

                                \n
                              1. Buffer overflow<\/span><\/li>\n
                              2. Race condition<\/span><\/li>\n
                              3. Directory traversal<\/span><\/li>\n
                              4. SQL injection<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                A buffer overflow occurs when a program attempts to place more data into a memory buffer than the buffer was designed to hold. The excess data can overwrite adjacent memory areas and potentially corrupt program data, cause the application to crash, or create opportunities for attackers to execute malicious code. Buffer overflow vulnerabilities often result from improper input validation or unsafe memory management. A race condition occurs when the outcome depends on the timing of concurrent operations, directory traversal involves accessing files outside an intended directory, and SQL injection manipulates database queries. Therefore, buffer overflow is the correct answer because it specifically involves exceeding the allocated capacity of a memory buffer.<\/span><\/p>\n

                                Question 396<\/b><\/h3>\n

                                Which physical security control is designed to stop vehicles from entering a restricted area?<\/b><\/p>\n

                                  \n
                                1. Bollard<\/span><\/li>\n
                                2. Mantrap<\/span><\/li>\n
                                3. Badge reader<\/span><\/li>\n
                                4. Cable lock<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 1<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  A bollard is a physical security barrier designed to prevent or restrict vehicle access to protected areas. Bollards are commonly installed around buildings, entrances, sidewalks, parking areas, and other locations where unauthorized vehicles could create a security risk. They can be fixed, removable, or retractable depending on the security requirements. A mantrap controls pedestrian entry by using two doors, often preventing a person from entering an area without proper authorization. A badge reader verifies credentials for physical access, while a cable lock secures individual equipment or devices. Therefore, bollard is the correct answer because it is specifically designed to stop or control vehicles from entering restricted areas.<\/span><\/p>\n

                                  Question 397<\/b><\/h3>\n

                                  Which backup strategy copies only the data that has changed since the previous backup of any type?<\/b><\/p>\n

                                    \n
                                  1. Full backup<\/span><\/li>\n
                                  2. Differential backup<\/span><\/li>\n
                                  3. Incremental backup<\/span><\/li>\n
                                  4. Mirror backup<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 3<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    An incremental backup copies only the data that has changed since the most recent backup of any type. For example, after a full backup, the first incremental backup copies newly changed data. The next incremental backup copies only the data changed since that previous incremental backup. This approach can reduce backup time and storage requirements, although restoring data may require the full backup plus multiple incremental backups. A differential backup, in contrast, copies data changed since the most recent full backup. A full backup copies all selected data, while a mirror backup creates a direct copy. Therefore, incremental backup is correct because it tracks changes since the latest backup.<\/span><\/p>\n

                                    Question 398<\/b><\/h3>\n

                                    Which security device monitors network traffic and generates alerts when suspicious activity is detected but does not normally block the traffic?<\/b><\/p>\n

                                      \n
                                    1. IPS<\/span><\/li>\n
                                    2. IDS<\/span><\/li>\n
                                    3. Firewall<\/span><\/li>\n
                                    4. WAF<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 2<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      An Intrusion Detection System (IDS) monitors network or system activity and generates alerts when it detects patterns or behaviors that may indicate malicious activity. An IDS is primarily a detective security control, meaning it identifies and reports suspicious events rather than automatically preventing them. Security teams can investigate IDS alerts and take appropriate action. An Intrusion Prevention System (IPS) performs similar detection functions but can actively block or prevent detected threats. A firewall controls network traffic according to configured rules, while a WAF specifically protects web applications. Therefore, IDS is the correct answer because it is designed primarily to detect suspicious traffic and alert administrators without normally blocking it.<\/span><\/p>\n

                                      Question 399<\/b><\/h3>\n

                                      Which security objective ensures that authorized users can access systems and information when needed?<\/b><\/p>\n

                                        \n
                                      1. Confidentiality<\/span><\/li>\n
                                      2. Integrity<\/span><\/li>\n
                                      3. Availability<\/span><\/li>\n
                                      4. Non-repudiation<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 3<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        Availability is one of the three main objectives of the CIA triad and ensures that authorized users can access systems, services, applications, and information when they need them. Organizations improve availability through measures such as redundancy, backups, failover systems, disaster recovery plans, load balancing, and protection against denial-of-service attacks. Confidentiality protects information from unauthorized disclosure, while integrity ensures that information remains accurate and has not been improperly modified. Non-repudiation provides evidence that a particular action or transaction was performed by a specific entity. Therefore, availability is the correct answer because it focuses on keeping resources accessible and operational for authorized users.<\/span><\/p>\n

                                        Question 400<\/b><\/h3>\n

                                        Which process identifies the underlying reason that caused a security incident or recurring technical problem?<\/b><\/p>\n

                                          \n
                                        1. Root cause analysis<\/span><\/li>\n
                                        2. Data classification<\/span><\/li>\n
                                        3. Vulnerability scanning<\/span><\/li>\n
                                        4. Threat hunting<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 1<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          Root cause analysis is a structured process used to determine the fundamental reason an incident, failure, or recurring technical problem occurred. Instead of simply fixing the immediate symptoms, security and technical teams investigate contributing factors and identify what actually caused the problem. Understanding the root cause helps organizations implement corrective actions that prevent the same issue from happening again. Data classification organizes information according to sensitivity, vulnerability scanning identifies potential security weaknesses, and threat hunting proactively searches for signs of malicious activity. Therefore, root cause analysis is the correct answer because its purpose is to identify the underlying cause of an incident or recurring problem and support effective long-term corrective measures.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full\u00a0CompTIA SY0-701 Exam Dumps\u00a0and Practice Test Dumps.   Question 381 Which security control can restrict network access based on the physical address of a network interface? MAC filtering DNS filtering Content filtering URL filtering Correct Answer: 1 Explanation MAC filtering allows network administrators to control network access based on the Media Access Control (MAC) […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/11766"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=11766"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/11766\/revisions"}],"predecessor-version":[{"id":11767,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/11766\/revisions\/11767"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=11766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=11766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=11766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}