COMPTIA SECURITY+ (SYO-701) EXAM] – QUESTIONS AND ANSWERS |
VERIFIED AND WELL DETAILED ANSWERS PLUS RATIONALES |
GUARANTEED PASS | LATEST EXAM UPDATE | EXAM PREP | STUDY
GUIDE | PRACTICE TEST| DOWNLOAD INSTANT PDF
1. A security administrator is configuring a new firewall and wants to ensure that all traffic
is blocked by default, only allowing specific necessary protocols. Which of the following
security principles is being applied?
A. Least Privilege
B. Implicit Deny
C. Separation of Duties
D. Defense in Depth
An implicit deny policy means that any traffic not explicitly permitted by a rule is
automatically blocked. This is the foundational principle for firewall security configuration.
2. A company has experienced a breach where an attacker intercepted sensitive data
transmitted over an unencrypted wireless network. Which of the following should the
security team implement to ensure data confidentiality during transit?
A. WPA3-Enterprise
B. WEP
C. TKIP
D. WPS
WPA3-Enterprise provides robust encryption and authentication mechanisms suitable for
securing data in transit. WEP and TKIP are deprecated and insecure, while WPS is
vulnerable to brute-force attacks.
3. A developer is worried about SQL injection vulnerabilities in a web application. Which
of the following is the most effective way to prevent these attacks?
A. Implementing client-side validation
B. Using parameterized queries (prepared statements)
C. Configuring a WAF to block all POST requests
D. Obfuscating the database schema
Parameterized queries ensure that the database treats user input as data rather than
executable code, which is the most effective defense against SQL injection. Client-side
validation can be easily bypassed.
4. A Chief Information Security Officer (CISO) wants to implement a solution that
provides centralized management of identity and access for users across multiple cloud and
on-premises applications. Which of the following technologies should be used?
,A. RADIUS
B. TACACS+
C. Federation/SSO
D. LDAP
Federation, often implemented via technologies like SAML or OIDC, allows users to log in
once and access multiple systems, providing a centralized approach to identity management.
RADIUS and LDAP are generally more focused on specific network or directory services.
5. A security analyst is reviewing logs and notices a large number of failed login attempts
followed by a successful login from an unusual IP address. What type of attack is likely
occurring?
A. Cross-site scripting
B. Brute-force/Credential stuffing
C. Man-in-the-middle
D. Buffer overflow
The pattern of many failed attempts followed by a success is characteristic of a brute-force or
credential stuffing attack where an attacker attempts to gain unauthorized access to a user
account.
6. Which of the following cryptographic algorithms is considered symmetric and is
commonly used for high-speed bulk data encryption?
A. RSA
B. ECC
C. AES
D. Diffie-Hellman
AES (Advanced Encryption Standard) is a symmetric block cipher and is the industry
standard for bulk data encryption due to its performance and security. RSA, ECC, and Diffie-
Hellman are asymmetric (public-key) algorithms.
7. A network technician needs to monitor traffic on a specific segment of the network to
troubleshoot a suspected malware beaconing issue. Which tool or feature should they use to
mirror traffic to an IDS?
A. Port Mirroring/SPAN
B. VLAN tagging
C. Packet switching
D. Routing protocols
Port Mirroring, or Switch Port Analyzer (SPAN), allows a network switch to copy traffic from
one or more ports to a single port where a monitoring device like an IDS can analyze it
without disrupting traffic flow.
, 8. An organization requires that all administrative actions on sensitive servers be logged
and that at least two individuals must authorize specific high-risk changes. Which concept
is this?
A. Mandatory Access Control
B. Dual Control/Two-person integrity
C. Discretionary Access Control
D. Role-Based Access Control
Dual control ensures that a single individual cannot perform a sensitive action alone,
requiring a second person's approval or presence to mitigate the risk of fraud or accidental
errors.
9. During an incident response process, which of the following phases involves identifying
the scope, impact, and root cause of the security event?
A. Preparation
B. Containment
C. Analysis/Detection
D. Eradication
The analysis phase (often part of the Detection and Analysis stage) is focused on determining
exactly what happened, the scope of the incident, and identifying the root cause to guide
further response actions.
10. A business is moving to a cloud service model where they want the provider to manage
the physical infrastructure, OS, and runtime, while the business only manages the
application data. Which service model is this?
A. IaaS
B. PaaS
C. SaaS
D. DaaS
In Software as a Service (SaaS), the provider manages the entire stack, including the
application and the infrastructure. The customer is primarily responsible for their own data
and configuration.
11. A security administrator needs to implement a digital signature to verify the integrity
and origin of an email. Which of the following should be used?
A. Symmetric encryption
B. Asymmetric encryption (Private Key)
C. Hashing only
D. Steganography
VERIFIED AND WELL DETAILED ANSWERS PLUS RATIONALES |
GUARANTEED PASS | LATEST EXAM UPDATE | EXAM PREP | STUDY
GUIDE | PRACTICE TEST| DOWNLOAD INSTANT PDF
1. A security administrator is configuring a new firewall and wants to ensure that all traffic
is blocked by default, only allowing specific necessary protocols. Which of the following
security principles is being applied?
A. Least Privilege
B. Implicit Deny
C. Separation of Duties
D. Defense in Depth
An implicit deny policy means that any traffic not explicitly permitted by a rule is
automatically blocked. This is the foundational principle for firewall security configuration.
2. A company has experienced a breach where an attacker intercepted sensitive data
transmitted over an unencrypted wireless network. Which of the following should the
security team implement to ensure data confidentiality during transit?
A. WPA3-Enterprise
B. WEP
C. TKIP
D. WPS
WPA3-Enterprise provides robust encryption and authentication mechanisms suitable for
securing data in transit. WEP and TKIP are deprecated and insecure, while WPS is
vulnerable to brute-force attacks.
3. A developer is worried about SQL injection vulnerabilities in a web application. Which
of the following is the most effective way to prevent these attacks?
A. Implementing client-side validation
B. Using parameterized queries (prepared statements)
C. Configuring a WAF to block all POST requests
D. Obfuscating the database schema
Parameterized queries ensure that the database treats user input as data rather than
executable code, which is the most effective defense against SQL injection. Client-side
validation can be easily bypassed.
4. A Chief Information Security Officer (CISO) wants to implement a solution that
provides centralized management of identity and access for users across multiple cloud and
on-premises applications. Which of the following technologies should be used?
,A. RADIUS
B. TACACS+
C. Federation/SSO
D. LDAP
Federation, often implemented via technologies like SAML or OIDC, allows users to log in
once and access multiple systems, providing a centralized approach to identity management.
RADIUS and LDAP are generally more focused on specific network or directory services.
5. A security analyst is reviewing logs and notices a large number of failed login attempts
followed by a successful login from an unusual IP address. What type of attack is likely
occurring?
A. Cross-site scripting
B. Brute-force/Credential stuffing
C. Man-in-the-middle
D. Buffer overflow
The pattern of many failed attempts followed by a success is characteristic of a brute-force or
credential stuffing attack where an attacker attempts to gain unauthorized access to a user
account.
6. Which of the following cryptographic algorithms is considered symmetric and is
commonly used for high-speed bulk data encryption?
A. RSA
B. ECC
C. AES
D. Diffie-Hellman
AES (Advanced Encryption Standard) is a symmetric block cipher and is the industry
standard for bulk data encryption due to its performance and security. RSA, ECC, and Diffie-
Hellman are asymmetric (public-key) algorithms.
7. A network technician needs to monitor traffic on a specific segment of the network to
troubleshoot a suspected malware beaconing issue. Which tool or feature should they use to
mirror traffic to an IDS?
A. Port Mirroring/SPAN
B. VLAN tagging
C. Packet switching
D. Routing protocols
Port Mirroring, or Switch Port Analyzer (SPAN), allows a network switch to copy traffic from
one or more ports to a single port where a monitoring device like an IDS can analyze it
without disrupting traffic flow.
, 8. An organization requires that all administrative actions on sensitive servers be logged
and that at least two individuals must authorize specific high-risk changes. Which concept
is this?
A. Mandatory Access Control
B. Dual Control/Two-person integrity
C. Discretionary Access Control
D. Role-Based Access Control
Dual control ensures that a single individual cannot perform a sensitive action alone,
requiring a second person's approval or presence to mitigate the risk of fraud or accidental
errors.
9. During an incident response process, which of the following phases involves identifying
the scope, impact, and root cause of the security event?
A. Preparation
B. Containment
C. Analysis/Detection
D. Eradication
The analysis phase (often part of the Detection and Analysis stage) is focused on determining
exactly what happened, the scope of the incident, and identifying the root cause to guide
further response actions.
10. A business is moving to a cloud service model where they want the provider to manage
the physical infrastructure, OS, and runtime, while the business only manages the
application data. Which service model is this?
A. IaaS
B. PaaS
C. SaaS
D. DaaS
In Software as a Service (SaaS), the provider manages the entire stack, including the
application and the infrastructure. The customer is primarily responsible for their own data
and configuration.
11. A security administrator needs to implement a digital signature to verify the integrity
and origin of an email. Which of the following should be used?
A. Symmetric encryption
B. Asymmetric encryption (Private Key)
C. Hashing only
D. Steganography
