COMPTIA SECURITY+ SY0-701
CERTIFICATION EXAM WITH QUESTIONS
AND VERIFIED ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
1.
A security administrator discovers that an attacker has obtained a valid
employee username and password through a phishing campaign. The
attacker then logs into the company's VPN from an unfamiliar country.
The organization uses multifactor authentication (MFA), but the attacker
successfully approves an MFA push notification that was sent to the
employee's phone. Which attack most likely enabled the attacker to
bypass the intended protection?
A. Credential stuffing
B. Password spraying
C. MFA fatigue
D. Kerberoasting
Answer: C. MFA fatigue
Rationale: MFA fatigue, also called push bombing, involves repeatedly
sending authentication prompts to a victim until the victim
accidentally or intentionally approves one. The credentials may have
initially been obtained through phishing, but the repeated unsolicited
MFA prompts are the defining characteristic of the second-stage
attack. Credential stuffing uses credentials obtained from other
breaches, password spraying tries a small number of common
1
,passwords against many accounts, and Kerberoasting targets Kerberos
service-account tickets.
2.
A company wants to prevent unauthorized users from connecting
personal laptops to the corporate wired network. The security team
wants the switch to verify the identity of a device or user before granting
network access. Which technology is most appropriate?
A. 802.1X
B. WPA3
C. NAT
D. DNSSEC
Answer: A. 802.1X
Rationale: IEEE 802.1X provides port-based network access control
and can require authentication before a device receives normal
network access. It commonly works with an authentication server such
as RADIUS. WPA3 protects wireless networks, NAT translates
addresses, and DNSSEC protects DNS integrity and authenticity
rather than controlling physical network-port access.
3.
An organization discovers that an employee installed unauthorized
remote-access software on a workstation. The software establishes an
outbound encrypted connection to an external command-and-control
server. Which security concept is most directly involved?
A. Data masking
B. Command and control
2
,C. Geofencing
D. Tokenization
Answer: B. Command and control
Rationale: Command and control (C2 or C&C) refers to
communication between compromised systems and an attacker-
controlled infrastructure. Malware commonly establishes outbound
connections to receive instructions, transfer information, or download
additional payloads. Data masking and tokenization protect sensitive
data, while geofencing restricts activity based on geographic
boundaries.
4.
A penetration tester discovers that a web application accepts user input
through a URL parameter. The tester enters ' OR '1'='1 and gains
unauthorized access to database records. Which vulnerability is being
exploited?
A. Cross-site scripting
B. SQL injection
C. LDAP injection
D. Directory traversal
Answer: B. SQL injection
Rationale: SQL injection occurs when untrusted input is improperly
incorporated into SQL queries, allowing an attacker to manipulate the
database query's intended logic. Parameterized queries and prepared
statements are major defenses. Cross-site scripting targets browser-
side script execution, LDAP injection manipulates LDAP queries, and
directory traversal attempts to access unauthorized filesystem paths.
3
, 5.
A security analyst needs to identify suspicious activity that occurred on a
workstation several days ago. The analyst reviews operating-system
logs, authentication logs, application logs, and firewall records and
correlates timestamps across multiple systems. Which security activity is
being performed?
A. Threat hunting
B. Log analysis
C. Data sanitization
D. Vulnerability remediation
Answer: B. Log analysis
Rationale: Log analysis involves examining recorded events to identify
suspicious behavior, failures, policy violations, or evidence of
compromise. Correlating events from multiple sources can help
establish an attack timeline. Threat hunting is a broader proactive
search for threats, while sanitization and remediation address data
disposal and vulnerability treatment.
6.
A company wants to ensure that employees can access only the
applications and data necessary for their specific jobs. Which principle
should the organization implement?
A. Least privilege
B. Open access
C. Mandatory vacation
D. Non-repudiation
Answer: A. Least privilege
4
CERTIFICATION EXAM WITH QUESTIONS
AND VERIFIED ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
1.
A security administrator discovers that an attacker has obtained a valid
employee username and password through a phishing campaign. The
attacker then logs into the company's VPN from an unfamiliar country.
The organization uses multifactor authentication (MFA), but the attacker
successfully approves an MFA push notification that was sent to the
employee's phone. Which attack most likely enabled the attacker to
bypass the intended protection?
A. Credential stuffing
B. Password spraying
C. MFA fatigue
D. Kerberoasting
Answer: C. MFA fatigue
Rationale: MFA fatigue, also called push bombing, involves repeatedly
sending authentication prompts to a victim until the victim
accidentally or intentionally approves one. The credentials may have
initially been obtained through phishing, but the repeated unsolicited
MFA prompts are the defining characteristic of the second-stage
attack. Credential stuffing uses credentials obtained from other
breaches, password spraying tries a small number of common
1
,passwords against many accounts, and Kerberoasting targets Kerberos
service-account tickets.
2.
A company wants to prevent unauthorized users from connecting
personal laptops to the corporate wired network. The security team
wants the switch to verify the identity of a device or user before granting
network access. Which technology is most appropriate?
A. 802.1X
B. WPA3
C. NAT
D. DNSSEC
Answer: A. 802.1X
Rationale: IEEE 802.1X provides port-based network access control
and can require authentication before a device receives normal
network access. It commonly works with an authentication server such
as RADIUS. WPA3 protects wireless networks, NAT translates
addresses, and DNSSEC protects DNS integrity and authenticity
rather than controlling physical network-port access.
3.
An organization discovers that an employee installed unauthorized
remote-access software on a workstation. The software establishes an
outbound encrypted connection to an external command-and-control
server. Which security concept is most directly involved?
A. Data masking
B. Command and control
2
,C. Geofencing
D. Tokenization
Answer: B. Command and control
Rationale: Command and control (C2 or C&C) refers to
communication between compromised systems and an attacker-
controlled infrastructure. Malware commonly establishes outbound
connections to receive instructions, transfer information, or download
additional payloads. Data masking and tokenization protect sensitive
data, while geofencing restricts activity based on geographic
boundaries.
4.
A penetration tester discovers that a web application accepts user input
through a URL parameter. The tester enters ' OR '1'='1 and gains
unauthorized access to database records. Which vulnerability is being
exploited?
A. Cross-site scripting
B. SQL injection
C. LDAP injection
D. Directory traversal
Answer: B. SQL injection
Rationale: SQL injection occurs when untrusted input is improperly
incorporated into SQL queries, allowing an attacker to manipulate the
database query's intended logic. Parameterized queries and prepared
statements are major defenses. Cross-site scripting targets browser-
side script execution, LDAP injection manipulates LDAP queries, and
directory traversal attempts to access unauthorized filesystem paths.
3
, 5.
A security analyst needs to identify suspicious activity that occurred on a
workstation several days ago. The analyst reviews operating-system
logs, authentication logs, application logs, and firewall records and
correlates timestamps across multiple systems. Which security activity is
being performed?
A. Threat hunting
B. Log analysis
C. Data sanitization
D. Vulnerability remediation
Answer: B. Log analysis
Rationale: Log analysis involves examining recorded events to identify
suspicious behavior, failures, policy violations, or evidence of
compromise. Correlating events from multiple sources can help
establish an attack timeline. Threat hunting is a broader proactive
search for threats, while sanitization and remediation address data
disposal and vulnerability treatment.
6.
A company wants to ensure that employees can access only the
applications and data necessary for their specific jobs. Which principle
should the organization implement?
A. Least privilege
B. Open access
C. Mandatory vacation
D. Non-repudiation
Answer: A. Least privilege
4
