COMPTIA SECURITY PLUS SYO 601 2026
MOCK EXAMS WITH EXPLANATIONS AND
SOLUTIONS
◉ You have been hired as a consultant to help Dion Training develop
a new disaster recovery plan. Dion Training has recently grown in
the number of employees and information systems infrastructure
used to support its employees. Unfortunately, Dion Training does not
currently have any documentation, policies, or procedures for its
student and faculty networks. What is the first action you should
take to assist them in developing a disaster recovery plan? Answer:
Identify the organization's assets
◉ Samantha works in the human resource department in an open
floorplan office. She is concerned about the possibility of someone
conducting shoulder surfing to read sensitive information from
employee files while accessing them on her computer. Which of the
following physical security measures should she implement to
protect against this threat? Answer: Privacy screen
◉ Your organization has been receiving many phishing emails
recently, and you are trying to determine why they are effective in
getting your users to click on their links. The latest email consists of
what looks like an advertisement that is offering an exclusive early
access opportunity to buy a new iPhone at a discounted price. Still,
,there are only 5 phones available at this price. What type of social
engineering principle is being exploited here? Answer: Scarcity
◉ What popular open-source port scanning tool is commonly used
for host discovery and service identification? Answer: nmap
◉ Dion Training has a $15,000 server that has frequently been
crashing. Over the past 12 months, the server has crashed 10 times,
requiring the server to be rebooted to recover from the crash. Each
time, this has resulted in a 5% loss of functionality or data. Based on
this information, what is the Annual Loss Expectancy (ALE) for this
server? Answer: $7,500
◉ Dion Training has an open wireless network called
"InstructorDemos" for its instructors to use during class, but they do
not want any students connecting to this wireless network. The
instructors need the "InstructorDemos" network to remain open
since some of their IoT devices used during course demonstrations
do not support encryption. Based on the requirements provided,
which of the following configuration settings should you use to
satisfy the instructor's requirements and prevent students from
using the "InstructorDemos" network? Answer: MAC filtering
◉ You are developing your vulnerability scanning plan and
attempting to scope your scans properly. You have decided to focus
on the criticality of a system to the organization's operations when
prioritizing the system in the scope of your scans. Which of the
, following would be the best place to gather the criticality of a
system? Answer: Review the asset inventory and BCP
◉ What is the correct order of the Incident Response process?
Answer: Preparation, Identification, Containment, Eradication,
Recovery, and Lessons Learned
◉ Which type of threat actor can accidentally or inadvertently cause
a security incident in your organization? Answer: Insider threat
◉ Dion Training has applied a new Group Policy to all student
accounts that will lock out any account in which the student enters
their password incorrectly 3 times in a row. Once the account is
locked out, the student must wait 15 minutes before they can
attempt to log in again. What type of attack is this mitigation
strategy trying to prevent? Answer: Brute force attack
◉ Which of the following cryptographic algorithms is classified as
symmetric? Answer: 3DES
◉ Fail to Pass Systems has just become the latest victim in a large-
scale data breach by an APT. Your initial investigation confirms a
massive exfiltration of customer data has occurred. Which of the
following actions do you recommend to the CEO of Fail to Pass
Systems in handling this data breach? Answer: Conduct notification
MOCK EXAMS WITH EXPLANATIONS AND
SOLUTIONS
◉ You have been hired as a consultant to help Dion Training develop
a new disaster recovery plan. Dion Training has recently grown in
the number of employees and information systems infrastructure
used to support its employees. Unfortunately, Dion Training does not
currently have any documentation, policies, or procedures for its
student and faculty networks. What is the first action you should
take to assist them in developing a disaster recovery plan? Answer:
Identify the organization's assets
◉ Samantha works in the human resource department in an open
floorplan office. She is concerned about the possibility of someone
conducting shoulder surfing to read sensitive information from
employee files while accessing them on her computer. Which of the
following physical security measures should she implement to
protect against this threat? Answer: Privacy screen
◉ Your organization has been receiving many phishing emails
recently, and you are trying to determine why they are effective in
getting your users to click on their links. The latest email consists of
what looks like an advertisement that is offering an exclusive early
access opportunity to buy a new iPhone at a discounted price. Still,
,there are only 5 phones available at this price. What type of social
engineering principle is being exploited here? Answer: Scarcity
◉ What popular open-source port scanning tool is commonly used
for host discovery and service identification? Answer: nmap
◉ Dion Training has a $15,000 server that has frequently been
crashing. Over the past 12 months, the server has crashed 10 times,
requiring the server to be rebooted to recover from the crash. Each
time, this has resulted in a 5% loss of functionality or data. Based on
this information, what is the Annual Loss Expectancy (ALE) for this
server? Answer: $7,500
◉ Dion Training has an open wireless network called
"InstructorDemos" for its instructors to use during class, but they do
not want any students connecting to this wireless network. The
instructors need the "InstructorDemos" network to remain open
since some of their IoT devices used during course demonstrations
do not support encryption. Based on the requirements provided,
which of the following configuration settings should you use to
satisfy the instructor's requirements and prevent students from
using the "InstructorDemos" network? Answer: MAC filtering
◉ You are developing your vulnerability scanning plan and
attempting to scope your scans properly. You have decided to focus
on the criticality of a system to the organization's operations when
prioritizing the system in the scope of your scans. Which of the
, following would be the best place to gather the criticality of a
system? Answer: Review the asset inventory and BCP
◉ What is the correct order of the Incident Response process?
Answer: Preparation, Identification, Containment, Eradication,
Recovery, and Lessons Learned
◉ Which type of threat actor can accidentally or inadvertently cause
a security incident in your organization? Answer: Insider threat
◉ Dion Training has applied a new Group Policy to all student
accounts that will lock out any account in which the student enters
their password incorrectly 3 times in a row. Once the account is
locked out, the student must wait 15 minutes before they can
attempt to log in again. What type of attack is this mitigation
strategy trying to prevent? Answer: Brute force attack
◉ Which of the following cryptographic algorithms is classified as
symmetric? Answer: 3DES
◉ Fail to Pass Systems has just become the latest victim in a large-
scale data breach by an APT. Your initial investigation confirms a
massive exfiltration of customer data has occurred. Which of the
following actions do you recommend to the CEO of Fail to Pass
Systems in handling this data breach? Answer: Conduct notification
