[Sep 09, 2026] Get to the Top with SY0-701 Practice Exam Questions [Q195-Q214]

4.5/5 - (2 votes)

[Sep 09, 2026] Get to the Top with SY0-701 Practice Exam Questions

Use Real SY0-701 Dumps Free Sample Questions and Practice Test Engine

CompTIA SY0-701 Exam Syllabus Topics:

Section	Weight	Objectives
Topic 1: Security Architecture	18%	– Zero trust and secure infrastructure 1. Zero trust principles 2. Infrastructure hardening 3. Secure deployment models – Cloud and virtualization security 1. Cloud security controls 2. Virtual machine security 3. Cloud service models – Secure network design 1. Network segmentation 2. Software-defined networking 3. Secure protocols and services
Topic 2: Security Program Management and Oversight	20%	– Compliance and audit 1. Regulatory compliance frameworks 2. Audit and assessment processes 3. Data privacy and protection – Risk management 1. Third-party risk management 2. Risk identification and assessment 3. Risk mitigation strategies – Security strategy and governance 1. Security training and awareness 2. Security metrics and reporting 3. Security policy development
Topic 3: General Security Concepts	12%	– Security frameworks and governance 1. Compliance requirements 2. Security models 3. Security policies and standards – Security fundamentals 1. Security controls types 2. Defense in depth 3. Confidentiality, integrity, availability – Cryptography basics 1. Hashing and digital signatures 2. Encryption algorithms 3. Public key infrastructure
Topic 4: Security Operations	28%	– Security monitoring and logging 1. SIEM and log management 2. Continuous monitoring 3. Alert analysis and response – Endpoint and application security 1. Patch and vulnerability management 2. Endpoint protection platforms 3. Application security controls – Identity and access management 1. Identity governance 2. Authentication and authorization 3. Access control models – Incident response and forensics 1. Evidence collection and handling 2. Recovery and post-incident activities 3. Incident response lifecycle
Topic 5: Threats, Vulnerabilities, and Mitigations	22%	– Vulnerabilities and risks 1. Risk assessment strategies 2. Zero-day exploits 3. Software and hardware vulnerabilities – Attack types and defenses 1. Application attacks 2. Network attacks 3. Mitigation techniques – Threat actors and motivations 1. Types of threat actors 2. Attack vectors and surfaces 3. Social engineering

Q195. After reviewing the following vulnerability scanning report:

A security analyst performs the following test:

Which of the following would the security analyst conclude for this reported vulnerability?

It is a false positive.

A rescan is required.

It is considered noise.

Compensating controls exist.

Q196. A user downloaded software from an online forum. After the user installed the software, the security team observed external network traffic connecting to the user’s computer on an uncommon port. Which of the following is the most likely explanation of this unauthorized connection?

The software had a hidden keylogger.

The software was ransomware.

The user’s computer had a fileless virus.

The software contained a backdoor.

Q197. A company experiences a breach. The investigation reveals that the threat actor used a zero-day vulnerability to gain access and move laterally. Which of the following would best improve the company’s security posture and minimize the time to detect this type of incident?

NAC

IDS

DLP

UBA

Q198. As part of new compliance audit requirements, multiple servers need to be segmented on different networks and should be reachable only from authorized internal systems. Which of the following would meet the requirements?

Configure firewall rules to block external access to Internal resources.

Set up a WAP to allow internal access from public networks.

Implement a new IPSec tunnel from internal resources.

Deploy an Internal Jump server to access resources.

Q199. Which of the following activities should be included as part of passive reconnaissance in a penetration test?

Domain Name System (DNS) zone transfer

Vulnerability scanning

Social engineering

Google hacking

Q200. To improve the security at a data center, a security administrator implements a CCTV system and posts several signs about the possibility of being filmed. Which of the following best describe these types of controls? (Select two).

Preventive

Deterrent

Corrective

Directive

Compensating

Detective

Q201. Which of the following enables the use of an input field to run commands that can view or manipulate data?

Cross-site scripting

Side loading

Buffer overflow

SQL injection

Q202. Sine?a recent upgrade (o a WLAN infrastructure, several mobile users have been unable to access the internet from the lobby. The networking team performs a heat map survey of the building and finds several WAPs in the area. The WAPs are using similar frequencies with high power settings. Which of the following installation considerations should the security team evaluate next?

Channel overlap

Encryption type

New WLAN deployment

WAP placement

Q203. An organization has experienced a breach because a hacker utilized a standard users two-year- old password that the hacker found on the dark web. Which of the following would have prevented this attack?

Privileged access management

Account lockout

Reuse policy

Complexity requirements

Q204. An organization experiences data loss after several employees traveled to an area that is well- known for corporate espionage. The employees always used VPNs when connected to the hotel Wi-Fi, logged off their machines when not in use, and kept their doors locked when leaving their devices unattended. Which of the following will best prevent data loss events in the future?

Data sanitization

WAF

FDE

Split tunneling

Q205. A manager meets with various stakeholders involved with a recently resolved security incident.
During the meeting, they discuss potential improvements to the environment in order to better respond to future incidents. Which of the following incident response activities does this describe?

Recovery

Analysis

Lessons learned

Containment

Q206. Select the appropriate attack and remediation from each drop-down list to label the corresponding attack with its remediation.
INSTRUCTIONS
Not all attacks and remediation actions will be used.
If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

Q207. A company wants to verify that the software the company is deploying came from the vendor the company purchased the software from. Which of the following is the best way for the company to confirm this information?

Validate the code signature.

Execute the code in a sandbox.

Search the executable for ASCII strings.

Generate a hash of the files.

Q208. Which of the following enables the use of an input field to run commands that can view or manipulate data?

Cross-site scripting

Side loading

Buffer overflow

SQL injection

Q209. Which of the following would be the best ways to ensure only authorized personnel can access a secure facility? (Select two).

Fencing

Video surveillance

Badge access

Access control vestibule

Sign-in sheet

Sensor

Q210. Which of the following can be used to identify potential attacker activities without affecting production servers?

Honey pot

Video surveillance

Zero Trust

Geofencing

Q211. A systems administrator receives the following alert from a file integrity monitoring tool:
The hash of the cmd.exe file has changed.
The systems administrator checks the OS logs and notices that no patches were applied in the last two months.
Which of the followingmostlikely occurred?

The end user changed the file permissions.

A cryptographic collision was detected.

A snapshot of the file system was taken.

A rootkit was deployed.

Q212. Which of the following can best protect against an employee inadvertently installing malware on a company system?

Host-based firewall

System isolation

Least privilege

Application allow list

Q213. A security architect at a large, multinational organization is concerned about the complexities and overhead of managing multiple encryption keys securely in a multicloud provider environment.
The security architect is looking for a solution with reduced latency to allow the incorporation of the organization’s existing keys and to maintain consistent, centralized control and management regardless of the data location. Which of the following would best meet the architect’s objectives?

Trusted Platform Module

IaaS

HSMaaS

PaaS

Q214. Which of the following is the best way to consistently determine on a daily basis whether security settings on servers have been modified?

Automation

Compliance checklist

Attestation

Manual audit

Automation is the best way to consistently determine on a daily basis whether security settings on servers have been modified. Automation is the process of using software, hardware, or other tools to perform tasks that would otherwise require human intervention or manual effort. Automation can help to improve the efficiency, accuracy, and consistency of security operations, as well as reduce human errors and costs. Automation can be used to monitor, audit, and enforce security settings on servers, such as firewall rules, encryption keys, access controls, patch levels, and configuration files. Automation can also alert security personnel of any changes or anomalies that may indicate a security breach or compromise12.
The other options are not the best ways to consistently determine on a daily basis whether security settings on servers have been modified:
Compliance checklist: This is a document that lists the security requirements, standards, or best practices that an organization must follow or adhere to. A compliance checklist can help to ensure that the security settings on servers are aligned with the organizational policies and regulations, but it does not automatically detect or report any changes or modifications that may occur on a daily basis3.
Attestation: This is a process of verifying or confirming the validity or accuracy of a statement, claim, or fact. Attestation can be used to provide assurance or evidence that the security settings on servers are correct and authorized, but it does not continuously monitor or audit any changes or modifications that may occur on a daily basis4.
Manual audit: This is a process of examining or reviewing the security settings on servers by human inspectors or auditors. A manual audit can help to identify and correct any security issues or discrepancies on servers, but it is time-consuming, labor-intensive, and prone to human errors. A manual audit may not be feasible or practical to perform on a daily basis.
Reference = 1: CompTIA Security+ SY0-701 Certification Study Guide, page 1022: Automation and Scripting – CompTIA Security+ SY0-701 – 5.1, video by Professor Messer3: CompTIA Security+ SY0-701 Certification Study Guide, page 974: CompTIA Security+ SY0-701 Certification Study Guide, page 98. : CompTIA Security+ SY0-701 Certification Study Guide, page 99.