CompTIA Security+ practice questions

1. Question 1 of 25

   Which of the following threat actors is the most likely to be hired by a foreign government to attack critical systems located in other countries?

   • AHacktivist
   • BWhistleblower
   • COrganized crime
   • DUnskilled attacker

   Show answer

   Correct answer: C

   How others answered

   • C72%
   • A28%

   Only 72% agreed on this answer — treat it as contested rather than settled.

   Explanation

   C. Organized crime Organized crime groups often have the resources, expertise, and networks to carry out sophisticated cyber attacks on behalf of governments or other entities for financial gain or political motives.

   Adapted from community discussion by lauren2wright · 2024-05-06 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

   1. L

      lauren2wright

      2024-05-06

      14 upvotes

      C. Organized crime Organized crime groups often have the resources, expertise, and networks to carry out sophisticated cyber attacks on behalf of governments or other entities for financial gain or political motives.

   2. E

      ermahasra

      2024-10-03

      Selected C3 upvotes

      C. Organized crime In the context of CompTIA Security+, organized crime refers to structured groups that are engaged in illegal activities, typically for financial gain. These groups are often highly sophisticated, well-funded, and operate with a high degree of coordination. They may be involved in various forms of cybercrime, including: Fraud: Engaging in activities such as credit card fraud, identity theft, and financial scams. Ransomware Attacks: Encrypting data and demanding a ransom for the decryption key. Data Breaches: Stealing sensitive information from organizations to sell on the black market or use for further criminal activities. Money Laundering: Using various techniques to disguise the origins of illegally obtained money. Drug Trafficking: Using online platforms to facilitate the sale and distribution of illegal drugs.

   3. A

      Anyio

      2024-10-17

      3 upvotes

      The answer is C. Organized crime. Organized crime groups are often well-funded, highly skilled, and capable of carrying out sophisticated cyberattacks, including those targeting critical infrastructure. Governments might collaborate with or hire these groups for cyber espionage, sabotage, or other malicious activities aimed at destabilizing or compromising another nation's critical systems. Hacktivists typically act independently for political or social reasons and are less likely to be directly hired by governments. Whistleblowers expose internal wrongdoings and are not typically involved in attacking external systems. Unskilled attackers (often referred to as "script kiddies") lack the expertise necessary for carrying out complex attacks on critical systems. Thus, organized crime groups are the most likely threat actors in this scenario.

   4. W

      way12

      2024-12-20

      Selected C2 upvotes

      the question points to a collection of attackers that is organized and they are targeting governments

2. Question 2 of 25

   Select 2

   An employee receives a text message that appears to have been sent by the payroll department and is asking for credential verification. Which of the following social engineering techniques are being attempted? (Choose two.)

   • ATyposquatting
   • BPhishing
   • CImpersonation
   • DVishing
   • ESmishing
   • FMisinformation

   Show answer

   Correct answer: C, E

   How others answered

   • CE86%

   Explanation

   In this scenario, where an employee receives a text message appearing to be from the payroll department asking for credential verification, the following social engineering techniques are being attempted: C. Impersonation - The attacker is pretending to be a trusted entity (the payroll department) to gain the employee's trust and obtain their credentials. E. Smishing - Smishing (SMS phishing) involves sending fraudulent text messages to trick individuals into revealing personal information, such as credentials, by clicking on a link or responding to the message.

   Adapted from community discussion by Etc_Shadow28000 · 2024-10-03 · 15 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

   1. E

      Etc_Shadow28000

      2024-10-03

      Selected C, E15 upvotes

      In this scenario, where an employee receives a text message appearing to be from the payroll department asking for credential verification, the following social engineering techniques are being attempted: C. Impersonation - The attacker is pretending to be a trusted entity (the payroll department) to gain the employee's trust and obtain their credentials. E. Smishing - Smishing (SMS phishing) involves sending fraudulent text messages to trick individuals into revealing personal information, such as credentials, by clicking on a link or responding to the message.

   2. P

      pedrwc7

      2024-09-20

      Selected C, E6 upvotes

      A. Typosquatting (Impersonation of legitimate URL) B. Phishing (Emails) C. Impersonation (Acting as someone) D. Vishing (Voice Phishing) E. Smishing (Message Phishing or Text Phishing) F. Misinformation (Providing wrong information or fake information or news)

   3. D

      dbrowndiver

      2024-10-03

      Selected C, E1 upvote

      Answer C: Pretending to Be Payroll: The text message claims to be from the payroll department, a trusted entity within the company. This impersonation aims to create a sense of urgency and legitimacy, convincing the employee to comply with the request for credential verification. The attacker is leveraging the employee's trust in the payroll department to obtain sensitive information, which is a classic example of impersonation in social engineering. Answer E: The attack occurs through a text message, making it a clear case of smishing. The attacker uses SMS to deliver the deceptive message, which asks for credential verification under the guise of being from a legitimate source. Why it is important, since the message is delivered via text and is attempting to harvest credentials, it aligns perfectly with the definition of smishing.

   4. M

      MAKOhunter33333333

      2024-05-12

      Selected C, E4 upvotes

      Text messages = smishing Appears to be payroll = impersonation

3. Question 3 of 25

   After reviewing the following vulnerability scanning report:

   

   A security analyst performs the following test:

   

   Which of the following would the security analyst conclude for this reported vulnerability?

   • AIt is a false positive.
   • BA rescan is required.
   • CIt is considered noise.
   • DCompensating controls exist.

   Show answer

   Correct answer: A

   How others answered

   • A57%
   • D42%

   Only 57% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Telnet itself is inherently insecure and it transmits data including passwords in plaintext making it vulnerable to interception and eavesdropping. While using encryption with telnet is not typical but it is possible, however there are other secure alternatives out there like SSH. So while it is true that Telnet is an unsecure protocol, having encryption is just a compensating control here. So the answer is D.

   Adapted from community discussion by a4e15bd · 2024-07-29 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

   1. A

      a4e15bd

      2024-07-29

      20 upvotes

      Telnet itself is inherently insecure and it transmits data including passwords in plaintext making it vulnerable to interception and eavesdropping. While using encryption with telnet is not typical but it is possible, however there are other secure alternatives out there like SSH. So while it is true that Telnet is an unsecure protocol, having encryption is just a compensating control here. So the answer is D.

   2. M

      mr_reyes

      2024-05-21

      Selected A17 upvotes

      False Positive: A false positive occurs when a vulnerability scanner incorrectly identifies a vulnerability that doesn’t actually exist. In this case, the initial vulnerability report flagged the use of an insecure network protocol (Telnet) on the server at 192.168.14.6. However, the follow-up test using Nmap with the telnet-encryption script revealed that the Telnet server supports encryption. Since encryption enhances security, the initial report was incorrect. Therefore, the conclusion is that the initial report was a false positive.

   3. 4

      420JhonnySins69

      2024-09-09

      12 upvotes

      Option D is the more reasonable. Compensating controls. is a secondary/supporting security control that prevents the vulnerability from being exploited. (encryption in this case) False Positive: believes that there's a vulnerability but when physically checked is not there. (Telnet is being used, the vulnerability of plain text is there.) False positive https://youtu.be/EJL0h4u871w?list=PL7XJSuT7Dq_UDJgYoQGIW9viwM5hc4C7n&t=6652 Objective (4.3 Explain various activities associated with vulnerability management) https://youtu.be/EJL0h4u871w?list=PL7XJSuT7Dq_UDJgYoQGIW9viwM5hc4C7n&t=7199

   4. D

      dbrowndiver

      2024-08-02

      Selected A9 upvotes

      Why This Is a False Positive: 1. Understanding Telnet: General Security Issues: Telnet typically transmits data in plaintext, making it susceptible to eavesdropping and other security vulnerabilities. This is why it is often flagged in security scans. 2. Encryption Support: Security Enhancement: The presence of encryption changes the security profile of Telnet. If encryption is supported and properly implemented, the transmission of data is secure, counteracting the usual vulnerabilities associated with Telnet. 3. Initial Assessment: Misinterpretation: The initial report indicated a vulnerability due to a general assumption that Telnet is insecure, without verifying the specific configuration that includes encryption. 4. Conclusion: False Positive: Since the Telnet server supports encryption, the assumption of insecurity was incorrect. The vulnerability scanner flagged an issue based on typical characteristics rather than the actual configuration of this specific Telnet implementation.

4. Question 4 of 25

   An organization disabled unneeded services and placed a firewall in front of a business-critical legacy system. Which of the following best describes the actions taken by the organization?

   • AException
   • BSegmentation
   • CRisk transfer
   • DCompensating controls

   Show answer

   Correct answer: D

   How others answered

   • D96%

   Explanation

   D. Compensating controls The actions taken by the organization—disabling unneeded services and placing a firewall in front of a business-critical legacy system—are examples of compensating controls. Compensating controls are security measures that are implemented to mitigate risk when the primary controls are not feasible or sufficient. In this case, since the legacy system might have inherent vulnerabilities that cannot be fully addressed, the organization has implemented additional controls to reduce the risk. Therefore, the correct answer is: D. Compensating controls

   Adapted from community discussion by Etc_Shadow28000 · 2024-06-12 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

   1. E

      Etc_Shadow28000

      2024-06-12

      Selected D8 upvotes

      D. Compensating controls The actions taken by the organization—disabling unneeded services and placing a firewall in front of a business-critical legacy system—are examples of compensating controls. Compensating controls are security measures that are implemented to mitigate risk when the primary controls are not feasible or sufficient. In this case, since the legacy system might have inherent vulnerabilities that cannot be fully addressed, the organization has implemented additional controls to reduce the risk. Therefore, the correct answer is: D. Compensating controls

   2. T

      Th3irdEye

      2024-05-16

      Selected D10 upvotes

      The word "legacy" should inform that this action is compensating.

   3. D

      dbrowndiver

      2024-08-02

      Selected D2 upvotes

      Compensating controls is the best choice because the actions taken by the organization are intended to mitigate the risks associated with a legacy system when more standard security measures cannot be applied. By implementing these alternative controls, the organization effectively enhances the security of the legacy system without requiring direct updates or changes to its structure.

   4. S

      SHADTECH123

      2024-05-18

      Selected D1 upvote

      Compensating controls are alternative measures implemented to mitigate the risk of a vulnerability when the primary controls cannot be applied. In this scenario, the organization has: Disabled unneeded services: This reduces the attack surface of the legacy system, limiting potential vulnerabilities. Placed a firewall in front of the system: This provides an additional layer of security, controlling and monitoring the traffic to and from the legacy system.

5. Question 5 of 25

   After a security awareness training session, a user called the IT help desk and reported a suspicious call. The suspicious caller stated that the Chief Financial Officer wanted credit card information in order to close an invoice. Which of the following topics did the user recognize from the training?

   • AInsider threat
   • BEmail phishing
   • CSocial engineering
   • DExecutive whaling

   Show answer

   Correct answer: C

   How others answered

   • C84%
   • D16%

   Explanation

   Answer is C....Social engineering is the practice of manipulating people into performing actions or divulging confidential information, often by impersonating someone else or creating a sense of urgency or trust. The suspicious caller in this scenario was trying to use social engineering to trick the user into giving away credit card information by pretending to be the CFO and asking for a payment. The user recognized this as a potential scam and reported it to the IT help desk. The other topics are not relevant to this situation.

   Adapted from community discussion by geocis · 2024-06-17 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

   1. E

      EXAMM3R

      2024-06-27

      20 upvotes

      Executive whaling is when the CFO is one being targeted, therefore the answer is C

   2. G

      geocis

      2024-06-17

      9 upvotes

      Answer is C....Social engineering is the practice of manipulating people into performing actions or divulging confidential information, often by impersonating someone else or creating a sense of urgency or trust. The suspicious caller in this scenario was trying to use social engineering to trick the user into giving away credit card information by pretending to be the CFO and asking for a payment. The user recognized this as a potential scam and reported it to the IT help desk. The other topics are not relevant to this situation.

   3. B

      Bimbo_12

      2024-07-22

      Selected C4 upvotes

      C. Social engineering Explanation: Social engineering is a manipulation technique that exploits human error to gain private information, access, or valuables. In this scenario, the suspicious caller was attempting to deceive the user into providing credit card information by falsely claiming to be acting on behalf of the Chief Financial Officer. This tactic is a classic example of social engineering, where the attacker uses social manipulation rather than technical hacking methods to obtain sensitive information. It is not D because this is a type of phishing attack that specifically targets high-profile executives (also known as "whales") to steal sensitive information. While the scenario does involve the mention of a high-ranking executive, it is broader in scope and fits under the general category of social engineering rather than a specific whaling attack through email.

   4. D

      dbrowndiver

      2024-08-02

      Selected C5 upvotes

      Suspicious caller impersonated someone with authority (CFO) to trick the user into providing credit card information. This is a classic example of social engineering, where the attacker exploits trust and urgency to extract sensitive data. The scenario matches the characteristics of a social engineering attack, as it involves manipulating the victim through a phone call rather than using technological methods or digital communication channels.

6. Question 6 of 25

   A security administrator is deploying a DLP solution to prevent the exfiltration of sensitive customer data. Which of the following should the administrator do first?

   • ABlock access to cloud storage websites.
   • BCreate a rule to block outgoing email attachments.
   • CApply classifications to the data.
   • DRemove all user permissions from shares on the file server.

   Show answer

   Correct answer: C

   How others answered

   • C86%

   Explanation

   Apply classifications to the data is the correct first step because it establishes a foundational understanding of what data is sensitive and needs protection. By classifying the data, the security administrator can ensure that subsequent DLP policies are effectively tailored to prevent the exfiltration of sensitive customer data, while minimizing unnecessary restrictions on non-sensitive data.

   Adapted from community discussion by dbrowndiver · 2024-08-02 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

   1. D

      dbrowndiver

      2024-08-02

      Selected C10 upvotes

      Apply classifications to the data is the correct first step because it establishes a foundational understanding of what data is sensitive and needs protection. By classifying the data, the security administrator can ensure that subsequent DLP policies are effectively tailored to prevent the exfiltration of sensitive customer data, while minimizing unnecessary restrictions on non-sensitive data.

   2. J

      Justhereforcomptia

      2024-08-19

      3 upvotes

      So you're gonna block all the end-users from sending attachments ? are you serious... What should be done, is classify the files you have first then block the sensitive ones from being sent as attachments. Blocking everything doesn't make any sense in the context of this question. Correct Answer is C

   3. A

      Anyio

      2025-01-18

      Selected C1 upvote

      The NIST (National Institute of Standards and Technology) Risk Management Framework (RMF) is a seven-step process that helps organizations manage security and privacy risks. The steps are: Prepare: Prepare the organization to manage security and privacy risks Categorize: Classify the system to be evaluated for risk Select: Choose controls Implement: Put the controls in place Assess: Evaluate the controls Authorize: Get approval for the system Monitor: Continuously monitor the controls Categorize == Classification

   4. N

      nyyankee718

      2024-07-21

      Selected C2 upvotes

      its asking what to do FIRST/ How would users know what not to send out if data is not classified

7. Question 7 of 25

   Select 2

   Several employees received a fraudulent text message from someone claiming to be the Chief Executive Officer (CEO). The message stated: “I’m in an airport right now with no access to email. I need you to buy gift cards for employee recognition awards. Please send the gift cards to following email address.” Which of the following are the best responses to this situation? (Choose two).

   • ACancel current employee recognition gift cards.
   • BAdd a smishing exercise to the annual company training.
   • CIssue a general email warning to the company.
   • DHave the CEO change phone numbers.
   • EConduct a forensic investigation on the CEO’s phone.
   • FImplement mobile device management.

   Show answer

   Correct answer: B, C

   How others answered

   • BC92%

   Explanation

   It is already known that the message is not being sent from the CEO, & awareness of this attack should be known among the company by using the proper training to identify when an attacker is smishing using employee likeness. It is not known if devices are compromised, but if employees are aware of the situation, then that can be figured out as well.

   Adapted from community discussion by Mehsotopes · 2024-05-08 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

   1. M

      Mehsotopes

      2024-05-08

      Selected B, C12 upvotes

      It is already known that the message is not being sent from the CEO, & awareness of this attack should be known among the company by using the proper training to identify when an attacker is smishing using employee likeness. It is not known if devices are compromised, but if employees are aware of the situation, then that can be figured out as well.

   2. A

      AbdullahMohammad251

      2024-10-03

      Selected B, C6 upvotes

      A fraudulent message was sent without spoofing the sender's number, indicating the message did not come from a legitimate source and the phone wasn't stolen. Therefore, we don't need to change numbers or conduct a forensic investigation on the CEO's phone. We will first inform the employees about the current smishing attack. Then, adjust the annual Company training to include awareness of and protection against similar smishing attacks.

   3. D

      dbrowndiver

      2024-10-03

      Selected B, C3 upvotes

      In this scenario, employees have received a fraudulent text message impersonating the CEO, aiming to trick them into purchasing and sending gift cards. The attack is a classic example of smishing, a type of phishing conducted through SMS Add a smishing exercise to the annual company training-Training employees through realistic exercises will prepare them for recognizing smishing attempts in the future. They will learn how to spot red flags in messages that seem urgent and authoritative but are suspicious in nature. Issue a general email warning to the company-o Alerting the organization helps contain the threat and reduces the chance of employees inadvertently engaging with the scam. It is an immediate response that mitigates risk by stopping the scam in its tracks.

   4. A

      AbdullahMohammad251

      2024-06-24

      Selected B, C2 upvotes

      A fraudulent message was used, and the sender's number was not spoofed, meaning the message didn't come from a legitimate source. The question didn't mention the phone was stolen either. Therefore, we don't need to change numbers or conduct a forensic investigation on the CEO's phone. First, we will inform the employees about the current smishing attack. Then, we will adjust our annual company training to include protection against smishing attacks.

8. Question 8 of 25

   A company is adding a clause to its AUP that states employees are not allowed to modify the operating system on mobile devices. Which of the following vulnerabilities is the organization addressing?

   • ACross-site scripting
   • BBuffer overflow
   • CJailbreaking
   • DSide loading

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   My first thought was: D - because jailbreaking only relates to iOS and rooting is Android. They didn't specify a device. However... The question relates to modifying the OS, not installing unofficial apps. So, although no OS is specified, answer C does seem most logical. It pays to take a little more time to dissect the wording of the question as much as possible.

   Adapted from community discussion by leedsbarber · 2024-06-09 · 16 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

   1. L

      leedsbarber

      2024-06-09

      Selected C16 upvotes

      My first thought was: D - because jailbreaking only relates to iOS and rooting is Android. They didn't specify a device. However... The question relates to modifying the OS, not installing unofficial apps. So, although no OS is specified, answer C does seem most logical. It pays to take a little more time to dissect the wording of the question as much as possible.

   2. D

      dbrowndiver

      2024-08-02

      Selected C5 upvotes

      Jailbreaking is the correct answer because it specifically involves modifying the operating system on mobile devices, which the company's Acceptable Use Policy aims to prohibit. By addressing jailbreaking, the company seeks to maintain the security and integrity of its mobile devices, preventing vulnerabilities associated with unauthorized OS modifications.

   3. B

      Burg

      2024-12-22

      3 upvotes

      Definitely agree. Especially with the way CompTIA words things. It's beneficial to understand what the question is asking fully.

   4. L

      Laura5859

      2024-09-13

      Selected C2 upvotes

      Jailbreaking is defined by CompTIA as gaining full access to the iOS device by removing the limitations imposed by the Apple iOS operating system.

9. Question 9 of 25

   An organization would like to store customer data on a separate part of the network that is not accessible to users on the main corporate network. Which of the following should the administrator use to accomplish this goal?

   • ASegmentation
   • BIsolation
   • CPatching
   • DEncryption

   Show answer

   Correct answer: A

   How others answered

   • A93%

   Explanation

   Further notes: Isolation is a security measure that can be used to protect sensitive data which typically involves creating a completely separate environment, such as a different physical server or a standalone network, which can be more restrictive than segmentation. The question has the data still on the network, just in a separate part. So, Option A is still the best answer.

   Adapted from community discussion by AutoroTink · 2024-05-15 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

   1. M

      MAKOhunter33333333

      2024-05-21

      Selected A14 upvotes

      Mentions the org wants to store it on the network just separate from the main network, which is segmentation.

   2. A

      AutoroTink

      2024-05-15

      7 upvotes

      Further notes: Isolation is a security measure that can be used to protect sensitive data which typically involves creating a completely separate environment, such as a different physical server or a standalone network, which can be more restrictive than segmentation. The question has the data still on the network, just in a separate part. So, Option A is still the best answer.

   3. D

      drosas84

      2024-06-10

      Selected A5 upvotes

      Network segmentation involves dividing a network into subnets to control access and traffic flow. Network isolation is more severe, creating a standalone network with no connectivity to other parts of the network. It's a stringent form of segregation.

   4. M

      MAKOhunter33333333

      2024-05-21

      5 upvotes

      CompTIA SY0-701 pg 13 states isolation cuts a system off from access to or from outside networks. Segmentation places sensitive systems on separate networks where they MAY communicate with each other.

10. Question 10 of 25

    An organization is struggling with scaling issues on its VPN concentrator and internet circuit due to remote work. The organization is looking for a software solution that will allow it to reduce traffic on the VPN and internet circuit, while still providing encrypted tunnel access to the data center and monitoring of remote employee internet traffic. Which of the following will help achieve these objectives?

    • ADeploying a SASE solution to remote employees
    • BBuilding a load-balanced VPN solution with redundant internet
    • CPurchasing a low-cost SD-WAN solution for VPN traffic
    • DUsing a cloud provider to create additional VPN concentrators

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Answer is A......SASE (Secure Access Service Edge) is a comprehensive networking and security approach that combines wide-area networking (WAN) capabilities with security features. It provides secure access to applications and data, including encrypted tunnel access to the data center, while also offering monitoring capabilities for remote employee internet traffic. By implementing a SASE solution, the organization can reduce traffic on the VPN and internet circuit by routing traffic intelligently through the cloud, closer to the users. This approach helps optimize performance and security, addressing the scaling issues effectively.

    Adapted from community discussion by geocis · 2024-06-17 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

    1. G

       geocis

       2024-06-17

       13 upvotes

       Answer is A......SASE (Secure Access Service Edge) is a comprehensive networking and security approach that combines wide-area networking (WAN) capabilities with security features. It provides secure access to applications and data, including encrypted tunnel access to the data center, while also offering monitoring capabilities for remote employee internet traffic. By implementing a SASE solution, the organization can reduce traffic on the VPN and internet circuit by routing traffic intelligently through the cloud, closer to the users. This approach helps optimize performance and security, addressing the scaling issues effectively.

    2. D

       dbrowndiver

       2024-08-02

       Selected A7 upvotes

       Deploying a SASE solution to remote employees is the best choice because it provides a holistic approach to secure remote access by reducing traffic, offering encrypted tunnel access, and monitoring internet traffic. SASE integrates necessary networking and security functions into a cloud-based solution, making it ideal for modern remote work environments.

    3. 9

       9149f41

       2025-02-03

       Selected A2 upvotes

       SASE includes: SD-WAN has capability of taffic load balancing. SD-WAN, a core part of SASE, can dynamically route traffic across multiple connections. SASE also included: Firewalls, Secure web gateways

    4. A

       a4e15bd

       2024-08-16

       1 upvote

       The correct answer is A. Deploying SASE Solution.. Secure Access Service Edge (SASE) is a network architecture framework that combines cloud-based security technologies with wide area network capabilities. The goal of SASE is to securely connect users, systems, and endpoints to applications and services anywhere

11. Question 11 of 25

    A company is required to use certified hardware when building networks. Which of the following best addresses the risks associated with procuring counterfeit hardware?

    • AA thorough analysis of the supply chain
    • BA legally enforceable corporate acquisition policy
    • CA right to audit clause in vendor contracts and SOWs
    • DAn in-depth penetration test of all suppliers and vendors

    Show answer

    Correct answer: A

    How others answered

    • A78%
    • C23%

    Explanation

    An analysis would safely address if their was a lack of reliability, or authenticity when procuring hardware from a supplier to protect the company.

    Adapted from community discussion by Mehsotopes · 2024-05-08 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

    1. M

       Mehsotopes

       2024-05-08

       Selected A11 upvotes

       An analysis would safely address if their was a lack of reliability, or authenticity when procuring hardware from a supplier to protect the company.

    2. A

       a4e15bd

       2024-08-15

       9 upvotes

       The correct answer is C: While understanding the supply chain is important, it doesn't directly address the ability to enforce compliance or verify the authenticity of the hardware being procured. A right to audit clause in vendor contracts and SOWs is a direct control measure that allows the company to verify that vendors are supplying genuine hardware and by having that right the company can inspect and verify the hardware's authenticity.

    3. M

       Mehsotopes

       2024-05-08

       Selected A7 upvotes

       A penetration test would be checking the security practices of your supply chain to ensure they are not easily tampered with, but does not address the lack of reliability, & authenticity that would protect a company from the possible procurement of faulty supplies/hardware like an analysis would. An enforced acquisition policy would be a bad practice especially if the parts were faulty. A right to audit clause, & Statement of Work (SOW) is the first step to allowing an analysis, or penetration test of vendor services, & goods.

    4. M

       Mehsotopes

       2024-05-08

       Selected A4 upvotes

       A penetration test would be checking the security practices of your supply chain to ensure they are not easily tampered with, but does not address the lack of reliability, & authenticity that would reason for the procurement of faulty supplies (hardware) like an analysis would. An enforced acquisition policy would be a bad practice especially if the parts were faulty. A right to audit clause, & Statement of Work (SOW) is the first step to allowing an analysis, or penetration test of vendor services, & goods.

12. Question 12 of 25

    Select 2

    Which of the following are cases in which an engineer should recommend the decommissioning of a network device? (Choose two.)

    • AThe device has been moved from a production environment to a test environment.
    • BThe device is configured to use cleartext passwords.
    • CThe device is moved to an isolated segment on the enterprise network.
    • DThe device is moved to a different location in the enterprise.
    • EThe device's encryption level cannot meet organizational standards.
    • FThe device is unable to receive authorized updates.

    Show answer

    Correct answer: E, F

    How others answered

    • EF75%
    • BE25%

    Explanation

    E. The device's encryption level cannot meet organizational standards. F. The device is unable to receive authorized updates. These two cases justify decommissioning a network device: - Encryption Level: If a device's encryption level cannot meet the organization's standards, it poses a significant security risk and should be decommissioned. - Authorized Updates: If a device is unable to receive authorized updates, it becomes vulnerable to known exploits and cannot be maintained securely, thus it should also be decommissioned. Therefore, the correct answers are: E. The device's encryption level cannot meet organizational standards. F. The device is unable to receive authorized updates.

    Adapted from community discussion by Etc_Shadow28000 · 2024-06-12 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

    1. E

       Etc_Shadow28000

       2024-06-12

       Selected E, F7 upvotes

       E. The device's encryption level cannot meet organizational standards. F. The device is unable to receive authorized updates. These two cases justify decommissioning a network device: - Encryption Level: If a device's encryption level cannot meet the organization's standards, it poses a significant security risk and should be decommissioned. - Authorized Updates: If a device is unable to receive authorized updates, it becomes vulnerable to known exploits and cannot be maintained securely, thus it should also be decommissioned. Therefore, the correct answers are: E. The device's encryption level cannot meet organizational standards. F. The device is unable to receive authorized updates.

    2. D

       dbrowndiver

       2024-08-02

       Selected E, F4 upvotes

       When evaluating whether a network device should be decommissioned, security vulnerabilities, compliance with organizational standards, and the ability to maintain the device are critical considerations. Options E and F highlight situations where a device is not able to meet these essential requirements. E. The device's encryption level cannot meet organizational standards and F. The device is unable to receive authorized updates are the correct reasons for recommending the decommissioning of a network device. These conditions indicate significant security and compliance risks that cannot be addressed through reconfiguration alone, necessitating the removal of the device to protect the organization's network and data.

    3. S

       Shaman73

       2024-06-04

       3 upvotes

       • E. The device's encryption level cannot meet organizational standards. • F. The device is unable to receive authorized updates

    4. J

       jennyka76

       2025-03-11

       Selected E, F1 upvote

       An engineer should recommend decommissioning a network device primarily when security risks are high, such as if the device's encryption level is insufficient for organization standards or if it cannot receive necessary security updates, or when it's no longer in active use.

13. Question 13 of 25

    A newly identified network access vulnerability has been found in the OS of legacy IoT devices. Which of the following would best mitigate this vulnerability quickly?

    • AInsurance
    • BPatching
    • CSegmentation
    • DReplacement

    Show answer

    Correct answer: C

    How others answered

    • C95%

    Explanation

    Patching is a common method for addressing vulnerabilities. However, in the case of legacy devices, patches may no longer be provided, or applying new patches may be difficult. Therefore, it is not suitable as a quick mitigation method, making C. Segmentation the correct answer.

    Adapted from community discussion by CyberSecurity24 · 2024-06-09 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

    1. K

       KrazyMonkey

       2024-05-15

       Selected C21 upvotes

       I've not heard of patching legacy devices... Professor Messer would be disappointed.

    2. C

       CyberSecurity24

       2024-06-09

       Selected C11 upvotes

       Patching is a common method for addressing vulnerabilities. However, in the case of legacy devices, patches may no longer be provided, or applying new patches may be difficult. Therefore, it is not suitable as a quick mitigation method, making C. Segmentation the correct answer.

    3. S

       SHADTECH123

       2024-05-18

       Selected C6 upvotes

       Segmentation would best mitigate the network access vulnerability in the OS of legacy IoT devices quickly. By segmenting the network, you can isolate the vulnerable devices from the rest of the network, thereby limiting potential access and reducing the risk of exploitation. This is often faster than patching or replacing the devices, especially if patches are not immediately available or replacement is not feasible in the short term.

    4. D

       dbrowndiver

       2024-08-03

       Selected C4 upvotes

       Legacy IoT Devices: These devices often lack the ability to be quickly patched or replaced due to hardware limitations or operational constraints. Segmentation offers a rapid response by limiting access and isolating these devices from critical network resources. Access Control: By segmenting the network, you can apply stricter access controls and monitoring, ensuring that any potential compromise of the IoT devices does not affect the broader network.

14. Question 14 of 25

    Which of the following provides the details about the terms of a test with a third-party penetration tester?

    • ARules of engagement
    • BSupply chain analysis
    • CRight to audit clause
    • DDue diligence

    Show answer

    Correct answer: A

    How others answered

    • A96%

    Explanation

    The correct option that provides details about the terms of a test with a third-party penetration tester is: A. Rules of engagement Rules of engagement (RoE) outline the scope, objectives, limitations, and boundaries of the penetration test. This document ensures both parties understand what is allowed and expected during the testing process, including which systems can be tested, the methods to be used, the timing of the tests, and how the results will be reported and handled. - B: This involves assessing the risks associated with the supply chain and third-party vendors, not specifically the terms of a penetration test. - C: This clause in a contract allows one party to audit the other, typically related to compliance and security practices, but does not detail the terms of a penetration test. - D. This is the process of investigating and evaluating a business or person before signing a contract, but it doesn't provide the specific terms of a penetration test.

    Adapted from community discussion by Etc_Shadow28000 · 2024-10-03 · 16 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

    1. E

       Etc_Shadow28000

       2024-10-03

       Selected A16 upvotes

       The correct option that provides details about the terms of a test with a third-party penetration tester is: A. Rules of engagement Rules of engagement (RoE) outline the scope, objectives, limitations, and boundaries of the penetration test. This document ensures both parties understand what is allowed and expected during the testing process, including which systems can be tested, the methods to be used, the timing of the tests, and how the results will be reported and handled. - B: This involves assessing the risks associated with the supply chain and third-party vendors, not specifically the terms of a penetration test. - C: This clause in a contract allows one party to audit the other, typically related to compliance and security practices, but does not detail the terms of a penetration test. - D. This is the process of investigating and evaluating a business or person before signing a contract, but it doesn't provide the specific terms of a penetration test.

    2. S

       shady23

       2024-10-03

       Selected A4 upvotes

       A. Rules of engagement Rules of engagement (ROE) outline the terms, conditions, and constraints of a penetration testing engagement between an organization and a third-party penetration tester. They specify what actions the tester is authorized to take, the scope of the testing, the systems and networks that can be assessed, the timing of the testing, and any legal or compliance considerations.

    3. A

       Abcd123321

       2024-05-12

       Selected A3 upvotes

       Definitions: Detailed guidelines and constraints regarding the execution of information security testing. The ROE is established before the start of a security test, and gives the test team authority to conduct defined activities without the need for additional permissions.

    4. D

       dbrowndiver

       2024-10-03

       Selected A1 upvote

       In the context of a penetration test with a third-party tester, the Rules of Engagement (RoE) document is crucial. This document outlines the specific terms and conditions under which the penetration test will be conducted, ensuring clarity and mutual understanding between the organization and the tester. The Rules of Engagement is essential for setting clear expectations and boundaries, ensuring that both parties are aligned on the test's objectives and constraints, and protecting the organization's assets and operations during the test.

15. Question 15 of 25

    A small business uses kiosks on the sales floor to display product information for customers. A security team discovers the kiosks use end-of-life operating systems. Which of the following is the security team most likely to document as a security implication of the current architecture?

    • APatch availability
    • BProduct software compatibility
    • CEase of recovery
    • DCost of replacement

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    The most likely security implication that the security team would document is patch availability. End-of-life operating systems no longer receive security updates or patches from the vendor, which leaves them vulnerable to newly discovered exploits and vulnerabilities. This lack of ongoing support means that any security flaws found in the operating systems will not be addressed, increasing the risk of compromise.

    Adapted from community discussion by SHADTECH123 · 2024-05-18 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

    1. S

       SHADTECH123

       2024-05-18

       Selected A7 upvotes

       The most likely security implication that the security team would document is patch availability. End-of-life operating systems no longer receive security updates or patches from the vendor, which leaves them vulnerable to newly discovered exploits and vulnerabilities. This lack of ongoing support means that any security flaws found in the operating systems will not be addressed, increasing the risk of compromise.

    2. E

       Etc_Shadow28000

       2024-06-12

       Selected A6 upvotes

       A. Patch availability The primary security implication of using end-of-life operating systems is the lack of patch availability. End-of-life systems no longer receive security updates or patches from the vendor, making them vulnerable to known exploits and security vulnerabilities that will not be fixed. This poses a significant risk to the security of the kiosks and the overall network. Therefore, the correct answer is: A. Patch availability

    3. 9

       9149f41

       2025-02-03

       Selected A2 upvotes

       The question is not asking for a solution to the legacy system, but rather asking what information needs to be documented in this scenario. Additionally, determining replacement costs is not a cybersecurity responsibility, as security teams can only recommend replacement while vendors provide the actual cost estimates

    4. D

       dbrowndiver

       2024-08-03

       Selected A1 upvote

       Patch availability is a critical concern for maintaining the security and integrity of systems. The absence of patches for EOL systems is a major security risk that the security team would likely document as a primary concern

16. Question 16 of 25

    A legacy device is being decommissioned and is no longer receiving updates or patches. Which of the following describes this scenario?

    • AEnd of business
    • BEnd of testing
    • CEnd of support
    • DEnd of life

    Show answer

    Correct answer: D

    How others answered

    • D52%
    • C48%

    Only 52% agreed on this answer — treat it as contested rather than settled.

    Explanation

    D. End of Life Here is why: End of support refers to when the manufacturer stops providing updates, patches and technical support for a product, but the product may still be use and it won't receive any further assistance or updates. End of Life: Refers to a stage where product is no longer sold, maintained or supported by manufacturer. This device is typically decommissioned or retired. End of support would only apply if the device was still in use but not longer receiving updates, in our scenario where decommissioning is involved, End of Life is the right answer.

    Adapted from community discussion by a4e15bd · 2024-08-16 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

    1. A

       a4e15bd

       2024-08-16

       4 upvotes

       D. End of Life Here is why: End of support refers to when the manufacturer stops providing updates, patches and technical support for a product, but the product may still be use and it won't receive any further assistance or updates. End of Life: Refers to a stage where product is no longer sold, maintained or supported by manufacturer. This device is typically decommissioned or retired. End of support would only apply if the device was still in use but not longer receiving updates, in our scenario where decommissioning is involved, End of Life is the right answer.

    2. N

       nap61

       2024-10-03

       Selected D2 upvotes

       Extracted from The Official CompTIA Security+ Student Guide (Exam SY0-701), Lesson 8, Topic 8A, page 212-213 " The manufacturer or vendor no longer supports EOL systems, so they do not receive updates, including critical security patches." " An EOL system is a specific product or version of a product that the manufacturer or vendor has publicly declared as no longer supported." "End-of-life (EOL) hardware vulnerabilities arise when manufacturers cease providing product updates, parts, or patches to the firmware." also no mention of "end of support (EOS)"

    3. B

       braveheart22

       2024-11-12

       Selected D2 upvotes

       D. End of life End of life (EOL) refers to a product (in this case, a legacy device) that is no longer being actively sold, supported, or maintained by the manufacturer. When a device reaches its EOL, it stops receiving updates, patches, and technical support. This often happens after the manufacturer has decided to discontinue the product, and it marks the point at which the device is considered obsolete in terms of official support.

    4. J

       jennyka76

       2025-03-11

       Selected D2 upvotes

       had to check on this one myself twice.. my answer is - D here is my proof for my selection In the context of the CompTIA SY0-701 (Security+) exam, "end of life" refers to when a specific version of the exam or a related product (like a software or hardware) is no longer officially supported by CompTIA and the manufacturer respectively, meaning no further updates, patches or security fixes will be provided.

17. Question 17 of 25

    A systems administrator wants to prevent users from being able to access data based on their responsibilities. The administrator also wants to apply the required access structure via a simplified format. Which of the following should the administrator apply to the site recovery resource group?

    • ARBAC
    • BACL
    • CSAML
    • DGPO

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    RBAC: Role-Based Access Control (Permissions based on roles. Others include: MAC, DAC, Rule-based, ABAC) ACL: Access Control List (Popular with configuring firewalls) SAML: Security Assertion Markup Language (used alongside SSO, authentication) GPO: Group Policy Objective (used in hardening, to dictate policies, user rights, and audit settings)

    Adapted from community discussion by AutoroTink · 2024-05-25 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

    1. M

       MAKOhunter33333333

       2024-05-22

       Selected A12 upvotes

       Role-based access control (RBAC) restricts users to only access data based on their job responsibilities.

    2. A

       AutoroTink

       2024-05-25

       Selected A8 upvotes

       RBAC: Role-Based Access Control (Permissions based on roles. Others include: MAC, DAC, Rule-based, ABAC) ACL: Access Control List (Popular with configuring firewalls) SAML: Security Assertion Markup Language (used alongside SSO, authentication) GPO: Group Policy Objective (used in hardening, to dictate policies, user rights, and audit settings)

    3. D

       dbrowndiver

       2024-08-03

       Selected A2 upvotes

       In this question the best choice is "A". RBAC (Role-Based Access Control) is correct because it allows the systems administrator to prevent unauthorized access by defining roles and assigning permissions based on user responsibilities. RBAC simplifies the access management process and ensures that users only have access to the data necessary for their roles.

    4. S

       Syl0

       2024-09-05

       1 upvote

       RBAC - Rule Based Access Control ACL - Access Control List SAML - Security Assertion Markup Language GPO - Group Policy Object

18. Question 18 of 25

    A penetration tester begins an engagement by performing port and service scans against the client environment according to the rules of engagement. Which of the following reconnaissance types is the tester performing?

    • AActive
    • BPassive
    • CDefensive
    • DOffensive

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    A. Active Active reconnaissance involves actively probing and scanning the target environment to gather information. This typically includes activities such as port and service scans, vulnerability scans, and other direct interactions with the target systems to identify potential weaknesses or entry points. Passive reconnaissance, on the other hand, involves gathering information without directly interacting with the target systems, such as monitoring network traffic or analyzing publicly available information. Options C and D, defensive and offensive reconnaissance, respectively, are not standard reconnaissance types typically used in the context of penetration testing.

    Adapted from community discussion by shady23 · 2024-05-11 · 18 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

    1. S

       shady23

       2024-05-11

       Selected A18 upvotes

       A. Active Active reconnaissance involves actively probing and scanning the target environment to gather information. This typically includes activities such as port and service scans, vulnerability scans, and other direct interactions with the target systems to identify potential weaknesses or entry points. Passive reconnaissance, on the other hand, involves gathering information without directly interacting with the target systems, such as monitoring network traffic or analyzing publicly available information. Options C and D, defensive and offensive reconnaissance, respectively, are not standard reconnaissance types typically used in the context of penetration testing.

    2. D

       dbrowndiver

       2024-10-03

       Selected A2 upvotes

       Active reconnaissance involves directly interacting with the target systems to gather information. This type of reconnaissance is often more intrusive because it sends packets or requests to the target to elicit responses, allowing the tester to gather detailed information about the target's configuration and potential weaknesses. In this Scenario Application: Direct Interaction: By performing port and service scans, the tester is "actively" sending packets to the target systems to determine which ports are open and what services are running. This direct interaction is characteristic of active reconnaissance. Used for Detailed Information Gathering: Active reconnaissance allows the Pen tester to gather precise details about the target's network, such as identifying specific services, versions, and potential entry points for further testing. This is why it pertains and fits: The nature of port and service scanning, which involves direct communication with the target systems, is aligned with the concept of active reconnaissance. It aims to provide a clear understanding of the target's network infrastructure and potential vulnerabilities.

    3. P

       PAWarriors

       2024-08-19

       Selected A1 upvote

       Correct answer is A. Active Reconnaissance: Engaging with the target system directly, such as scanning for open ports using tools like Nmap. Passive Reconnaissance: Gathering information without direct engagement, like using open-source intelligence or WHOIS to collect data

    4. J

       JackExam2025

       2025-02-23

       Selected A1 upvote

       Interacting with the target systems, the reconnaissance type is active

19. Question 19 of 25

    Select 2

    During the onboarding process, an employee needs to create a password for an intranet account. The password must include ten characters, numbers, and letters, and two special characters. Once the password is created, the company will grant the employee access to other company-owned websites based on the intranet profile. Which of the following access management concepts is the company most likely using to safeguard intranet accounts and grant access to multiple sites based on a user's intranet account? (Choose two.)

    • AFederation
    • BIdentity proofing
    • CPassword complexity
    • DDefault password changes
    • EPassword manager
    • FOpen authentication

    Show answer

    Correct answer: A, C

    How others answered

    • AC100%

    Explanation

    "A". Federation and "C". are the correct answers. Federation facilitates access to multiple systems using a single intranet profile, and password complexity ensures that the passwords used are strong and secure. These concepts work together to safeguard intranet accounts and streamline user access across various company-owned websites.

    Adapted from community discussion by dbrowndiver · 2024-08-03 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

    1. D

       dbrowndiver

       2024-08-03

       Selected A, C7 upvotes

       "A". Federation and "C". are the correct answers. Federation facilitates access to multiple systems using a single intranet profile, and password complexity ensures that the passwords used are strong and secure. These concepts work together to safeguard intranet accounts and streamline user access across various company-owned websites.

    2. T

       TheMichael

       2024-07-19

       Selected A, C4 upvotes

       Answer: A and C Federation establishes trust with a third-party that manages authentication, potentially providing a more secure solution for internal company systems. In this scenario the company is the third party that grants access to other company-owned websites. The answer is not Open authentication because Open authentication allows you to log into any other company-owned websites with your password, not intranet profile. Open authentication is less secure so a company would be less likely to use it in this fashion which also makes A and C make more sense.

    3. C

       c80f5c5

       2024-06-05

       3 upvotes

       This one is tricky because federation and open auth are very similar. I think OAuth might be for third party applications (like signing into a game with your facebook account) and not multiple company owned platforms like the question asks

    4. 3

       35f7aac

       2024-06-01

       3 upvotes

       Hmm. Why not F instead of A? Question says "other company-owned websites". I thought Federation applies more to independent organizations connecting together.

20. Question 20 of 25

    Which of the following would be the best way to handle a critical business application that is running on a legacy server?

    • ASegmentation
    • BIsolation
    • CHardening
    • DDecommissioning

    Show answer

    Correct answer: A

    How others answered

    • A44%
    • B40%

    Only 44% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A. Segmentation Segmentation is the best approach to handle a critical business application running on a legacy server. By segmenting the legacy server from the rest of the network, you can limit the potential impact of any vulnerabilities associated with the legacy system. This approach allows the critical application to continue running while minimizing the risk to the rest of the network. Therefore, the correct answer is: A. Segmentation

    Adapted from community discussion by Etc_Shadow28000 · 2024-06-12 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

    1. E

       Etc_Shadow28000

       2024-06-12

       Selected A20 upvotes

       A. Segmentation Segmentation is the best approach to handle a critical business application running on a legacy server. By segmenting the legacy server from the rest of the network, you can limit the potential impact of any vulnerabilities associated with the legacy system. This approach allows the critical application to continue running while minimizing the risk to the rest of the network. Therefore, the correct answer is: A. Segmentation

    2. A

       a4e15bd

       2024-08-18

       3 upvotes

       Isolation is used to completely separate a system from the network which is ideal if the primary goal is to eliminate any potential risk of legacy server compromising other systems. It is more extreme measure, typically applied when the application doesnt need to communicate with other systems or when the risk is deemed too high. Segmentation on the other hand is used to limit the legacy applications communication to only necessary interactions which still protects the rest of the network but allows the application to function normally. It is more nuanced approach allowing for controlled interactions while still reducing risk. So A. Segmentation is the best option because it provides a balance between security and functionality allow the legacy system to continue operating within a restricted and monitored environment.

    3. M

       MAKOhunter33333333

       2024-05-22

       Selected A5 upvotes

       Isolation is like completely separate, while segmentation means it is still on the network providing service

    4. 5

       585402e

       2025-02-15

       Selected A3 upvotes

       For this question i choose "Segmentation" but.. Segmentation is ideal when the legacy server requires internet access through the company's web proxy. It keeps the server within a secure, isolated network segment, ensuring it can access the internet while minimizing risks to other parts of the network. Isolation is the better approach when the legacy server only needs to be powered on for specific local operations. It provides a higher level of security by completely separating the server from other systems and network resources.

21. Question 21 of 25

    Which of the following is required for an organization to properly manage its restore process in the event of system failure?

    • AIRP
    • BDRP
    • CRPO
    • DSDLC

    Show answer

    Correct answer: B

    How others answered

    • B96%

    Explanation

    RPO would cover amount of data that is expected to be recovered given a failure while DRP encompasses the whole recovery process necessary to restore the system.

    Adapted from community discussion by Mehsotopes · 2024-05-08 · 17 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

    1. M

       Mehsotopes

       2024-05-08

       Selected B17 upvotes

       RPO would cover amount of data that is expected to be recovered given a failure while DRP encompasses the whole recovery process necessary to restore the system.

    2. S

       SHADTECH123

       2024-05-17

       Selected B6 upvotes

       B. DRP (Disaster Recovery Plan) Explanation: A Disaster Recovery Plan (DRP) is essential for managing the restore process in the event of system failure. It provides a detailed strategy for recovering data, systems, and applications, ensuring that business operations can resume as quickly as possible after a disaster. While an IRP handles immediate incident response, and RPO and SDLC are related to specific aspects of data recovery and system development, the DRP is specifically focused on comprehensive recovery and continuity planning.

    3. F

       f71cbb0

       2024-05-12

       Selected B4 upvotes

       An IRP defines how to detect, contain, analyze, and resolve security incidents, while a DRP outlines how to restore critical systems and data after a major disruption, such as system failure

    4. D

       dbrowndiver

       2024-08-01

       Selected B2 upvotes

       The DRP provides detailed instructions on how to restore systems, applications, and data, enabling the organization to return to normal operations as quickly as possible after a failure.

22. Question 22 of 25

    The local administrator account for a company's VPN appliance was unexpectedly used to log in to the remote management interface. Which of the following would have most likely prevented this from happening?

    • AUsing least privilege
    • BChanging the default password
    • CAssigning individual user IDs
    • DReviewing logs more frequently

    Show answer

    Correct answer: B

    How others answered

    • B60%
    • A20%
    • C20%

    Only 60% agreed on this answer — treat it as contested rather than settled.

    Explanation

    idk if it's my ADHD or what but I had to re-read this question like 5 times and I still don't completely understand what they're asking lol

    Adapted from community discussion by d4a5620 · 2024-09-07 · 21 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

    1. D

       d4a5620

       2024-09-07

       21 upvotes

       idk if it's my ADHD or what but I had to re-read this question like 5 times and I still don't completely understand what they're asking lol

    2. F

       fmeox567

       2024-11-21

       Selected B2 upvotes

       The most likely action that would have prevented the local administrator account from being used unexpectedly to log in to the remote management interface is: B. Changing the default password Here’s why: - Changing the default password: Many VPN appliances come with default usernames and passwords. If these are not changed, anyone with knowledge of the default credentials (which are often easily found online) can gain access to the appliance. Changing the default password to something strong and unique would make it much more difficult for unauthorized users to log in. - A. Using least privilege: While this is a good security practice, it typically refers to ensuring users have only the minimum level of access needed to perform their tasks. In the case of an administrator account being used, the issue is more likely related to the strength of the password rather than inappropriate access rights being assigned.

    3. A

       Anyio

       2025-01-23

       Selected B2 upvotes

       B. Changing the default password Explanation: Default administrator accounts often come with weak or widely known credentials, making them an easy target for attackers. Changing the default password to a strong, unique one is a fundamental security practice that would have likely prevented unauthorized access. Other Options: A. Using least privilege: This is important but doesn't address the issue if the default password is still in use. C. Assigning individual user IDs: While useful for tracking and accountability, it doesn't prevent unauthorized access if the default admin account remains active. D. Reviewing logs more frequently: Log reviews can help detect incidents but won't prevent them. Changing the default password directly addresses the vulnerability.

    4. D

       dbrowndiver

       2024-08-03

       Selected B3 upvotes

       Many devices and applications come with default administrator credentials that are intended to be changed immediately after installation. Failure to change these passwords leaves systems vulnerable to unauthorized access. By changing the default password for the local administrator account, the company would significantly reduce the risk of unauthorized access. Attackers often attempt to use default credentials to gain entry, so ensuring these are changed is a fundamental security practice.

23. Question 23 of 25

    Select 2

    Which of the following factors are the most important to address when formulating a training curriculum plan for a security awareness program? (Choose two.)

    • AChannels by which the organization communicates with customers
    • BThe reporting mechanisms for ethics violations
    • CThreat vectors based on the industry in which the organization operates
    • DSecure software development training for all personnel
    • ECadence and duration of training events
    • FRetraining requirements for individuals who fail phishing simulations

    Show answer

    Correct answer: C, E

    How others answered

    • CE100%

    Explanation

    C. Threat vectors based on the industry in which the organization operates E. Cadence and duration of training events When formulating a training curriculum plan for a security awareness program, it is crucial to focus on: - Threat vectors based on the industry in which the organization operates (C): Understanding the specific threats that are most relevant to the industry helps tailor the training content to address the most pressing risks and vulnerabilities that employees might face. - Cadence and duration of training events (E): Establishing an appropriate schedule and duration for training ensures that employees receive regular, ongoing education to keep security top-of-mind and adapt to evolving threats. Therefore, the correct answers are: C. Threat vectors based on the industry in which the organization operates E. Cadence and duration of training events

    Adapted from community discussion by Etc_Shadow28000 · 2024-06-12 · 9 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

    1. E

       Etc_Shadow28000

       2024-06-12

       Selected C, E9 upvotes

       C. Threat vectors based on the industry in which the organization operates E. Cadence and duration of training events When formulating a training curriculum plan for a security awareness program, it is crucial to focus on: - Threat vectors based on the industry in which the organization operates (C): Understanding the specific threats that are most relevant to the industry helps tailor the training content to address the most pressing risks and vulnerabilities that employees might face. - Cadence and duration of training events (E): Establishing an appropriate schedule and duration for training ensures that employees receive regular, ongoing education to keep security top-of-mind and adapt to evolving threats. Therefore, the correct answers are: C. Threat vectors based on the industry in which the organization operates E. Cadence and duration of training events

    2. T

       Th3irdEye

       2024-05-16

       Selected C, E5 upvotes

       C you need to know what to train against E training schedule is one of the most important aspects of the curriculum The chosen answer with talking about ethics violations is unrelated to security training. Retraining requirements are important too but less so than C and E.

    3. A

       AutoroTink

       2024-05-14

       Selected C, E4 upvotes

       If I was to make a curriculum, I'd want to know the biggest "what" that we would teach, and "when" and "how often" we'd be teaching it. The others are great, but not as important as these two things.

    4. J

       Jacket

       2024-09-15

       1 upvote

       C. Threat vectors based on the industry in which the organization operates: Understanding the specific threats that are relevant to your industry is critical. Different industries face unique risks (e.g., phishing attacks in finance, insider threats in healthcare). Training should be tailored to address these industry-specific threats to ensure the most relevant and effective education for employees. E. Cadence and duration of training events: The frequency and length of training sessions are essential to ensure that the training is both effective and engaging. Regular, well-timed training helps reinforce security principles, ensuring employees are constantly aware of evolving threats and practices without feeling overwhelmed.

24. Question 24 of 25

    In order to strengthen a password and prevent a hacker from cracking it, a random string of 36 characters was added to the password. Which of the following best describes this technique?

    • AKey stretching
    • BTokenization
    • CData masking
    • DSalting

    Show answer

    Correct answer: D

    How others answered

    • D71%
    • A29%

    Only 71% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Salting is the correct answer because it involves adding a random string to a password before hashing to strengthen security. This technique effectively prevents precomputed hash attacks, making it a critical component of modern password protection strategies.

    Adapted from community discussion by dbrowndiver · 2024-08-03 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

    1. D

       dbrowndiver

       2024-08-03

       Selected D12 upvotes

       Salting is the correct answer because it involves adding a random string to a password before hashing to strengthen security. This technique effectively prevents precomputed hash attacks, making it a critical component of modern password protection strategies.

    2. C

       chalaka

       2024-11-19

       Selected D2 upvotes

       D. Salting Explanation: Salting involves adding a random string (called a salt) to a password before it is hashed to prevent attackers from using precomputed hash databases (like rainbow tables) to crack the password. The random string (in this case, 36 characters) is unique and makes the password significantly harder to guess because it ensures that even if two users have the same password, their hashes will be different.

    3. E

       Eracle

       2025-01-03

       2 upvotes

       CORRETION: cannot be D, because lengthening the key does not add a causal string to the password. Key stretching involves applying a cryptographic function repeatedly (thousands or millions of times) on the password and salt to make the hashing process much slower and computationally expensive. CORRECT ANSWER: A.

    4. V

       VincentvdS

       2025-02-02

       Selected D1 upvote

       Salting is correct. Read the difference between Salting and Key Stretching on : https://library.mosse-institute.com/articles/2023/07/key-stretching-and-saltingm.html It explains a lot.

25. Question 25 of 25

    A technician is deploying a new security camera. Which of the following should the technician do?

    • AConfigure the correct VLAN.
    • BPerform a vulnerability scan.
    • CDisable unnecessary ports.
    • DConduct a site survey.

    Show answer

    Correct answer: D

    How others answered

    • D87%

    Explanation

    A site survey is essential to determine the best locations for camera installation, ensuring optimal coverage and signal strength. It involves assessing the physical environment to identify any potential issues that could affect the camera’s performance, such as obstructions, lighting conditions, and power source availability. A. Configure the correct VLAN: While important for network segmentation, it’s not the first step in physical deployment. B. Perform a vulnerability scan: This is more relevant for assessing the security of existing systems, not the initial placement of a camera. C. Disable unnecessary ports: This is a security measure for network devices, but it doesn’t address the physical aspects of camera deployment.

    Adapted from community discussion by AutoroTink · 2024-05-08 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SY0-701 or CertExamHQ.

    1. A

       AutoroTink

       2024-05-08

       Selected D5 upvotes

       A site survey is essential to determine the best locations for camera installation, ensuring optimal coverage and signal strength. It involves assessing the physical environment to identify any potential issues that could affect the camera’s performance, such as obstructions, lighting conditions, and power source availability. A. Configure the correct VLAN: While important for network segmentation, it’s not the first step in physical deployment. B. Perform a vulnerability scan: This is more relevant for assessing the security of existing systems, not the initial placement of a camera. C. Disable unnecessary ports: This is a security measure for network devices, but it doesn’t address the physical aspects of camera deployment.

    2. E

       Etc_Shadow28000

       2024-06-12

       Selected D6 upvotes

       D. Conduct a site survey. Before deploying a new security camera, conducting a site survey is crucial. A site survey helps determine the optimal placement of the camera, assesses environmental factors, ensures there are no blind spots, and verifies that the camera will effectively cover the desired area. It also helps in planning for network connectivity, power supply, and other logistical considerations. Therefore, the correct answer is: D. Conduct a site survey.

    3. S

       shady23

       2024-05-09

       Selected D4 upvotes

       D. Conduct a site survey. The keyword in the question that makes option D correct is "deploying a new security camera." Conducting a site survey is crucial when deploying new security cameras because it allows the technician to assess various factors such as the physical environment, potential obstacles, optimal camera placement, coverage areas, and lighting conditions. This ensures that the security camera is installed in the most effective location to fulfill its surveillance objectives.

    4. S

       SHADTECH123

       2024-05-17

       Selected D3 upvotes

       Conducting a site survey involves assessing the physical environment where the security camera will be installed. This includes identifying optimal camera placement, ensuring sufficient coverage, assessing lighting conditions, and identifying potential sources of interference. It helps ensure that the security camera is deployed effectively to meet the organization's surveillance requirements.

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-701 practice, question 1 of 25