CompTIA Security+607 questions across 61 pages are complete and free, with no account or card.
607 questions in this bank
Free access · progress saved on this device
Which of the following threat actors is the most likely to be hired by a foreign government to attack critical systems located in other countries?
Answer: C
C. Organized crime Organized crime groups often have the resources, expertise, and networks to carry out sophisticated cyber attacks on behalf of governments or other entities for financial gain or political motives.
Source: Adapted from community discussion — lauren2wright
An employee receives a text message that appears to have been sent by the payroll department and is asking for credential verification. Which of the following social engineering techniques are being attempted? (Choose two.)
Answer: CE
In this scenario, where an employee receives a text message appearing to be from the payroll department asking for credential verification, the following social engineering techniques are being attempted: C. Impersonation - The attacker is pretending to be a trusted entity (the payroll department) to gain the employee's trust and obtain their credentials. E. Smishing - Smishing (SMS phishing) involves sending fraudulent text messages to trick individuals into revealing personal information, such as credentials, by clicking on a link or responding to the message.
Source: Adapted from community discussion — Etc_Shadow28000
An organization is leveraging a VPN between its headquarters and a branch location. Which of the following is the VPN protecting?
Answer: B
Data in transit is the correct answer because a VPN is specifically designed to protect data as it moves between two locations. By encrypting the data and securing the communication path, the VPN ensures that information remains confidential and secure during transmission, making it the most relevant choice for this scenario.
Source: Adapted from community discussion — dbrowndiver
After reviewing the following vulnerability scanning report:
A security analyst performs the following test:
Which of the following would the security analyst conclude for this reported vulnerability?
Answer: A
Telnet itself is inherently insecure and it transmits data including passwords in plaintext making it vulnerable to interception and eavesdropping. While using encryption with telnet is not typical but it is possible, however there are other secure alternatives out there like SSH. So while it is true that Telnet is an unsecure protocol, having encryption is just a compensating control here. So the answer is D.
Source: Adapted from community discussion — a4e15bd
An organization disabled unneeded services and placed a firewall in front of a business-critical legacy system. Which of the following best describes the actions taken by the organization?
Answer: D
D. Compensating controls The actions taken by the organization—disabling unneeded services and placing a firewall in front of a business-critical legacy system—are examples of compensating controls. Compensating controls are security measures that are implemented to mitigate risk when the primary controls are not feasible or sufficient. In this case, since the legacy system might have inherent vulnerabilities that cannot be fully addressed, the organization has implemented additional controls to reduce the risk. Therefore, the correct answer is: D. Compensating controls
Source: Adapted from community discussion — Etc_Shadow28000
A security consultant needs secure, remote access to a client environment. Which of the following should the security consultant most likely use to gain access?
Answer: C
IPSec is ideal for establishing a secure connection between a security consultant’s device and a client’s network, ensuring confidentiality, integrity, and authenticity of data transmitted over the connection.
Source: Adapted from community discussion — dbrowndiver
Which of the following should a systems administrator use to ensure an easy deployment of resources within the cloud provider?
Answer: B
Infrastructure as Code (IaC) is the correct answer because it provides the necessary tools and practices for automating and simplifying the deployment of infrastructure resources in a cloud environment. IaC enables efficient and repeatable resource provisioning, making it the most effective solution for the systems administrator's needs.
Source: Adapted from community discussion — dbrowndiver
After a security awareness training session, a user called the IT help desk and reported a suspicious call. The suspicious caller stated that the Chief Financial Officer wanted credit card information in order to close an invoice. Which of the following topics did the user recognize from the training?
Answer: C
Answer is C....Social engineering is the practice of manipulating people into performing actions or divulging confidential information, often by impersonating someone else or creating a sense of urgency or trust. The suspicious caller in this scenario was trying to use social engineering to trick the user into giving away credit card information by pretending to be the CFO and asking for a payment. The user recognized this as a potential scam and reported it to the IT help desk. The other topics are not relevant to this situation.
Source: Adapted from community discussion — geocis
A security administrator is deploying a DLP solution to prevent the exfiltration of sensitive customer data. Which of the following should the administrator do first?
Answer: C
Apply classifications to the data is the correct first step because it establishes a foundational understanding of what data is sensitive and needs protection. By classifying the data, the security administrator can ensure that subsequent DLP policies are effectively tailored to prevent the exfiltration of sensitive customer data, while minimizing unnecessary restrictions on non-sensitive data.
Source: Adapted from community discussion — dbrowndiver
An administrator assists the legal and compliance team with ensuring information about customer transactions is archived for the proper time period. Which of the following data policies is the administrator carrying out?
Answer: B
The administrator is tasked with ensuring that transaction data is archived for the appropriate duration. This task involves adhering to retention schedules that dictate how long such data must be kept to meet compliance obligations. Retention policies are critical for legal and compliance teams, as they help avoid legal issues related to data disposal and ensure that records are available for audits, investigations, or regulatory reviews.
Source: Adapted from community discussion — dbrowndiver
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SY0-701 practice, question 1. 607 questions available.
Version 1.0.0. How we source questions