CompTIA Security+607 questions across 61 pages are complete and free, with no account or card.
607 questions in this bank
Free access · progress saved on this device
A coffee shop owner wants to restrict internet access to only paying customers by prompting them for a receipt number. Which of the following is the best method to use given this requirement?
Answer: B
B Captive Portal This will allow the coffee shop to restrict internet access by redirecting users to a web page where they must enter the receipt information to gain access.
Source: Adapted from community discussion — a4e15bd
While performing digital forensics, which of the following is considered the most volatile and should have the contents collected first?
Answer: B
When the computer powers off, anything in the RAM is going to be lost. Therefore, collecting potential evidence out of the RAM is the first thing that should be done out of these options.
Source: Adapted from community discussion — TrebleSmith
A hosting provider needs to prove that its security controls have been in place over the last six months and have sufficiently protected customer data. Which of the following would provide the best proof that the hosting provider has met the requirements?
Answer: B
B. SOC 2 Type 2 report SOC 2 stands for System and Organization Controls 2. A SOC 2 Type 2 report provides an audit of the effectiveness of security controls over a period of time (typically 6-12 months), specifically focusing on the operating effectiveness of controls related to security, availability, processing integrity, confidentiality, and privacy. This report would demonstrate that the controls were not only in place but also effectively protecting customer data over the required period.
Source: Adapted from community discussion — ViciousAkira
A city municipality lost its primary data center when a tornado hit the facility. Which of the following should the city staff use immediately after the disaster to handle essential public services?
Answer: C
Im going with C, because while a BCP is for helping to ensure that essential business operations continue after a disaster (such as this tornado), it is broader in scope. The DRP offers specific steps and processes to follow to recover critical IT infrastructure and systems, which is the more immediate concern "immediately after the disaster."
Source: Adapted from community discussion — c7b3ff0
Which of the following is considered a preventive control?
Answer: D
Segregation of duties is going to PREVENT users from having the ability to potentially manipulate processes within the business by splitting duties amongst others. Somewhat of a "checks and balances" kind of system.
Source: Adapted from community discussion — TrebleSmith
A systems administrator notices that a testing system is down. While investigating, the systems administrator finds that the servers are online and accessible from any device on the server network. The administrator reviews the following information from the monitoring system:
Which of the following is the most likely cause of the outage?
Answer: A
A Denial of Service. This is clearly indicative of DoS attack where the two Test hosts are being overwhelmed with excessive traffic received causing them to become unresponsive and crash.
Source: Adapted from community discussion — a4e15bd
A security team has been alerted to a flood of incoming emails that have various subject lines and are addressed to multiple email inboxes. Each email contains a URL shortener link that is redirecting to a dead domain. Which of the following is the best step for the security team to take?
Answer: D
D. Block the URL shortener domain in the web proxy: By blocking the URL shortener domain, the security team can prevent users from accessing potentially malicious links, even if the domain is currently dead. This proactive measure helps mitigate the risk of future attacks using the same URL shortener.
Source: Adapted from community discussion — RoRoRoYourBoat
A security administrator would like to protect data on employees’ laptops. Which of the following encryption techniques should the security administrator use?
Answer: C
The answer is C - Fulldisk encryption, this encrypts the whole storage drive of the device, including OS, files, app data, etc. the reason its not the other options partition encryption - only encrypts the partition, meaning if there are multiple partitions then some of them could be left unencrypted and a threat actor could steal data in them. Asymmetric encryption - is an encryption technique using Public Key, private key methodology. Database encryption - is used to encrypt databases (schema) or data within the databases.
Source: Adapted from community discussion — rjbb
A security administrator is working to secure company data on corporate laptops in case the laptops are stolen. Which of the following solutions should the administrator consider?
Answer: A
It’s funny how in this scenario it’s easy picking but as soon as you apply the same scenario but with remote wipe as one of the options, you’ll have a pretty even split of answers between remote wipe and disk encryption.
Source: Adapted from community discussion — fc040c7
A company needs to keep the fewest records possible, meet compliance needs, and ensure destruction of records that are no longer needed. Which of the following best describes the policy that meets these requirements?
Answer: C
C. Retention policy. Reasoning: Security policy: While a security policy is important for protecting sensitive information, it doesn't specifically address the retention and destruction of records. Classification policy: A classification policy helps categorize information based on its sensitivity and value, but it doesn't provide guidelines for how long records should be retained or when they should be destroyed. Retention policy: A retention policy establishes rules for how long different types of records should be kept and when they can be destroyed. This is exactly what the company needs to meet compliance requirements and minimize the number of records it needs to store. Access control policy: An access control policy governs who can access different types of information. While it's important for data protection, it doesn't directly address the retention and destruction of records. Therefore, a retention policy is the best option for the company to meet its requirements of keeping the fewest records possible, meeting compliance needs, and ensuring destruction of records that are no longer needed.
Source: Adapted from community discussion — Glacier88
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SY0-701 practice, question 171. 607 questions available.
Version 1.0.0. How we source questions