CompTIA Security+607 questions across 61 pages are complete and free, with no account or card.
607 questions in this bank
Free access · progress saved on this device
An organization is developing a security program that conveys the responsibilities associated with the general operation of systems and software within the organization. Which of the following documents would most likely communicate these expectations?
Answer: C
A security analyst created a fake account and saved the password in a non-readily accessible directory in a spreadsheet. An alert was also configured to notify the security team if the spreadsheet is opened. Which of the following best describes the deception method being deployed?
Answer: C
C. Honeytoken Explanation: ✔ A honeytoken is a decoy piece of data (e.g., fake credentials, database records, or files) designed to detect unauthorized access. ✔ In this scenario, the analyst created a fake account (credentials) and stored them in a hidden spreadsheet, setting up an alert when accessed. ✔ This helps identify malicious activity if an attacker discovers and attempts to use the credentials. Why not the other options? A. Honeypot – A decoy system or server designed to lure attackers, not a single credential or file. B. Honeyfile – A fake document (e.g., a sensitive-looking spreadsheet or PDF), whereas this scenario is about credentials rather than just a document. D. Honeynet – A network of multiple honeypots, not a single deception mechanism like a honeytoken.
Source: Adapted from community discussion — test_arrow
Which of the following is the best way to provide secure, remote access for employees while minimizing the exposure of a company’s internal network?
Answer: A
A company wants to track modifications to the code that is used to build new virtual servers. Which of the following will the company most likely deploy?
Answer: D
A U.S.-based cloud-hosting provider wants to expand its data centers to new international locations. Which of the following should the hosting provider consider first?
Answer: A
When a U.S.-based cloud-hosting provider is considering expanding its data centers to new international locations, the first thing they should consider is local data protection regulations. These regulations govern how personal or sensitive data is collected, stored, processed, and transferred across borders. Different countries have different regulations, such as the GDPR in the EU or PIPEDA in Canada. Compliance with these regulations is crucial to avoid legal penalties, fines, or reputational damage
Source: Adapted from community discussion — barracouto
Which of the following documents details how to accomplish a technical security task?
Answer: D
While conducting a business continuity tabletop exercise, the security team becomes concerned by potential impact if a generator was to develop a fault during failover. Which of the following is the team most likely to consider in regard to risk management activities?
Answer: C
most times, check for the basic word used in the question, it highlights 'impact", so the answer should be BIA (Business impact analysis)
Source: Adapted from community discussion — 3037402
Which of the following is prevented by proper data sanitization?
Answer: A
A certificate authority needs to post information about expired certificates. Which of the following would accomplish this task?
Answer: B
The correct answer is: B. CRL (Certificate Revocation List) Explanation: CRL (Certificate Revocation List) is a list of digital certificates that have been revoked or expired before their scheduled expiration date. Certificate authorities (CAs) use CRLs to publicly post information about certificates that are no longer valid, ensuring that relying parties can check the status of a certificate. TPM (Trusted Platform Module) (A) is a hardware component used for secure cryptographic operations, not related to posting expired certificate information. PKI (Public Key Infrastructure) (C) is the framework that manages digital certificates and public-key encryption, but it is not a specific mechanism for posting expired certificate information. CSR (Certificate Signing Request) (D) is a request sent to a CA to issue a digital certificate, which is unrelated to posting expired certificate information.
Source: Adapted from community discussion — Anyio
Which of the following can best contribute to prioritizing patch applications?
Answer: A
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SY0-701 practice, question 471. 607 questions available.
Version 1.0.0. How we source questions