SY0-701 practice questions 81–90

1. Question 81 · 607 in bank

   Which of the following describes effective change management procedures?

   • AApproving the change after a successful deployment
   • BHaving a backout plan when a patch fails
   • CUsing a spreadsheet for tracking changes
   • DUsing an automatic change control bypass for security updates

   Show answer

   Answer: B

   Explanation

   o When applying patches or making system changes, there's always a risk of unforeseen issues. An effective backout plan allows for a quick and organized response, ensuring that systems can be returned to their last known good state, thereby maintaining business continuity and reducing the potential impact on operations.

   Source: Adapted from community discussion — dbrowndiver

   Next question

2. Question 82 · 607 in bank

   The CIRT is reviewing an incident that involved a human resources recruiter exfiltrating sensitive company data. The CIRT found that the recruiter was able to use HTTP over port 53 to upload documents to a web server. Which of the following security infrastructure devices could have identified and blocked this activity?

   • AWAF utilizing SSL decryption
   • BNGFW utilizing application inspection
   • CUTM utilizing a threat feed
   • DSD-WAN utilizing IPSec

   Show answer

   Answer: B

   Explanation

   B. NGFW utilizing application inspection A Next-Generation Firewall (NGFW) utilizing application inspection could have identified and blocked the use of HTTP over port 53. NGFWs have advanced capabilities that allow them to inspect and identify traffic based on the application layer, not just the port and protocol, enabling them to detect and prevent non-standard use of ports for malicious activities. Therefore, the correct answer is: B. NGFW utilizing application inspection

   Source: Adapted from community discussion — Etc_Shadow28000

   Next question

3. Question 83 · 607 in bank

   An enterprise is working with a third party and needs to allow access between the internal networks of both parties for a secure file migration. The solution needs to ensure encryption is applied to all traffic that is traversing the networks. Which of the following solutions should most likely be implemented?

   • AEAP
   • BIPSec
   • CSD-WAN
   • DTLS

   Show answer

   Answer: B

   Explanation

   If you need to secure communication between networks or remote sites, IPsec is a suitable choice. On the other hand, if you are primarily concerned with securing web-based communication, TLS is the preferred option.

   Source: Adapted from community discussion — edmondme

   Next question

4. Question 84 · 607 in bank

   An administrator has identified and fingerprinted specific files that will generate an alert if an attempt is made to email these files outside of the organization. Which of the following best describes the tool the administrator is using?

   • ADLP
   • BSNMP traps
   • CSCAP
   • DIPS

   Show answer

   Answer: A

   Explanation

   DLP is the correct answer because it is specifically designed to detect, monitor, and prevent the unauthorized transfer of sensitive data, such as fingerprinted files, outside the organization. DLP solutions provide the necessary tools to ensure data security by generating alerts and blocking unauthorized data exfiltration attempts.

   Source: Adapted from community discussion — dbrowndiver

   Next question

5. Question 85 · 607 in bank

   A software developer released a new application and is distributing application files via the developer's website. Which of the following should the developer post on the website to allow users to verify the integrity of the downloaded files?

   • AHashes
   • BCertificates
   • CAlgorithms
   • DSalting

   Show answer

   Answer: A

   Explanation

   Hashes is the correct answer because they provide a straightforward and reliable method for verifying the integrity of downloaded files. By comparing the hash of a downloaded file with the hash provided on the website, users can ensure that the file has not been altered, confirming its integrity and authenticity.

   Source: Adapted from community discussion — dbrowndiver

   Next question

6. Question 86 · 607 in bank

   An organization wants to limit potential impact to its log-in database in the event of a breach. Which of the following options is the security team most likely to recommend?

   • ATokenization
   • BHashing
   • CObfuscation
   • DSegmentation

   Show answer

   Answer: B

   Explanation

   When passwords are hashed, the database stores only the hash values instead of the actual passwords. This means that even if the database is breached, the attackers cannot easily obtain the original passwords. Hashing is a one-way function, meaning it is computationally infeasible to reverse-engineer the original input from the hash. This ensures that password data is secure even if exposed. Hashing significantly mitigates the risk of credential theft by ensuring that password data remains protected, making it the most effective choice for securing a log-in database against potential breaches. Hashing is the correct answer because it effectively limits the impact of a database breach by storing only hashed versions of passwords, thereby protecting sensitive credential information. Hashing ensures that even if the log-in database is compromised, the passwords remain secure and difficult for attackers to reverse-engineer.

   Source: Adapted from community discussion — dbrowndiver

   Next question

7. Question 87 · 607 in bank

   An administrator finds that all user workstations and servers are displaying a message that is associated with files containing an extension of .ryk. Which of the following types of infections is present on the systems?

   • AVirus
   • BTrojan
   • CSpyware
   • DRansomware

   Show answer

   Answer: D

   Explanation

   Files are populating a message, nothing else would except ransomware to let the victim know. Also, .ryk is a file extension for Ransomeware Ryuk

   Source: Adapted from community discussion — MAKOhunter33333333

   Next question

8. Question 88 · 607 in bank

   A systems administrator is advised that an external web server is not functioning property. The administrator reviews the following firewall logs containing traffic going to the web server:

   

   Which of the following attacks is likely occurring?

   • ADDoS
   • BDirectory traversal
   • CBrute-force
   • DHTTPS downgrade

   Show answer

   Answer: A

   Explanation

   (100.50.20.7) on port 443. This pattern is typical of a SYN flood DDoS attack, where attackers overwhelm a server with SYN requests to deplete its resources. Simultaneous Connections: All requests occur simultaneously (01:45:09.102), suggesting a coordinated attack, which is a hallmark of DDoS attacks. DDoS is the correct answer because the logs display multiple SYN requests from different IP addresses to the same server in a short time, indicative of a SYN flood DDoS attack aimed at overwhelming the server and causing disruption.

   Source: Adapted from community discussion — dbrowndiver

   Next question

9. Question 89 · 607 in bank

   An organization would like to calculate the time needed to resolve a hardware issue with a server. Which of the following risk management processes describes this example?

   • ARecovery point objective
   • BMean time between failures
   • CRecovery time objective
   • DMean time to repair

   Show answer

   Answer: D

   Explanation

   Mean Time to Repair (MTTR) is the correct answer because it directly relates to calculating the time needed to resolve hardware issues and restore the server to full functionality. MTTR is a critical metric for understanding and improving maintenance processes, ensuring efficient recovery from hardware failures.

   Source: Adapted from community discussion — dbrowndiver

   Next question

10. Question 90 · 607 in bank

    An analyst is evaluating the implementation of Zero Trust principles within the data plane. Which of the following would be most relevant for the analyst to evaluate?

    • ASecured zones
    • BSubject role
    • CAdaptive identity
    • DThreat scope reduction

    Show answer

    Answer: B

    Explanation

    According to the The Official CompTIA Security+ Study Guide (Exam SY0-701) 9th Edition, which is the latest edition, the Zero Trust Architecture is implemented in the CONTROL and DATA planes. The CONTROL plane has the Adaptive identity, Threat Scope Reduction, Policy-Driven Access Control and Policy Decision Point functions; while the DATA plane has the Subject, Policy Enforcement Point and Implicit Trusted Zones functions. In the question, the key word is "...principles within the DATA PLANE,..." and only Answer B: Subject, is in the DATA within the DATA plane.

    Source: Adapted from community discussion — maxxem45

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SY0-701 practice, question 81. 607 questions available.