PRACTICE

CompTIA Security+ (SY0-701) Exam

00

hours hour

00

minutes minute

00

seconds second

Question 1 of 83

Which of the following is an essential component of a well-structured asset management process within an organization's cybersecurity operations?

Question 2 of 83

An organization wants to ensure the security of its sensitive data stored on the company's physical drives, with varying levels of access for different users. Which of the following encryption methods would BEST suit this requirement?

Question 3 of 83

A large multinational company adopts a new standard to enhance its information security management system. The company operates across different regions, so the chosen standard must be internationally recognized. The company wants the standard to provide a comprehensive framework to ensure adequate and proportionate security controls. Which of the following standards would be MOST suitable for the company's needs?

Question 4 of 83

A financial institution receives a significant software update. What is the optimal approach to handle this situation in a change management program?

Question 5 of 83

At a healthcare technology company, a cybersecurity alert flagged an unusual pattern of data traffic from one of its key database servers. Initial analysis indicates a potential data breach that is not yet conclusively confirmed. The server contains sensitive patient data. If confirmed, it could have severe legal and reputational implications for the company. What steps should the incident response team take to better understand the situation?

Question 6 of 83

An organization has just completed an assessment of all the points where a threat actor might exploit a vulnerability in the network. This analysis includes its computer systems, network ports, applications, and user interactions. What is the term for this collection of potential points of exploitation?

Question 7 of 83

After an extensive security audit, a medium-sized corporation discovers several of its company laptops contain malware. The malware is most likely the result of the use of unauthorized USB storage devices. The chief information security officer (CISO) wants to prevent similar incidents in the future. Which of the following options would best mitigate this risk?

Question 8 of 83

A company’s IT department has noticed irregularities in network usage and resource allocation. Which tool would be MOST beneficial in collecting the metadata and statistics from the network traffic?

Question 9 of 83

A tech company employs the Single Loss Expectancy (SLE) and Annualized Loss Expectancy (ALE) models for quantitative assessment and uses subjective judgment for qualitative analysis. They use a "heat map" or "traffic light" impact matrix to represent the severity of the risk, its likelihood, cost of controls, etc. What is the primary benefit of the company's approach of combining both quantitative and qualitative risk assessment methods?

Question 10 of 83

A large technology firm adopts the National Institute of Standards and Technology (NIST) Cybersecurity Framework to improve its security posture. The company has hired an external security consultant to conduct a gap analysis to identify areas in which the firm deviates from the recommended framework controls. What is the MOST accurate description of this process?

Question 11 of 83

An organization considers a new third-party vendor to provide critical technology solutions. It is nearing the final stages of the vendor selection process and wants to ensure a robust assessment of the vendor's security practices and risk management capabilities. Provided approval is granted, which method would be MOST suitable for the organization to gain an in-depth understanding of the vendor's security controls, identify potential vulnerabilities in its systems, and validate the effectiveness of its security measures?

Question 12 of 83

A large corporation with employees spread across different locations wants to enhance its endpoint security. The corporation has had an increase in cybersecurity threats, and its existing antivirus solutions do not seem to be effective against advanced persistent threats. Which of the following mitigation techniques would provide the BEST protection for this situation?

Question 13 of 83

A lead architect is designing a new security system for a multinational corporation. The Chief Executive Officer (CEO) emphasizes that the continuity of business operations is a top priority. Why would incorporating resilience and recovery into the security architecture be vital in this scenario?

Question 14 of 83

A software development company recognizes that some of its employees are vulnerable to phishing attacks. To address this, the company plans to set up a training program. What factors should the company primarily consider while defining such training programs?

Question 15 of 83

A cybersecurity analyst notices that a certain rule in the Security Information and Event Management (SIEM) system is generating a high volume of dashboard notifications, making it difficult for the team to manage. Which action would be MOST effective in dealing with this issue?

Question 16 of 83

An employee at a company is having difficulty remembering a complex password for their workstation and is looking for a more secure and memorable alternative. What type of credential would be the BEST recommendation?

Question 17 of 83

In the context of a global manufacturing firm transitioning to a remote work arrangement due to a crisis, which aspect is the MOST critical to ensure business continuity?

Question 18 of 83

An organization is planning to secure its data in all its states: at rest, in transit, and in use. This includes large volumes of data that it continuously transfers over the network. Which of the following schemes is the BEST approach to achieve this while maintaining efficiency and security?

Question 19 of 83

A company wants to establish a secure communication channel with its remote employees. The company aims to ensure that the individuals communicating are who they claim to be to avoid any potential on-path attacks. Which system can help the company meet its objectives?

Question 20 of 83

A large organization is planning to move its operations to the cloud and is considering different cloud deployment models. The organization wants to achieve a balance of cost, security, flexibility, and control over its data and applications and is considering a hybrid cloud model but has concerns about the security implications. Which of the following is a potential security challenge the organization should consider when using a hybrid cloud model?

Question 21 of 83

An organization recently hired a new employee who passed all the necessary background checks and completed the recruitment process successfully. The organization wants to ensure that the new employee's integration into the company is as smooth and secure as possible. Which of the following procedures would be MOST appropriate to apply in this situation?

Question 22 of 83

An IT security analyst at a mid-sized company has observed unusual network activity on a workstation over the past few days. This workstation has initiated frequent and unsolicited communications with an unknown external IP address. Further investigation reveals the presence of unauthorized software on the workstation, which seems to be actively transmitting sensitive system data to this external address and possibly receiving commands or files in return without any visible signs or knowledge of the user. Given these specific behaviors, what type of malware is MOST likely responsible for these activities?

Question 23 of 83

An IT architect of a medium-sized e-commerce business is planning to optimize their system's capacity and lower operating costs. As part of this, the architect is considering a clustering solution for the servers, with the key objective being maximum capacity and seamless customer experience. Which type of clustering setup would BEST meet the needs of this e-commerce business?

Question 24 of 83

Given the importance of automation and orchestration related to secure operations, a newly hired IT employee creates, modifies, and deletes user accounts and access rights across the company's IT systems. Due to the significant number of users and the heightened need for security, this task proves to be time-consuming and error-prone. Which automation capability can not only improve the efficiency and consistency of this task but also ensure secure operations?

Question 25 of 83

An organization receives large amounts of diverse data sources during cybersecurity incidents and needs a more efficient tool. Dealing with system memory, log files, network traffic, and endpoint security data has proven to be chaotic. What primary function would a Security Information and Event Management (SIEM) tool serve in this scenario?

Question 26 of 83

Which of the following threat actors is MOST likely to exploit unsecured networks using default credentials for financial gains?

Question 27 of 83

Considering common threat vectors and attack surfaces, which statement BEST describes the primary risk, from a cybersecurity perspective, with using unsupported systems and applications?

Question 28 of 83

A newly appointed Information Security Officer at a startup company is improving IT security. The current IT environment lacks standardized security configurations, and various operating systems, applications, and network devices are in use. The officer decides to implement secure baseline configurations but also wants to ensure the chosen approach can adapt to evolving threats and handle the diversity in the company's IT environment. What is the MOST appropriate approach to achieve these goals?

Question 29 of 83

An organization stores its sensitive data on physical storage devices. It wants to bolster security measures due to a rise in industrial espionage and the risk of physical theft of these devices. Which of the following encryption strategies would be the MOST effective for the organization to choose?

Question 30 of 83

An organization recently experienced a security breach due to the actions of an employee who engaged in an activity that posed a risk to the company's information systems. The employee downloaded unverified software onto the company device, resulting in a malware infection. Following this incident, the company plans to implement a policy to prevent similar occurrences in the future. Which of the following policies is MOST suitable for addressing this specific issue?

Question 31 of 83

A company has been experiencing issues with operator fatigue within the cybersecurity team, leading to decreased alertness and cognitive function. Considering different strategies to help combat this issue, how can automation and orchestration assist in addressing operator fatigue in security operations?

Question 32 of 83

A company has recently suffered a data breach due to an attacker gaining unauthorized access to its system via an unsecured network interface on one of its machines. To prevent similar incidents in the future, what steps should the company take as part of its endpoint hardening strategy?

Question 33 of 83

A multinational organization is planning to expand its services to various locations across the globe. The organization requires a flexible IT infrastructure that can easily adapt to rapid business growth but also maintain data security and meet different legal and regulatory requirements. Which of the following architecture models would be MOST suitable for this organization?

Question 34 of 83

A multinational firm headquartered in San Francisco, California, serves customers from various countries, including European Union countries. The company collects, processes, and stores substantial amounts of personal data. With which of the following legal regulations must the company's governance committee ensure compliance?

Question 35 of 83

The network administrator of a company receives an email notification about an unusual email activity. Multiple employees received an email with an attached file having an odd double extension: .docx and .hta. The email system's security feature flagged the email as potentially harmful. Based on the provided details, what type of virus is MOST likely involved in this scenario?

Question 36 of 83

A company has implemented a zone-based security topology with different levels of trust and access control requirements for hosts within its network perimeter. The company has various zones, including a low-privilege zone for printers, an enterprise local area network (LAN) for client devices, a guest zone, and a zone for public-facing servers. Which of the following statements about the inter-zone traffic is correct?

Question 37 of 83

In the context of information security, an organization discovers a zero-day vulnerability in its database software. At the same time, a known hacking group has expressed intentions to target entities using this specific software. Which of the following BEST describes this situation's relation to vulnerability, threat, and risk?

Question 38 of 83

A large multinational corporation recently suffered a significant data breach. The organization had established an Incident Response Plan (IRP) that primarily consisted of a team of skilled cybersecurity analysts. However, the data breach escalated rapidly, and the company found itself in the headlines, which caused serious damage to its reputation. What key elements were likely missing from the company's Incident Response Plan?

Question 39 of 83

A cybersecurity team at an organization prepares to carry out an assessment that aims to mimic potential attackers' tactics, techniques, and procedures (TTPs) to identify vulnerabilities and weaknesses in the organization's digital systems. What type of penetration test is the team about to conduct?

Question 40 of 83

A cybersecurity analyst uses a Security Information and Event Management (SIEM) tool to monitor network activity in a large organization. During a shift, the analyst receives multiple alerts indicating the same user account is experiencing multiple login failures. They received the alert only after multiple login failures occurred within an hour. Which of the following correlation rules likely triggered this alert?

Question 41 of 83

An organization observes employees leaving sensitive documents on their desks, thereby exposing sensitive data in the work area. To stop unauthorized staff or guests from accessing this information, the organization decides to introduce a new policy. Which policy would resolve this issue?

Question 42 of 83

A manufacturing organization identifies its server maintenance and repair process as a mission-essential function. The company experienced three server failures in the last year, each failure taking approximately six hours to repair and restore operations. A standard operational year is usually assumed to be 8,760 hours (24*365). Given the company's performance metrics and assuming operations run all day and every day, what are the annual MTBF and MTTR for the organization's server maintenance and repair process?

Question 43 of 83

An organization in the healthcare sector notices an increase in ransomware attacks in their industry. How should it adjust its vulnerability analysis strategy?

Question 44 of 83

In an IT environment, automation and scripting play a critical role in managing services and access. How does automation assist security analysts in their daily tasks?

Question 45 of 83

Two businesses establish a new vendor relationship. Before proceeding with formal contractual agreements, the organizations want to mutually outline their intentions, shared goals, and general terms of cooperation. Which of the following agreements would BEST suit this initial stage?

Question 46 of 83

Which of the following describes the placement and role of a firewall in a network with a defense-in-depth strategy?

Question 47 of 83

Which of the following BEST describes the purpose of fundamental security concepts in the cybersecurity profession?

Question 48 of 83

What type of data is information that can easily be understood and interpreted without additional processing or translation?

Question 49 of 83

Under the General Data Protection Regulation (GDPR), how soon must an organization report a breach of personal data?

Question 50 of 83

A group of hackers, exploiting vulnerabilities in a certain organization's online platforms and using spear-phishing techniques, launches a series of attacks disrupting the organization’s services. These attack vectors target both software flaws and human elements of the organization. Driven by disdain for the organization’s practices, their primary objective is to raise awareness and bring about changes in the organization’s conduct. Based on this information, what is the primary motivation of these threat actors?

Question 51 of 83

A software company designs a new feature for its product involving the creation and storage of new algorithms and methods that give the product a competitive advantage. The company wants to appropriately classify this information within its data management system. What would be the MOST fitting classification for this data?

Question 52 of 83

An organization validates its security controls, processes, and adherence to industry standards and wants an unbiased evaluation to instill confidence among stakeholders. Which method should it employ for this purpose?

Question 53 of 83

The cybersecurity team of a company notices suspicious activities on its network. Some computers have increased memory usage and are sending out network requests repeatedly to random IP ranges. No one observed an interaction when these activities started. Based on the provided details, what type of malicious activity is MOST likely happening in this scenario?

Question 54 of 83

The company’s system has recently detected suspicious network activity, signaling a possible cybersecurity incident. The incident response team has assembled, and after going through the detection and analysis phases, the containment phase of the incident response process has started. In this phase, what is the primary objective?

Question 55 of 83

A cybersecurity analyst for a medium-sized company needs to perform a vulnerability scan that provides an in-depth analysis of potential weaknesses in the company's system, including misconfigured applications and security settings. The analyst is considering using a credentialed or non-credentialed scan. Which type of scan is MOST appropriate for this situation?

Question 56 of 83

Which of the following mitigation techniques refers to the process of protecting all information on a hard drive, including the programs responsible for booting an operating system?

Question 57 of 83

An employee at a company frequently recycles old passwords when prompted for a password change. What feature of a password policy can prevent this?

Question 58 of 83

A technology company experiences several security vulnerabilities with its online application, leading to customer complaints and legal threats. In response, the board of directors decides to outsource the maintenance and associated liabilities of the application to a third party. Which risk management strategy is the company primarily implementing?

Question 59 of 83

A newly established organization has decided to implement Virtual LANs (VLANs) for segmenting workstation computer hosts from Voice over Internet Protocol (VoIP) handsets. The organization is using two VLANs that map to two subnets: 10.1.32.0/24 for workstation computers and 10.1.40.0/24 for VoIP handsets. In this setup, what could be a potential security advantage?

Question 60 of 83

At a medium-scale software development firm, significant modifications to several critical applications that employees use daily are on the horizon. Considering the principles of change management, what should the primary focus be during the implementation phase of these changes?

Question 61 of 83

Given the complexities and benefits of secure protocols, which statement BEST guides the chief information security officer's (CISO) approach to implementing them?

Question 62 of 83

Which of the following descriptions is true about fail-open and fail-closed configurations for security devices in the event of a failure?

Question 63 of 83

An organization's automated scanner has just flagged a vulnerability with the identifier CVE-2023-0150. What are some initial steps the organization should take to understand and potentially address this vulnerability?

Question 64 of 83

A mid-sized tech company has started experiencing regular system slowdowns and data traffic abnormalities. However, its current intrusion detection system (IDS) has generated no alerts. The IT department relies heavily on the IDS for potential threats and does not actively monitor system metrics or logs. Which statement is MOST likely true about the situation?

Question 65 of 83

A company is considering moving its applications and data to the cloud. The company handles sensitive data and wants to maintain control over the security of its applications and data. It is considering using an infrastructure-as-a-service (IaaS) model. Which of the following is a key responsibility the company will need to manage in an IaaS model?

Question 66 of 83

In the event of a confirmed ransomware attack on a server containing valuable intellectual property, what should be the immediate next step?

Question 67 of 83

A cybersecurity team has discovered an unauthorized alteration in the endpoint configuration of several workstations within the organization, resulting in a malware infection. As part of the response strategy, the team must select a specific mitigation technique to prevent similar incidents in the future. Which of the following is the MOST suitable approach to undertake?

Question 68 of 83

A software engineer discovers a flaw in one of the organization's existing products that could allow nefarious attackers to gain unauthorized access to the system on which it is running. What vulnerability signifies that developers must immediately fix the problem or widespread damage could ensue before a patch is available?

Question 69 of 83

A large financial institution recently adopted a Bring Your Own Device (BYOD) policy. It understands the cost and flexibility advantages of this approach but is concerned about the potential security implications. Specifically, the institution wants to ensure that its sensitive data remains protected even when accessed from or stored on employees' personal devices. What would be the MOST effective strategy to safeguard data in this context?

Question 70 of 83

A newly launched online store wants to secure transactions between the store and customers using a pair of public and private keys. Which cryptographic technique would BEST meet these requirements?

Question 71 of 83

Which, usually small-organization, threat actor uses cyber weapons to promote political agendas and perform service disruption attacks?

Question 72 of 83

A multinational company discovered its existing cybersecurity policies were no longer adequate due to evolving cybersecurity threats and updated industry regulations. The board of directors, comprising high-ranking executives, decided to review and revise the policies. Who should the company involve in this process?

Question 73 of 83

An organization's systems and networks are made of various exploitable components and entry points. The organization also faces a cybersecurity threat from a group located outside the organization with extensive funding and highly skilled members capable of creating advanced exploit techniques, but no internal access. Considering the potential vulnerabilities in systems and networks, and based on these attributes, which of the following BEST describes the threat actor and the primary attack surface they might target?

Question 74 of 83

An organization has decommissioned several laptops used for handling sensitive data. Which of the following should be the primary step to ensure data security and compliance with regulations before repurposing or disposing of these devices?

Question 75 of 83

Which of the following accurately reflects the responsibilities of a data processor under data protection laws such as the General Data Protection Regulation (GDPR)?

Question 76 of 83

A cybersecurity analyst for a large organization is enhancing the company's security posture. The analyst notices increased alerts related to a particular known exploit in the company's server software. The company's intrusion detection system (IDS) uses a predefined set of rules, provided by security personnel, to identify events that are unacceptable. What type of detection method is the company using in this scenario?

Question 77 of 83

Which of the following is a correct interpretation of data sovereignty?

Question 78 of 83

A technology company identifies a potential risk in the form of data breaches due to vulnerabilities in its e-commerce application. The company has assessed that the likelihood of occurrence is high, and the impact could be significant, leading to loss of customer trust and potential legal liabilities. The company has assigned a team to manage this risk and to implement necessary security measures to mitigate it. Which of the following is the BEST description of the role this team is performing?

Question 79 of 83

A company plans to expand its existing network, which currently employs a basic star topology, by adding hundreds more devices. What is a potential drawback of this plan?

Question 80 of 83

A multinational corporation is sending sensitive data to various regional offices securely. What is an optimal cryptographic method to employ in this situation?

Question 81 of 83

A major software vendor becomes aware of a new zero-day vulnerability in one of its products due to an anonymous tip. The vulnerability could potentially allow unauthorized access to sensitive data stored in the software. The vendor is currently creating a patch to address the issue. Which of the following BEST describes the current risk to the software users and the appropriate response from the software vendor?

Question 82 of 83

An organization prepares to store and handle a data type that includes sensitive personal information, such as healthcare records and social security numbers. This data is subject to specific laws and regulations concerning its protection and use. What category does this data type fall under?

Question 83 of 83

The network administrator of an educational institution is upgrading an existing wireless network. The campus has various buildings, each having multiple floors, and the aim is to ensure consistent Wi-Fi coverage across the entire campus. To achieve this, a site survey and heat map creation will guide the placement and configuration of wireless access points (WAPs). Which of the following would MOST accurately represent the correct actions based on the survey results?