CompTIA Security+ Certification Exam: When Will the SY0-701 Exam Be Launched?

1. A company has discovered unauthorized devices are using its WiFi network, and it wants to harden the access point to improve security.

Which f the following configuration should an analysis enable To improve security? (Select TWO.)

2. During an incident a company CIRT determine it is necessary to observe the continued network-based transaction between a callback domain and the malware running on an enterprise PC.

Which of the following techniques would be BEST to enable this activity while reducing the risk of lateral spread and the risk that the adversary would notice any changes?

3. Which of the following environment utilizes dummy data and is MOST to be installed locally on a system that allows to be assessed directly and modified easily wit each build?

4. A desktop support technician recently installed a new document-scanning software program on a computer. However, when the end user tried to launch the program, it did not respond.

Which of the following is MOST likely the cause?

5. A company recently experienced an attack during which its main website was Directed to the attacker's web server, allowing the attacker to harvest credentials from unsuspecting customers,.

Which of the following should the

company implement to prevent this type of attack from occurring In the future?

6. A security engineer is installing a WAF to protect the company's website from malicious web requests over SSL.

Which of the following is needed to meet the objective?

7. A security analyst has received several reports of an issue on an internal web application. Users state they are having to provide their credentials twice to log in. The analyst checks with the application team and notes this is not an expected behavior.

After looking at several logs, the analyst decides to run some commands on the gateway and obtains the following output:

Which of the following BEST describes the attack the company is experiencing?

8. A company recently experienced an attack during which 5 main website was directed to the atack-er’s web server, allowing the attacker to harvest credentials from unsuspecting customers.

Which of the following should the company Implement to prevent this type of attack from occurring in the future?

9. A security engineer is installing a WAF to protect the company's website from malicious web requests over SSL.

Which of the following is needed to meet the objective?

10. Which of the following BEST describes a social-engineering attack that relies on an executive at a small business visiting a fake banking website where credit card and account details are harvested?

11. If a current private key is compromised, which of the following would ensure it cannot be used to decrypt ail historical data?

12. Which of the following environments can be stood up in a short period of time, utilizes either dummy

data or actual data, and is used to demonstrate and model system capabilities and functionality for a

fixed, agreed-upon

duration of time?

13. After segmenting the network, the network manager wants to control the traffic between the segments.

Which of the following should the manager use to control the network traffic?

14. A security researcher is tracking an adversary by noting its attacks and techniques based on its capabilities, infrastructure, and victims.

Which of the following is the researcher MOST likely using?

15. A security engineer needs to create a network segment that can be used for servers thal require connections from untrusted networks.

Which of the following should the engineer implement?

16. one of the attendees starts to notice delays in the connection. and the HTTPS site requests are reverting to HTTP.

Which of the following BEST describes what is happening?

17. A major clothing company recently lost a large amount of proprietary information. The security officer must find a solution to ensure this never happens again.

Which of the following is the BEST technical implementation to prevent this from happening again?

18. The spread of misinformation surrounding the outbreak of a novel virus on election day led to eligible voters choosing not to take the risk of going the polls.

This is an example of:

19. A company is required to continue using legacy software to support a critical service.

Which of the following BEST explains a risk of this practice?

20. A security researcher has alerted an organization that its sensitive user data was found for sale on a website.

Which of the following should the organization use to inform the affected parties?

21. A company wants to modify its current backup strategy to modify its current backup strategy to minimize the number of backups that would need to be restored in case of data loss.

Which of the following would be the BEST backup strategy

22. Which of the following is the MOST secure but LEAST expensive data destruction method for data that is stored on hard drives?

23. A security analyst is investigating multiple hosts that are communicating to external IP addresses during the hours of 2:00 a.m - 4:00 am. The malware has evaded detection by traditional antivirus software.

Which of the following types of malware is MOST likely infecting the hosts?

24. Which of the following would be BEST for a technician to review to determine the total risk an organization can bear when assessing a "cloud-first" adoption strategy?

25. Which of the following cryptographic concepts would a security engineer utilize while implementing non-repudiation? (Select TWO)

26. A security analyst notices several attacks are being blocked by the NIPS but does not see anything on

the boundary firewall logs. The attack seems to have been thwarted.

Which of the following resiliency techniques was applied to the network to prevent this attack?

27. Which of the following isa risk that is specifically associated with hesting applications iin the public cloud?

28. A company is required to continue using legacy software to support a critical service.

Which of the following BEST explains a risk of this practice?

29. After a hardware incident, an unplanned emergency maintenance activity was conducted to rectify the issue. Multiple alerts were generated on the SIEM during this period of time.

Which of the following BEST explains what happened?

30. A security administrator is setting up a SIEM to help monitor for notable events across the enterprise.

Which of the following control types does this BEST represent?

31. A network analyst is setting up a wireless access point for a home office in a remote, rural location. The requirement is that users need to connect to the access point securely but do not want to have to remember passwords.

Which of the following should the network analyst enable to meet the requirement?

32. Which of the following environments utilizes dummy data and is MOST likely to be installed locally on a system that allows code to be assessed directly and modified easily with each build?

33. While reviewing pcap data, a network security analyst is able to locate plaintext usernames and passwords being sent from workstations to network witches.

Which of the following is the security analyst MOST likely observing?

34. A client sent several inquiries to a project manager about the delinquent delivery status of some critical reports. The project manager claimed the reports were previously sent via email, but then quickly generated and backdated the reports before submitting them as plain text within the body of a new email message thread.

Which of the following actions MOST likely supports an investigation for fraudulent submission?

35. A new vulnerability in the SMB protocol on the Windows systems was recently discovered, but no patches are currently available to resolve the issue. The security administrator is concerned tf servers in the company's DMZ will be vulnerable to external attack; however, the administrator cannot disable the service on the servers, as SMB is used by a number of internal systems and applications on the LAN.

Which of the following TCP ports should be blocked for all external inbound connections to the DMZ as a workaround to protect the servers? (Select TWO).

36. When planning to build a virtual environment, an administrator need to achieve the following,

• Establish polices in Limit who can create new VMs

• Allocate resources according to actual utilization‘

• Require justification for requests outside of the standard requirements.

• Create standardized categories based on size and resource requirements.

Which of the following is the administrator MOST likely trying to do?

37. A security analyst wants to verify that a client-server (non-web) application is sending encrypted traffic.

Which of the following should the analyst use?

38. Ann, a customer, received a notification from her mortgage company stating her PII may be shared with partners, affiliates, and associates to maintain day-to-day business operations.

Which of the following documents did Ann receive?

39. A large enterprise has moved all its data to the cloud behind strong authentication and encryption. A sales director recently had a laptop stolen, and later, enterprise data was found to have been compromised from a local database.

Which of the following was the MOST likely cause?

40. The following are the logs of a successful attack.

Which of the following controls would be BEST to use to prevent such a breach in the future?

41. During a Chief Information Security Officer (CISO) convention to discuss security awareness, the attendees are provided with a network connection to use as a resource. As the convention progresses, one of the attendees starts to notice delays in the connection, and the HIIPS site requests are reverting to HTTP.

Which of the following BEST describes what is happening?

42. An organization would like to remediate the risk associated with its cloud service provider not meeting its advertised 99.999% availability metrics.

Which of the following should the organization consult for the exact requirements for the cloud provider?

43. An enterprise has hired an outside security firm to facilitate penetration testing on its network and applications. The firm has agreed to pay for each vulnerability that ts discovered.

Which of the following BEST represents the type of testing that is being used?

44. A retail company that is launching @ new website to showcase the company’s product line and other information for online shoppers registered the following URLs:

* www companysite com

* shop companysite com

* about-us companysite com contact-us. companysite com secure-logon company site com

Which of the following should the company use to secure its website if the company is concerned with convenience and cost?

45. Which of the following disaster recovery tests is the LEAST time consuming for the disaster recovery team?

46. A systems administrator is considering different backup solutions for the IT infrastructure. The company is looking for a solution that offers the fastest recovery time while also saving the most amount of storage used to maintain the backups.

Which of the following recovery solutions would be the BEST option to meet these requirements?

47. After a phishing scam fora user's credentials, the red team was able to craft payload to deploy on a server. The attack allowed the installation of malicious software that initiates a new remote session.

Which of the following types of attacks has occurred?

48. A cybersecurity administrator needs to implement a Layer 7 security control on a network and block potential attacks.

Which of the following can block an attack at Layer 7? (Select TWO).

49. During an incident, a company's CIRT determines it is necessary to observe the continued network-based transactions between a callback domain and the malware running on an enterprise PC.

Which of the following techniques would be BEST to enable this activity while reducing the nsk of lateral spread and the risk that the adversary would notice any changes?

50. A business is looking for a cloud service provider that offers a la carte services, including cloud backups, VM elasticity, and secure networking.

Which of the following cloud service provider types should business engage?

51. A security analyst is responding to an alert from the SIEM. The alert states that malware was discovered on a host and was not automatically deleted.

Which of the following would be BEST for the analyst to perform?

52. A cybersecurity administrator needs to allow mobile BYOD devices to access network resources. As the devices are not enrolled to the domain and do not have policies applied to them, which of the following are best practices for authentication and infrastructure security? (Select TWO).

53. An analyst is working on an email security incident in which the target opened an attachment containing a worm. The analyst wants to implement mitigation techniques to prevent further spread.

Which of the following is the BEST course of action for the analyst to take?

54. An enterprise needs to keep cryptographic keys in a safe manner.

Which of the following network appliances can achieve this goal?

55. An organization recently acquired an ISO 27001 certification.

Which of the following would MOST likely be considered a benefit of this certification?

56. A company would like to provide flexibility for employees on device preference. However, the company is concerned about supporting too many different types of hardware.

Which of the following deployment models will provide the needed flexibility with the GREATEST amount of control and security over company data and infrastructure?

57. A security analyst reports a company policy violation in a case in which a large amount of sensitive data is being downloaded after hours from various mobile devices to an external site. Upon further investigation, the analyst notices that successful login attempts are being conducted with impossible travel times during the same time periods when the unauthorized downloads are occurring. The analyst also discovers a couple of WAPs are using the same SSID, but they have non-standard DHCP configurations and an overlapping channel.

Which of the following attacks is being conducted?

58. A security analyst must enforce policies to harden an MDM infrastructure.

The requirements are as follows:

* Ensure mobile devices can be tracked and wiped.

* Confirm mobile devices are encrypted.

Which of the following should the analyst enable on all the devices to meet these requirements?

59. A company installed several crosscut shredders as part of increased information security practices targeting data leakage risks.

Which of the following will this practice reduce?

60. Which of the following conditions impacts data sovereignty?

61. Developers are writing code and merging it into shared repositories several times a day, where it is tested automatically.

Which of the following concepts does this BEST represent?

62. A company uses a drone for precise perimeter and boundary monitoring.

Which of the following should be MOST concerning to the company?

63. The security team received a report of copyright infringement from the IP space of the corporate network. The report provided a precise time stamp for the incident as well as the name of the copyrighted files. The analyst has been tasked with determining the infringing source machine and instructed to implement measures to prevent such incidents from occurring again.

Which of the following is MOST capable of accomplishing both tasks?

64. A user reports trouble using a corporate laptop. The laptop freezes and responds slowly when writing documents and the mouse pointer occasional disappears.

The task list shows the following results

Which of the following is MOST likely the issue?

65. Which of the following function as preventive, detective, and deterrent controls to reduce the risk of physical theft? (Select TWO).

66. A security assessment found that several embedded systems are running unsecure protocols. These Systems were purchased two years ago and the company that developed them is no longer in business.

Which of the following constraints BEST describes the reason the findings cannot be remediated?

67. Which of the following uses six initial steps that provide basic control over system security by including hardware and software inventory, vulnerability management, and continuous monitoring to minimize risk in all network environments?

68. The Chief Executive Officer announced a new partnership with a strategic vendor and asked the Chief

Information Security Officer to federate user digital identities using SAML-based protocols.

Which of the following will this enable?

69. A company was compromised, and a security analyst discovered the attacker was able to get access to a service account.

The following logs were discovered during the investigation:

Which of the following MOST likely would have prevented the attacker from learning the service account name?

70. The SIEM at an organization has detected suspicious traffic coming a workstation in its internal network. An analyst in the SOC the workstation and discovers malware that is associated with a botnet is installed on the device A review of the logs on the workstation reveals that the privileges of the local account were escalated to a local administrator.

To which of the following groups should the analyst report this real-world event?

71. A financial institution would like to store its customer data in a cloud but still allow the data to be accessed and manipulated while encrypted. Doing so would prevent the cloud service provider from being able to decipher the data due to its sensitivity. The financial institution is not concerned about computational overheads and slow speeds.

Which of the following cryptographic techniques would BEST meet the requirement?

72. A company reduced the area utilized in its datacenter by creating virtual networking through automation and by creating provisioning routes and rules through scripting.

Which of the following does this example describe?

73. A global company is experiencing unauthorized logging due to credential theft and account lockouts caused by brute-force attacks. The company is considering implementing a third-party identity provider to help mitigate these attacks.

Which of the following would be the BEST control for the company to require from prospective vendors?

74. An organization wants to integrate its incident response processes into a workflow with automated decision points and actions based on predefined playbooks.

Which of the following should the organization implement?

75. A bad actor tries to persuade someone to provide financial information over the phone in order to gain access to funds.

Which of the following types of attacks does this scenario describe?

76. Which of the following must be in place before implementing a BCP?

77. A developer is building a new portal to deliver single-pane-of-glass management capabilities to customers with multiple firewalls. To Improve the user experience, the developer wants to implement an authentication and authorization standard that uses security tokens that contain assertions to pass user Information between nodes.

Which of the following roles should the developer configure to meet these requirements? (Select TWO).

78. An organization wants seamless authentication to its applications.

Which of the following should the organization employ to meet this requirement?

79. A security analyst is running a vulnerability scan to check for missing patches during a suspected security rodent During which of the following phases of the response process is this activity MOST likely occurring?

80. A security engineer needs to build @ solution to satisfy regulatory requirements that stale certain critical servers must be accessed using MFA However, the critical servers are older and

are unable to support the addition of MFA,

Which of the following will the engineer MOST likely use to achieve this objective?

81. Which of the following environments would MOST likely be used to assess the execution of component parts of a system at both the hardware and software levels and to measure performance characteristics?

82. A company is implementing a new SIEM to log and send alerts whenever malicious activity is blocked by its antivirus and web content filters.

Which of the following is the primary use case for this scenario?

83. Which of the following in a forensic investigation should be priorities based on the order of volatility? (Select TWO).

84. The Chief Technology Officer of a local college would like visitors to utilize the school's WiFi but must be able to associate potential malicious activity to a specific person.

Which of the following would BEST allow this objective to be met?

85. An analyst Is generating a security report for the management team. Security guidelines recommend disabling all listening unencrypted services.

Given this output from Nmap:

Which of the following should the analyst recommend to disable?

86. As part of a company's ongoing SOC maturation process, the company wants to implement a method to share cyberthreat intelligence data with outside security partners.

Which of the following will the company MOST likely implement?

87. A security incident has been resolved.

Which of the following BEST describes the importance of the final phase of the incident response plan?

88. Which of the following describes a maintenance metric that measures the average time required to troubleshoot and restore failed equipment?

89. Which of the following should a technician consider when selecting an encryption method for data that needs to remain confidential for a specific length of time?

90. A network analyst is investigating compromised corporate information. The analyst leads to a theory that network traffic was intercepted before being transmitted to the internet.

The following output was captured on an internal host:

Based on the IoCS, which of the following was the MOST likely attack used to compromise the network communication?

91. A security analyst is investigating a phishing email that contains a malicious document directed to the company's Chief Executive Officer (CEO).

Which of the following should the analyst perform to understand the threat and retrieve possible IoCs?

92. A customer has reported that an organization's website displayed an image of a smiley (ace rather than the expected web page for a short time two days earlier.

A security analyst reviews log tries and sees the following around the lime of the incident:

Which of the following is MOST likely occurring?

93. Which of the following would produce the closet experience of responding to an actual incident response scenario?

94. A security analyst was deploying a new website and found a connection attempting to authenticate on the site's portal. While Investigating.

The incident, the analyst identified the following Input in the username field:

Which of the following BEST explains this type of attack?

95. The Chief Information Security Officer directed a risk reduction in shadow IT and created a policy requiring all unsanctioned high-risk SaaS applications to be blocked from user access.

Which of the following is the BEST security solution to reduce this risk?

96. After a WiFi scan of a local office was conducted, an unknown wireless signal was identified Upon investigation, an unknown Raspberry Pi device was found connected to an Ethernet port using a single connection.

Which of the following BEST describes the purpose of this device?

97. Remote workers in an organization use company-provided laptops with locally installed applications and locally stored data Users can store data on a remote server using an encrypted connection. The organization discovered data stored on a laptop had been made available to the public.

Which of the following security solutions would mitigate the risk of future data disclosures?

98. A security researcher has alerted an organization that its sensitive user data was found for sale on a website.

Which of the following should the organization use to inform the affected parties?

99. An organization's Chief Information Security Officer is creating a position that will be responsible for implementing technical controls to protect data, including ensuring backups are properly maintained.

Which of the following roles would MOST likely include these responsibilities?

100. Which of the following would MOST likely be identified by a credentialed scan but would be missed by an uncredentialed scan?