Free CompTIA SY0-701 Practice Exams - Page 10 of 19

Question #91

Which of the following is most likely associated with introducing vulnerabilities on a corporate network by the deployment of unapproved software?

A . Hacktivists
B . Script kiddies
C . Competitors
D . Shadow IT

Reveal Solution Hide Solution

Question #92

A company is currently utilizing usernames and passwords, and it wants to integrate an MFA method that is seamless, can Integrate easily into a user’s workflow, and can utilize employee-owned devices.

Which of the following will meet these requirements?

A . Push notifications
B . Phone call
C . Smart card
D . Offline backup codes

Reveal Solution Hide Solution

Question #93

Which of the following types of identification methods can be performed on a deployed application during runtime?

A . Dynamic analysis
B . Code review
C . Package monitoring
D . Bug bounty

Reveal Solution Hide Solution

Question #94

Company A jointly develops a product with Company B, which is located in a different country.

Company A finds out that their intellectual property is being shared with unauthorized companies.

Which of the following has been breached?

A . SLA
B . AUP
C . SOW
D . MOA

Reveal Solution Hide Solution

Question #95

Which of the following best represents an application that does not have an on-premises requirement and is accessible from anywhere?

A . Pass
B . Hybrid cloud
C . Private cloud
D . IaaS
E . SaaS

Reveal Solution Hide Solution

Question #96

Which of the following Is a common, passive reconnaissance technique employed by penetration testers in the early phases of an engagement?

A . Open-source intelligence
B . Port scanning
C . Pivoting
D . Exploit validation

Reveal Solution Hide Solution

Question #97

A customer has a contract with a CSP and wants to identify which controls should be implemented in the IaaS enclave.

Which of the following is most likely to contain this information?

A . Statement of work
B . Responsibility matrix
C . Service-level agreement
D . Master service agreement

Reveal Solution Hide Solution

Question #98

A systems administrator is looking for a low-cost application-hosting solution that is cloud-based.

Which of the following meets these requirements?

A . Serverless framework
B . Type 1 hvpervisor
C . SD-WAN
D . SDN

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

A serverless framework is a cloud-based application-hosting solution that meets the requirements of low-cost and cloud-based. A serverless framework is a type of cloud computing service that allows developers to run applications without managing or provisioning any servers. The cloud provider handles the server-side infrastructure, such as scaling, load balancing, security, and maintenance, and charges the developer only for the resources consumed by the application. A serverless framework enables developers to focus on the application logic and functionality, and reduces the operational costs and complexity of hosting applications. Some examples of serverless frameworks are AWS Lambda, Azure Functions, and Google Cloud Functions.

A type 1 hypervisor, SD-WAN, and SDN are not cloud-based application-hosting solutions that meet the requirements of low-cost and cloud-based. A type 1 hypervisor is a software layer that runs directly on the hardware and creates multiple virtual machines that can run different operating systems and applications. A type 1 hypervisor is not a cloud-based service, but a virtualization technology that can be used to create private or hybrid clouds. A type 1 hypervisor also requires the developer to manage and provision the servers and the virtual machines, which can increase the operational costs and complexity of hosting applications. Some examples of type 1 hypervisors are VMware ESXi, Microsoft Hyper-V, and Citrix XenServer.

SD-WAN (Software-Defined Wide Area Network) is a network architecture that uses software to dynamically route traffic across multiple WAN connections, such as broadband, LTE, or MPLS. SD-WAN is not a cloud-based service, but a network optimization technology that can improve the performance, reliability, and security of WAN connections. SD-WAN can be used to connect remote sites or users to cloud-based applications, but it does not host the applications itself. Some examples of SD-WAN vendors are Cisco, VMware, and Fortinet.

SDN (Software-Defined Networking) is a network architecture that decouples the control plane from the data plane, and uses a centralized controller to programmatically manage and configure the network devices and traffic flows. SDN is not a cloud-based service, but a network automation technology that can enhance the scalability, flexibility, and efficiency of the network. SDN can be used to create virtual networks or network functions that can support cloud-based applications, but it does not host the applications itself. Some examples of SDN vendors are OpenFlow, OpenDaylight, and OpenStack.

Reference: CompTIA Security+ SY0-701 Certification Study Guide, page 264-265; Professor Messer’s CompTIA SY0-701 Security+ Training Course, video 3.1 – Cloud and Virtualization, 7:40 – 10:00; [Serverless Framework]; [Type 1 Hypervisor]; [SD-WAN]; [SDN].

Question #99

Which of the following would be the best way to handle a critical business application that is running on a legacy server?

A . Segmentation
B . Isolation
C . Hardening
D . Decommissioning

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

A legacy server is a server that is running outdated or unsupported software or hardware, which may pose security risks and compatibility issues. A critical business application is an application that is essential for the operation and continuity of the business, such as accounting, payroll, or inventory management. A legacy server running a critical business application may be difficult to replace or upgrade, but it should not be left unsecured or exposed to potential threats.

One of the best ways to handle a legacy server running a critical business application is to harden it. Hardening is the process of applying security measures and configurations to a system to reduce its attack surface and vulnerability.

Hardening a legacy server may involve steps such as:

Applying patches and updates to the operating system and the application, if available Removing or disabling unnecessary services, features, or accounts

Configuring firewall rules and network access control lists to restrict inbound and outbound traffic Enabling encryption and authentication for data transmission and storage

Implementing logging and monitoring tools to detect and respond to anomalous or malicious activity Performing regular backups and testing of the system and the application

Hardening a legacy server can help protect the critical business application from unauthorized access, modification, or disruption, while maintaining its functionality and availability. However, hardening a legacy server is not a permanent solution, and it may not be sufficient to address all the security issues and challenges posed by the outdated or unsupported system. Therefore, it is advisable to plan for the eventual decommissioning or migration of the legacy server to a more secure and modern platform, as soon as possible.

Reference: CompTIA Security+ SY0-701 Certification Study Guide, Chapter 3: Architecture and Design, Section 3.2: Secure System Design, Page 133 1; CompTIA Security+ Certification Exam Objectives, Domain 3: Architecture and Design, Objective 3.2: Explain the importance of secure system design, Subobjective: Legacy systems 2

Question #100

A Chief Information Security Officer wants to monitor the company’s servers for SQLi attacks and allow for comprehensive investigations if an attack occurs. The company uses SSL decryption to allow traffic monitoring.

Which of the following strategies would best accomplish this goal?

A . Logging all NetFlow traffic into a SIEM
B . Deploying network traffic sensors on the same subnet as the servers
C . Logging endpoint and OS-specific security logs
D . Enabling full packet capture for traffic entering and exiting the servers

Reveal Solution Hide Solution