Free CompTIA SY0-701 Practice Exams - Page 13 of 19

Question #121

Which of the following alert types is the most likely to be ignored over time?

A . True positive
B . True negative
C . False positive
D . False negative

Question #122

Which of the following factors are the most important to address when formulating a training curriculum plan for a security awareness program? (Select two).

A . Channels by which the organization communicates with customers
B . The reporting mechanisms for ethics violations
C . Threat vectors based on the industry in which the organization operates
D . Secure software development training for all personnel
E . Cadence and duration of training events
F . Retraining requirements for individuals who fail phishing simulations

Reveal Solution Hide Solution

Question #123

Which of the following methods would most likely be used to identify legacy systems?

A . Bug bounty program
B . Vulnerability scan
C . Package monitoring
D . Dynamic analysis

Reveal Solution Hide Solution

Question #124

An administrator notices that several users are logging in from suspicious IP addresses. After speaking with the users, the administrator determines that the employees were not logging in from those IP addresses and resets the affected users’ passwords.

Which of the following should the administrator implement to prevent this type of attack from succeeding in the future?

A . Multifactor authentication
B . Permissions assignment
C . Access management
D . Password complexity

Reveal Solution Hide Solution

Question #125

A company needs to provide administrative access to internal resources while minimizing the traffic allowed through the security boundary.

Which of the following methods is most secure?

A . Implementing a bastion host
B . Deploying a perimeter network
C . Installing a WAF
D . Utilizing single sign-on

Reveal Solution Hide Solution

Correct Answer: A
A

Explanation:

A bastion host is a special-purpose server that is designed to withstand attacks and provide secure access to internal resources. A bastion host is usually placed on the edge of a network, acting as a gateway or proxy to the internal network. A bastion host can be configured to allow only certain types of traffic, such as SSH or HTTP, and block all other traffic. A bastion host can also run security software such as firewalls, intrusion detection systems, and antivirus programs to monitor and filter incoming and outgoing traffic. A bastion host can provide administrative access to internal resources by requiring strong authentication and encryption, and by logging all activities for auditing purposes12.

A bastion host is the most secure method among the given options because it minimizes the traffic allowed through the security boundary and provides a single point of control and defense. A bastion host can also isolate the internal network from direct exposure to the internet or other untrusted networks, reducing the attack surface and the risk of compromise3.

Deploying a perimeter network is not the correct answer, because a perimeter network is a network segment that separates the internal network from the external network. A perimeter network usually hosts public-facing services such as web servers, email servers, or DNS servers that need to be accessible from the internet. A perimeter network does not provide administrative access to internal resources, but rather protects them from unauthorized access. A perimeter network can also increase the complexity and cost of network management and security4.

Installing a WAF is not the correct answer, because a WAF is a security tool that protects web applications from common web-based attacks by monitoring, filtering, and blocking HTTP traffic. A WAF can prevent attacks such as cross-site scripting, SQL injection, or file inclusion, among others. A WAF does not provide administrative access to internal resources, but rather protects them from web application vulnerabilities. A WAF is also not a comprehensive solution for network security, as it only operates at the application layer and does not protect against other types of attacks or threats5.

Utilizing single sign-on is not the correct answer, because single sign-on is a method of authentication that allows users to access multiple sites, services, or applications with one username and password. Single sign-on can simplify the sign-in process for users and reduce the number of passwords they have to remember and manage. Single sign-on does not provide administrative access to internal resources, but rather enables access to various resources that the user is authorized to use. Single sign-on can also introduce security risks if the user’s credentials are compromised or if the single sign-on provider is breached6. Reference 1: Bastion host – Wikipedia, 2: 14 Best Practices to Secure SSH Bastion Host – goteleport.com, 3: The Importance Of Bastion Hosts In Network Security, 4: What is the network perimeter? | Cloudflare, 5: What is a WAF? | Web Application Firewall explained, 6: [What is single sign-on (SSO)? – Definition from WhatIs.com]

Question #126

An organization’s internet-facing website was compromised when an attacker exploited a buffer overflow.

Which of the following should the organization deploy to best protect against similar attacks in the future?

A . NGFW
B . WAF
C . TLS
D . SD-WAN

Reveal Solution Hide Solution

Question #127

Which of the following is the final step of the modem response process?

A . Lessons learned
B . Eradication
C . Containment
D . Recovery

Reveal Solution Hide Solution

Question #128

A security administrator would like to protect data on employees’ laptops.

Which of the following encryption techniques should the security administrator use?

A . Partition
B . Asymmetric
C . Full disk
D . Database

Reveal Solution Hide Solution

Correct Answer: C
C

Explanation:

Full disk encryption (FDE) is a technique that encrypts all the data on a hard drive, including the operating system, applications, and files. FDE protects the data from unauthorized access in case the laptop is lost, stolen, or disposed of without proper sanitization. FDE requires the user to enter a password, a PIN, a smart card, or a biometric factor to unlock the drive and boot the system. FDE can be implemented by using software solutions, such as BitLocker, FileVault, or VeraCrypt, or by using hardware solutions, such as self-encrypting drives (SEDs) or Trusted Platform Modules (TPMs). FDE is a recommended encryption technique for laptops and other mobile devices that store sensitive data. Partition encryption is a technique that encrypts only a specific partition or volume on a hard drive, leaving the rest of the drive unencrypted. Partition encryption is less secure than FDE, as it does not protect the entire drive and may leave traces of data on unencrypted areas. Partition encryption is also less convenient than FDE, as it requires the user to mount and unmount the encrypted partition manually.

Asymmetric encryption is a technique that uses a pair of keys, one public and one private, to encrypt and decrypt data. Asymmetric encryption is mainly used for securing communication, such as email, web, or VPN, rather than for encrypting data at rest. Asymmetric encryption is also slower and more computationally intensive than symmetric encryption, which is the type of encryption used by FDE and partition encryption.

Database encryption is a technique that encrypts data stored in a database, such as tables, columns, rows, or cells. Database encryption can be done at the application level, the database level, or the file system level. Database encryption is useful for protecting data from unauthorized access by database administrators, hackers, or malware, but it does not protect the data from physical theft or loss of the device that hosts the database.

Reference: Data Encryption C CompTIA Security+ SY0-401: 4.4, CompTIA Security+ Cheat Sheet and PDF | Zero To Mastery, CompTIA Security+ SY0-601 Certification Course – Cybr, Application Hardening C SY0-601 CompTIA Security+: 3.2.

Question #129

A spoofed identity was detected for a digital certificate.

Which of the following are the type of unidentified key and the certificate mat could be in use on the company domain?

A . Private key and root certificate
B . Public key and expired certificate
C . Private key and self-signed certificate
D . Public key and wildcard certificate

Reveal Solution Hide Solution

Question #130

Which of the following is a common source of unintentional corporate credential leakage in cloud environments?

A . Code repositories
B . Dark web
C . Threat feeds
D . State actors
E . Vulnerability databases

Reveal Solution Hide Solution