CompTIA SY0-701 Exam Questions
CompTIA Security+ (Page 10 )

Updated On: 27-Apr-2026

A security administrator is working to find a cost-effective solution to implement certificates for a large number of domains and subdomains owned by the company. Which of the following types of certificates should the administrator implement?

  1. Wildcard
  2. Client certificate
  3. Self-signed
  4. Code signing

Answer(s): A

Explanation:

Option A is correct because a wildcard certificate covers multiple subdomains under a single domain (e.g., *.example.com), reducing cost and management effort for many domains/subdomains. B is incorrect because client certificates authenticate users/devices, not domain protection. C is incorrect because self-signed certificates are not trusted by default and don’t scale well for large deployments. D is incorrect because code signing certificates validate software integrity, not web domain/subdomain TLS authentication.



An auditor discovered multiple insecure ports on some servers. Other servers were found to have legacy protocols enabled. Which of the following tools did the auditor use to discover these issues?

  1. Nessus
  2. curl
  3. Wireshark
  4. netcat

Answer(s): A

Explanation:

Option A is correct because Nessus is a vulnerability scanner used to identify insecure ports and misconfigurations, including legacy protocols, across hosts. Option B is incorrect since curl is a transfer tool for HTTP/S requests, not a port or protocol audit tool. Option C is incorrect because Wireshark captures network traffic for analysis but does not systematically discover insecure ports or legacy protocols across multiple servers. Option D is incorrect as netcat is a network utility for manual connections and data transfer, not a full asset/port-scanning vulnerability assessment.



A security analyst received a tip that sensitive proprietary information was leaked to the public. The analyst is reviewing the PCAP and notices traffic between an internal server and an external host that includes the following:

...
12:47:22.327233 PPPoE [ses 0x8122] IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto IPv6 (41), length 331) 10.5.1.1 > 52.165.16.154: IP6 (hlim E3, next- header TCP (6) paylcad length: 271) 2001:67c:2158:a019::ace.53104 > 2001:0:5ef5:79fd:380c:dddd:a601:24fa.13788: Flags [P.], cksum 0xd7ee (correct), seq 97:348, ack 102, win 16444, length 251
...

Which of the following was most likely used to exfiltrate the data?

  1. Encapsulation
  2. MAC address spoofing
  3. Steganography
  4. Broken encryption
  5. Sniffing via on-path position

Answer(s): A

Explanation:

Option A is correct because encapsulation over PPPoE with IPv6/TCP payload suggests tunneling data via a protocol wrapper, enabling covert exfiltration within legitimate traffic. Incorrect –
B: MAC spoofing operates at Layer 2, not indicated by the observed IPv6/TCP payload exfiltration pattern.
C: Steganography hides data within non-obvious media; the dump shows network protocol headers, not embedded payload steganography.
D: Broken encryption implies ciphertext leakage, but the trace shows standard TCP payload without clues of attempted decryption or weak cipher.
E: Sniffing via on-path position requires attacker placement; the data flow is outbound to an external host, not evidence of passive interception.



A company wants to reduce the time and expense associated with code deployment. Which of the following technologies should the company utilize?

  1. Serverless architecture
  2. Thin clients
  3. Private cloud
  4. Virtual machines

Answer(s): A

Explanation:

Option A is correct because serverless architecture reduces deployment time and operational costs by removing server provisioning and management, enabling faster code deployment and automatic scaling.
B) Incorrect — Thin clients are end-user devices with minimal processing; they do not directly reduce deployment time or costs for code deployment.
C) Incorrect — Private cloud focuses on ownership and control of infrastructure but does not inherently speed up deployment processes compared to serverless.
D) Incorrect — Virtual machines involve provisioning and managing runtime environments, which can increase deployment time and maintenance costs versus serverless.



A security administrator is performing an audit on a stand-alone UNIX server, and the following message is immediately displayed:

(Error 13): /etc/shadow: Permission denied.

Which of the following best describes the type of tool that is being used?

  1. Pass-the-hash monitor
  2. File integrity monitor
  3. Forensic analysis
  4. Password cracker

Answer(s): D

Explanation:

Option D is correct because a password cracker attempts to read /etc/shadow to crack password hashes, and “Permission denied” on /etc/shadow indicates restricted access typical of password-cracking activities on UNIX. A) Pass-the-hash monitor is used to reuse captured hashes for authentication, not to access /etc/shadow directly. B) File integrity monitor checks for unauthorized changes to files, not for attempting password cracking. C) Forensic analysis is broad but does not specifically imply active credential cracking; it’s an investigative, not a live cracking tool. Correct — D. Incorrect — A, B, C.



A security administrator needs to create firewall rules for the following protocols: RTP, SIP, H.323. and SRTP.
Which of the following does this rule set support?

  1. RTOS
  2. VoIP
  3. SoC
  4. HVAC

Answer(s): B

Explanation:

Option B is correct because RTP, SIP, H.323, and SRTP are protocols commonly used in Voice over IP (VoIP) communications; firewall rules targeting these protocols support VoIP traffic. Incorrect — A (RTOS) refers to real-time operating systems, not related to these network protocols. Incorrect — C (SoC) stands for System on Chip, unrelated to protocol filtering. Incorrect — D (HVAC) is heating, ventilation, and air conditioning infrastructure and not a networking protocol family.



Which of the following best describes a social engineering attack that uses a targeted electronic messaging campaign aimed at a Chief Executive Officer?

  1. Whaling
  2. Spear phishing
  3. Impersonation
  4. Identity fraud

Answer(s): A

Explanation:

Option A is correct because whaling specifically targets high-profile individuals like a Chief Executive Officer using tailored electronic messaging to steal credentials or information.
A) Correct — Whaling is a targeted phishing (social engineering) aimed at executives.
B) Incorrect — Spear phishing is targeted at individuals or roles but not necessarily the CEO; whaling is the CEO-specific subset.
C) Incorrect — Impersonation involves pretending to be someone else but not necessarily the messaging campaign aimed at a CEO.
D) Incorrect — Identity fraud involves stealing someone's identity generally, not the targeted executive phishing campaign.



During a penetration test, a flaw in the internal PKI was exploited to gain domain administrator rights using specially crafted certificates. Which of the following remediation tasks should be completed as part of the cleanup phase?

  1. Updating the CRL
  2. Patching the CA
  3. Changing passwords
  4. Implementing SOAR

Answer(s): B

Explanation:

Option B is correct because patching the CA addresses internal PKI vulnerabilities exploited by forged certificates, removing trust issues and preventing repeat compromises. A) Updating the CRL alone may help revoke certificates but does not fix underlying CA weaknesses exploited. C) Changing passwords is a general control, not addressing PKI/domain admin compromise via certificates. D) Implementing SOAR relates to incident response automation but does not remediate CA core weaknesses. Therefore patching the CA mitigates the root cause of the PKI exploit and hardens PKI trust infrastructure.



Viewing page 10 of 102
Viewing questions 73 - 80 out of 804 questions


SY0-701 Exam Discussions & Posts

AI Tutor AI Tutor 👋 I’m here to help!