CompTIA SY0-701 Exam Questions
CompTIA Security+ (Page 11 )

Updated On: 27-Apr-2026

A company wants to implement MFA. Which of the following enables the additional factor while using a smart card?

  1. PIN
  2. Hardware token
  3. User ID
  4. SMS

Answer(s): A

Explanation:

Option A is correct because pairing a smart card with a PIN provides multi-factor authentication: something you have (smart card) and something you know (PIN). Incorrect — B hardware token: while a separate token can be second factor, the question specifies using a smart card, and a token typically is a standalone device, not integrated with the card. Incorrect — C User ID: not a factor; it is an identifier, not an authentication factor. Incorrect — D SMS: delivers a one-time code via phone, not involving the smart card as the possession factor.



A company hired an external consultant to assist with required system upgrades to a critical business application. A systems administrator needs to secure the consultant's access without sharing passwords to critical systems. Which of the following solutions should most likely be utilized?

  1. TACACS+
  2. SAML
  3. An SSO platform
  4. Role-based access control
  5. PAM software

Answer(s): E

Explanation:

Option E) correct — PAM (Pluggable Authentication Module) software enables centralized, password-based or token-based authentication management for external consultants without sharing passwords, and supports credential vaults and session controls. It helps enforce least privilege and audit access.
A) Incorrect — TACACS+ is for device administration authentication but not specifically about secure consultant access without sharing credentials.
B) Incorrect — SAML is for federated SSO authentication tokens, not direct privilege management for temporary consultant access.
C) Incorrect — An SSO platform provides single sign-on, not granular, temporary access controls or credential separation for consultants.
D) Incorrect — RBAC defines permissions but does not address secure authentication and credential management for outsiders.



A newly implemented wireless network is designed so that visitors can connect to the wireless network for business activities. The legal department is concerned that visitors might connect to the network and perform illicit activities. Which of me following should the security team implement to address this concern?

  1. Configure a RADIUS server to manage device authentication.
  2. Use 802.1X on all devices connecting to wireless.
  3. Add a guest captive portal requiring visitors to accept terms and conditions.
  4. Allow for new devices to be connected via WPS.

Answer(s): C

Explanation:

Option C is correct because a guest captive portal enforces terms and conditions, allowing policy enforcement, monitoring, and legal defensibility for visitor activity on the network. A captive portal can require consent and provide usage restrictions, reducing illicit activity risk.
A) Incorrect — RADIUS manages device authentication and centralized authorization, but does not explicitly address user behavior enforcement or terms/conditions for visitors.
B) Incorrect — 802.1X authenticates devices but is more about access control than enforceable user terms and policy.
D) Incorrect — WPS is insecure and not related to visitor policy or legal compliance; it does not enforce usage terms.



Which of the following data roles is responsible for identifying risks and appropriate access to data?

  1. Owner
  2. Custodian
  3. Steward
  4. Controller

Answer(s): A

Explanation:

Option A is correct because an data owner is responsible for identifying data risks and defining who has access to that data, aligning with data governance and access control responsibilities. Incorrect — B: Custodian handles data storage and protection controls but not ownership of risk decisions. Incorrect — C: Steward focuses on ongoing data quality and metadata management, not risk ownership or access authorization. Incorrect — D: Controller is not a standard dataRole in this context; governance typically uses owner, steward, custodian, and sometimes user access roles, making it not the correct term here.



Which of the following physical controls can be used to both detect and deter? (Choose two.)

  1. Lighting
  2. Fencing
  3. Signage
  4. Sensor
  5. Bollard
  6. Lock

Answer(s): A,D

Explanation:

Option A is correct because lighting serves as a deterrent by increasing visibility and a detector by revealing intruders in well-lit areas. Option D is correct because sensors detect unauthorized access or activity, contributing to deterrence via warning or notification. Incorrect — B) Fencing can deter but is not a detector. Incorrect — C) Signage deters by warning but does not detect. Incorrect — E) Bollard provides physical deterrence but not detection. Incorrect — F) Lock deters access but does not detect activity; some might argue alarms, but locks alone aren’t detectors.



A multinational bank hosts several servers in its data center. These servers run a business-critical application used by customers to access their account information. Which of the following should the bank use to ensure accessibility during peak usage times?

  1. Load balancer
  2. Cloud backups
  3. Geographic dispersal
  4. Disk multipathing

Answer(s): A

Explanation:

Option A is correct because a load balancer distributes client requests across multiple servers, improving availability and performance during peak usage by preventing any single server from becoming a bottleneck. Incorrect — B: Cloud backups protect data loss, not active availability during peak load. Incorrect — C: Geographic dispersal enhances disaster recovery and latency for some users but does not inherently balance load across servers. Incorrect — D: Disk multipathing provides redundant I/O paths for storage devices but does not address application layer load distribution across servers.



The author of a software package is concerned about bad actors repackaging and inserting malware into the software. The software download is hosted on a website, and the author exclusively controls the website's contents. Which of the following techniques would best ensure the software's integrity?

  1. Input validation
  2. Code signing
  3. Secure cookies
  4. Fuzzing

Answer(s): B

Explanation:

Option B is correct because code signing provides integrity verification of the software package, enabling users to detect tampering or repackaging by validating the publisher’s digital signature. A) Input validation protects against invalid data in applications, not software integrity. C) Secure cookies protect session data, not code integrity. D) Fuzzing is a testing technique to find vulnerabilities, not a method for ensuring integrity post-release. Correct — code signing ensures authenticity and integrity of the downloadable package, preventing malicious alterations. Incorrect — A, C, and D do not verify or guarantee the integrity of the distributed software.



A third-party vendor is moving a particular application to the end-of-life stage at the end of the current year. Which of the following is the most critical risk if the company chooses to continue running the application?

  1. Lack of security updates
  2. Lack of new features
  3. Lack of support
  4. Lack of source code access

Answer(s): A

Explanation:

Option A is correct because continuing to run an end-of-life application eliminates ongoing security updates and patches, increasing vulnerability exposure and risk of exploitation.
B) Incorrect — While missing new features may be a concern, the critical risk in EOL software is security and patching, not feature parity.
C) Incorrect — Lack of official vendor support is a concern, but the more immediate risk is unpatched vulnerabilities that remain exploitable.
D) Incorrect — Source code access is not typically the primary risk of running EOL software; exposure remains tied to unpatched weaknesses rather than access to code.



Viewing page 11 of 102
Viewing questions 81 - 88 out of 804 questions


SY0-701 Exam Discussions & Posts

AI Tutor AI Tutor 👋 I’m here to help!