Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. CompTIA
  5. SY0-701

CompTIA SY0-701 Exam Questions
CompTIA Security+ (Page 12 )

Updated On: 27-Apr-2026
Page 12 of 102
PDF with 804 Questions

A security analyst recently read a report about a flaw in several of the organization's printer models that causes credentials to be sent over the network in cleartext, regardless of the encryption settings. Which of the following would be best to use to validate this finding?

  1. Wireshark
  2. netcat
  3. Nessus
  4. Nmap

Answer(s): A

Explanation:

Option A is correct because Wireshark captures and analyzes network traffic, allowing verification of credentials transmitted in cleartext and identification of exposed authentication data across protocols.
B) Incorrect — netcat is a simple read/write tool for raw connections; it does not provide comprehensive traffic capture or protocol analysis to verify credential exposure.
C) Incorrect — Nessus is a vulnerability scanner that identifies known flaws but does not actively analyze live network traffic to confirm credentials sent in cleartext.
D) Incorrect — Nmap probes networks for hosts and services and can detect open ports, but it does not inspect the content of credentials in transit.



A development team is launching a new public-facing web product. The Chief Information Security Officer has asked that the product be protected from attackers who use malformed or invalid inputs to destabilize the system. Which of the following practices should the development team implement?

  1. Fuzzing
  2. Continuous deployment
  3. Static code analysis
  4. Manual peer review

Answer(s): A

Explanation:

Option A is correct because fuzzing tests how the application handles malformed or unexpected inputs, helping to identify input validation weaknesses that attackers could exploit. Incorrect — B (Continuous deployment) focuses on rapid delivery, not vulnerability assessment. Incorrect — C (Static code analysis) analyzes source code for defects but may miss runtime input handling issues; fuzzing complements it by exercising runtime input validation. Incorrect — D (Manual peer review) helps catch logic flaws but is less systematic for input resilience testing compared to automated fuzzing.



During an annual review of the system design, an engineer identified a few issues with the currently released design. Which of the following should be performed next according to best practices?

  1. Risk management process
  2. Product design process
  3. Design review process
  4. Change control process

Answer(s): D

Explanation:

Option D is correct because change control ensures formal approval, documentation, and review of design changes before implementation, aligning with best practices for maintaining security baselines.
A) Incorrect — Risk management process focuses on identifying, assessing, and mitigating risks, not specifically on controlling design changes after issues are found.
B) Incorrect — Product design process governs initial product development, not the procedural control for post-release design modifications.
C) Incorrect — Design review process validates design aspects but is typically part of the design activity, whereas change control manages the authorization and traceability of changes.



Which of the following is best to use when determining the severity of a vulnerability?

  1. CVE
  2. OSINT
  3. SOAR
  4. CVSS

Answer(s): D

Explanation:

Option D is correct because CVSS provides a standardized framework to rate vulnerability severity based on metrics like exploitability and impact, enabling consistent risk assessment across environments.
A) CVE identifies a vulnerability, not its severity rating.
B) OSINT gathers public information, not a standardized severity metric.
C) SOAR automates responses, not severity assessment, though it can ingest CVSS scores.
D) Correct — CVSS is the standardized severity scoring system used for risk prioritization.



An organization experienced a security breach that allowed an attacker to send fraudulent wire transfers from a hardened PC exclusively to the attacker's bank through remote connections. A security analyst is creating a timeline of events and has found a different PC on the network containing malware. Upon reviewing the command history, the analyst finds the following:

PS>.\mimikatz.exe "sekurlsa::pth /user:localadmin /domain:corp-domain.com / ntlm:F327

Which of the following best describes how the attacker gained access to the hardened PC?

  1. The attacker created fileless malware that was hosted by the banking platform.
  2. The attacker performed a pass-the-hash attack using a shared support account.
  3. The attacker utilized living-off-the-land binaries to evade endpoint detection and response software.
  4. The attacker socially engineered the accountant into performing bad transfers.

Answer(s): B

Explanation:

Option B is correct because the command shows Mimikatz being used with sekurlsa::pth (Pass-the-Hash) to impersonate a local administrator account using an NTLM hash to access other systems. This indicates credential reuse via a hashed credential (NTLM) to gain access to the hardened PC and perform unauthorized actions.
A) Incorrect — Fileless malware refers to residing in memory without files; the evidence shows a credential theft technique (pass-the-hash), not fileless execution.
C) Incorrect — Living-off-the-land binaries describe using native tools, but the explicit pass-the-hash usage indicates credential abstraction rather than just native binary abuse.
D) Incorrect — Social engineering is not demonstrated by the command history; it involves user manipulation rather than credential harvesting via Mimikatz.



Which of the following is the best resource to consult for information on the most common application exploitation methods?

  1. OWASP
  2. STIX
  3. OVAL
  4. Threat intelligence feed
  5. Common Vulnerabilities and Exposures

Answer(s): A

Explanation:

Option A is correct because OWASP (Open Web Application Security Project) publishes comprehensive resources on web application security, including common exploitation techniques, top weaknesses (e.g., OWASP Top Ten), and secure development practices.
B) Incorrect — STIX focuses on sharing cyber threat intelligence structure, not specifically exploitation methods.
C) Incorrect — OVAL provides vulnerability definitions and checks but is not the primary source for documented exploitation techniques.
D) Incorrect — Threat intelligence feeds offer indicators of compromise and adversary info but are not the canonical resource detailing common exploitation methods.
E) Incorrect — CVE lists vulnerabilities; while related, it’s not a best-practice reference for common exploitation vectors compared to OWASP.



A security analyst is reviewing the logs on an organization's DNS server and notices the following unusual snippet:



Which of the following attack techniques was most likely used?

  1. Determining the organization's ISP-assigned address space
  2. Bypassing the organization's DNS sinkholing
  3. Footprinting the internal network
  4. Attempting to achieve initial access to the DNS server
  5. Exfiltrating data from fshare.int.complia.org

Answer(s): C

Explanation:

Option C is correct because footprinting the internal network involves gathering information about internal hosts, services, and topology, which DNS logs can reveal through query patterns, zone transfers, or resolve records pointing to internal assets. Incorrect — A: determining ISP-assigned address space is external reconnaissance, not evidenced by typical internal DNS logs. B: bypassing DNS sinkholing relates to anti-malware and DNS manipulation, not footprinting indicators in logs. D: attempting initial access to the DNS server would show auth attempts or exploitation activity, not general footprinting patterns. E: exfiltration from fshare.int.complia.org implies data leakage, which DNS logs alone wouldn’t uniquely indicate.



A security analyst at an organization observed several user logins from outside the organization's network. The analyst determined that these logins were not performed by individuals within the organization. Which of the following recommendations would reduce the likelihood of future attacks? (Choose two.)

  1. Disciplinary actions for users
  2. Conditional access policies
  3. More regular account audits
  4. Implementation of additional authentication factors
  5. Enforcement of content filtering policies
  6. A review of user account permissions

Answer(s): B,D

Explanation:

Option B is correct because conditional access policies limit access based on context (user, device, location, risk), reducing exposure from anomalous outside logins. Option D is correct because additional authentication factors (MFA) provide a second factor, mitigating credential theft or phishing attempts.
A) Incorrect — Disciplinary actions do not prevent unauthorized access and may not address root cause.
C) Incorrect — Regular audits help detect issues but don’t directly prevent external logins.
E) Incorrect — Content filtering mitigates web threats, not authentication or remote access.
F) Incorrect — Reviewing permissions helps least- privilege but doesn’t directly reduce external login likelihood without MFA or access controls.



Viewing page 12 of 102
Viewing questions 89 - 96 out of 804 questions
Share your experience with other


SY0-701 Exam Discussions & Posts

AI Tutor AI Tutor 👋 I’m here to help!