Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. CompTIA
  5. SY0-701

CompTIA SY0-701 Exam Questions
CompTIA Security+ (Page 2 )

Updated On: 24-Mar-2026
Page 2 of 91
PDF with 757 Questions

A company purchased cyber insurance to address items listed on the risk register.
Which of the following strategies does this represent?

  1. Accept
  2. Transfer
  3. Mitigate
  4. Avoid

Answer(s): B

Explanation:

The correct answer is B: Transfer. Cyber insurance shifts financial risk from the organization to a third party, covering losses identified in the risk register. Accept means risks are acknowledged without action, which isn’t the case here. Mitigate involves reducing the likelihood or impact of a risk through controls, not transferring the cost. Avoid entails changing plans to eliminate risk entirely, which insurance does not accomplish. A cyber insurance policy related to identified risks aligns with risk transfer as a treatment option in risk management. A) Accept: not applicable. C) Mitigate: incorrect. D) Avoid: incorrect.



Which of the following is the most likely to be used to document risks, responsible parties, and thresholds?

  1. Risk tolerance
  2. Risk transfer
  3. Risk register
  4. Risk analysis

Answer(s): C

Explanation:

A risk register is the formal document that records identified risks, owners, thresholds, and mitigation actions. It provides accountability and a centralized view for risk management.
A) Risk tolerance reflects the amount of risk an organization is willing to accept, not a document listing risks and owners.
B) Risk transfer involves shifting risk to terceros (e.g., insurance), not documenting risks or thresholds.
D) Risk analysis is the process of identifying and evaluating risks, not the recording and ownership document.
C) Risk register



HOTSPOT (Drag and Drop is not supported)

You are a security administrator investigating a potential infection on a network.

INSTRUCTIONS

Click on each host and firewall. Review all logs to determine which host originated the infection and then identify if each remaining host is clean or infected.

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.













Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:



A systems administrator notices that the research and development department is not using the company VPN when accessing various company-related services and systems.
Which of the following scenarios describes this activity?

  1. Espionage
  2. Data exfiltration
  3. Nation-state attack
  4. Shadow IT

Answer(s): D

Explanation:

A) Shadow IT activity occurs when employees use unsanctioned tools or networks, such as bypassing the VPN to access services, which is exactly the scenario described.
B) Data exfiltration involves unauthorized transfer of data, typically after access is gained, not the act of using unsanctioned network access tools.
C) Nation-state attack implies a state-backed operation targeting the organization, which is not implied by departmental VPN avoidance.
D) Espionage refers to obtaining confidential information; while related, the term here best captures unauthorized use of non-approved IT resources within the organization.



Which of the following threat vectors is most commonly utilized by insider threat actors attempting data exfiltration?

  1. Unidentified removable devices
  2. Default network device credentials
  3. Spear phishing emails
  4. Impersonation of business units through typosquatting

Answer(s): A

Explanation:

Insider threat data exfiltration most often leverages uncontrolled or unmanaged removable media, enabling covert copying of sensitive data offsite.
A) Unidentified removable devices
B) Default network device credentials
C) Spear phishing emails
D) Impersonation of business units through typosquatting


Reference:



Which of the following agreement types defines the time frame in which a vendor needs to respond?

  1. SOW
  2. SLA
  3. MOA
  4. MOU

Answer(s): B

Explanation:

Acknowledged: The correct answer is B.
B) Defines the expected service level and response times in a vendor relationship, establishing the time frame for incident and request responses as part of an service level agreement (SLA).
A) SOW specifies project scope, deliverables, and timelines, not ongoing response windows.
C) MOA outlines mutual aims for collaboration; it does not set response time requirements.
D) MOU documents intent to cooperate but lacks enforceable performance metrics like specific response times.


Reference:



Which of the following is a feature of a next-generation SIEM system?

  1. Virus signatures
  2. Automated response actions
  3. Security agent deployment
  4. Vulnerability scanning

Answer(s): B

Explanation:

A next-generation SIEM incorporates automated response actions to contain and remediate threats in real time.
A) Virus signatures are traditional AV signatures, not a NG-SIEM feature.
C) Security agent deployment is typical of EDR/agents, not intrinsic to NG-SIEM capabilities.
D) Vulnerability scanning is a separate assessment function, not a core NG-SIEM feature.


Reference:



To improve the security at a data center, a security administrator implements a CCTV system and posts several signs about the possibility of being filmed.
Which of the following best describe these types of controls? (Choose two.)

  1. Preventive
  2. Deterrent
  3. Corrective
  4. Directive
  5. Compensating
  6. Detective

Answer(s): B,F

Explanation:

The correct choices are B and F because CCTV and signage deter potential intruders (deterrent control) and provide evidence of incidents or wrongdoing (detective control). Deterrents discourage activity through the threat of being recorded; detectives identify and document events after they occur.
A) Preventive is about stopping events before they happen, which CCTV/signage alone do not guarantee.
C) Corrective refers to actions taken to restore systems after a security incident, not ongoing deterrence or evidence collection.
D) Directive governs behavior through policy or instruction, not the physical security measure.
E) Compensating provides alternative controls when a primary control fails; not applicable here.
F) Detective is correct for evidence collection and incident identification.


Reference:



Viewing page 2 of 91
Viewing questions 9 - 16 out of 757 questions



Post your Comments and Discuss CompTIA SY0-701 exam dumps with other Community members:

SY0-701 Exam Discussions & Posts

AI Tutor 👋 I’m here to help!