CompTIA SY0-701 Exam Questions
CompTIA Security+ (Page 2 )

Updated On: 10-May-2026

A company purchased cyber insurance to address items listed on the risk register. Which of the following strategies does this represent?

  1. Accept
  2. Transfer
  3. Mitigate
  4. Avoid

Answer(s): B

Explanation:

Option B is correct because transferring risk via cyber insurance shifts financial impact of a threat from the organization to an insurer, aligning with risk transfer strategy. A (Accept) would mean acknowledging the risk without action; not applicable since insurance is a transfer mechanism. C (Mitigate) involves reducing likelihood or impact through controls, not shifting costs. D (Avoid) means not engaging in the activity that creates risk; insurance does not eliminate the risk itself. Therefore, insurance serves as a risk transfer remedy rather than acceptance, mitigation, or avoidance.



Which of the following is the most likely to be used to document risks, responsible parties, and thresholds?

  1. Risk tolerance
  2. Risk transfer
  3. Risk register
  4. Risk analysis

Answer(s): C

Explanation:

Option C is correct because a risk register documents risks, assigns responsible parties, and defines risk thresholds and treatment actions.
A) Incorrect — Risk tolerance describes the organization’s overall appetite for risk, not a ledger of risks or owners.
B) Incorrect — Risk transfer is a treatment option (e.g., insurance) rather than a documentation artifact.
D) Incorrect — Risk analysis assesses likelihood and impact but does not establish ownership or thresholds in a formal register.



HOTSPOT (Drag and Drop is not supported)

You are a security administrator investigating a potential infection on a network.

INSTRUCTIONS

Click on each host and firewall. Review all logs to determine which host originated the infection and then identify if each remaining host is clean or infected.

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.













Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:



A systems administrator notices that the research and development department is not using the company VPN when accessing various company-related services and systems. Which of the following scenarios describes this activity?

  1. Espionage
  2. Data exfiltration
  3. Nation-state attack
  4. Shadow IT

Answer(s): D

Explanation:

Option D is correct because Shadow IT refers to employees using unsanctioned tools or solutions, such as bypassing the VPN, to access services, often without IT oversight. Incorrect — A) Espionage implies covert information gathering by attackers, not internal R&D bypassing VPN. Incorrect — B) Data exfiltration involves unauthorized data transfer, not the act of using unauthorized tools itself. Incorrect — C) Nation-state attack denotes a political or strategic attacker; not applicable to internal department bypass of VPN.



Which of the following threat vectors is most commonly utilized by insider threat actors attempting data exfiltration?

  1. Unidentified removable devices
  2. Default network device credentials
  3. Spear phishing emails
  4. Impersonation of business units through typosquatting

Answer(s): A

Explanation:

Option A is correct because insiders often use removable media or devices to exfiltrate data, leveraging physical access and trusted insider status to copy information off-network.
B is incorrect because default network device credentials are a common hardening issue for attackers externally or due to poor onboarding, not a typical insider-driven exfiltration vector.
C is incorrect because spear phishing targets external adversaries to gain initial access, not primarily an insider exfiltration method.
D is incorrect because typosquatting impersonates brands to deceive external users; it does not reflect a standard insider data exfiltration technique.



Which of the following agreement types defines the time frame in which a vendor needs to respond?

  1. SOW
  2. SLA
  3. MOA
  4. MOU

Answer(s): B

Explanation:

Option B is correct because a Service Level Agreement (SLA) defines performance metrics and response times for vendor services, including incident response and uptime commitments. A) SOW (Statement of Work) outlines scope and deliverables, not response time. C) MOA (Memorandum of Agreement) is a high-level collaboration document, not time frames. D) MOU (Memorandum of Understanding) is a non-binding agreement outlining intent, not specific response windows. Correct — SLA explicitly specifies the required response time and performance levels in a formal contractual metric.



Which of the following is a feature of a next-generation SIEM system?

  1. Virus signatures
  2. Automated response actions
  3. Security agent deployment
  4. Vulnerability scanning

Answer(s): B

Explanation:

Option B is correct because next-generation SIEMs integrate automated response actions (SOAR-like capabilities) to orchestrate containment, remediation, and workflow across tools. A) Virus signatures are legacy antivirus content, not central to NG SIEMs. C) Security agent deployment is a deployment consideration, not a NG SIEM feature. D) Vulnerability scanning is typically a separate function from SIEMs; NG SIEMs focus on detection, correlation, and automated response rather than initial vulnerability assessment.



To improve the security at a data center, a security administrator implements a CCTV system and posts several signs about the possibility of being filmed. Which of the following best describe these types of controls? (Choose two.)

  1. Preventive
  2. Deterrent
  3. Corrective
  4. Directive
  5. Compensating
  6. Detective

Answer(s): B,F

Explanation:

Option B is correct because deterrent controls aim to discourage criminal activity by increasing the likelihood of being observed (CCTV) and signaling monitoring through signs. Option F is correct because detective controls identify and detect security incidents (CCTV footage).
A) Incorrect — Preventive controls aim to prevent incidents from occurring (e.g., access control, locks), not just deter or detect.
C) Incorrect — Corrective controls respond after a breach to restore state, not to deter or detect.
D) Incorrect — Directive controls guide behavior and governance, not detection or deterrence.
E) Incorrect — Compensating controls provide an alternative security measure when a primary control is not feasible, not specifically deterrence/detection.
F) (already cited)



Viewing page 2 of 102
Viewing questions 9 - 16 out of 804 questions


SY0-701 Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!