CompTIA SY0-701 Exam Questions
CompTIA Security+ (Page 26 )

Updated On: 27-Apr-2026

Which of the following is most likely to be used as a just-in-time reference document within a security operations center?

  1. Change management policy
  2. Risk profile
  3. Playbook
  4. SIEM profile

Answer(s): C

Explanation:

A playbook provides step-by-step procedures for responding to specific types of security incidents, making it an essential just-in-time reference during active incidents. SOC analysts rely on playbooks to quickly access instructions and guidance for consistent and effective response actions.



A security engineer configured a remote access VPN. The remote access VPN allows end users to connect to the network by using an agent that is installed on the endpoint, which establishes an encrypted tunnel. Which of the following protocols did the engineer most likely implement?

  1. GRE
  2. IPSec
  3. SD-WAN
  4. EAP

Answer(s): B

Explanation:

IPSec is commonly used in remote access VPNs to establish secure, encrypted tunnels between the endpoint and the network. This ensures that data transmitted over the VPN is protected from interception, providing confidentiality, integrity, and authentication. IPSec is a widely used protocol for secure remote access VPNs.



Executives at a company are concerned about employees accessing systems and information about sensitive company projects unrelated to the employees' normal job duties. Which of the following enterprise security capabilities will the security team most likely deploy to detect that activity?

  1. UBA
  2. EDR
  3. NAC
  4. DLP

Answer(s): A

Explanation:

UBA helps detect unusual or unauthorized access patterns by analyzing user behavior and identifying deviations from typical access patterns. It can alert the security team when employees attempt to access systems or data unrelated to their job duties, which addresses the executives' concern about potential insider threats or policy violations related to sensitive projects.



Several customers want an organization to verify its security controls are operating effectively and have requested an independent opinion. Which of the following is the most efficient way to address these requests?

  1. Hire a vendor to perform a penetration test
  2. Perform an annual self-assessment.
  3. Allow each client the right to audit
  4. Provide a third-party attestation report

Answer(s): D

Explanation:

A third-party attestation report, such as a SOC 2 report, is an independent assessment of the organization's security controls conducted by an external auditor. This report provides clients with the assurance they need without requiring each client to conduct their own audit or the organization to perform separate assessments, making it both efficient and credible.



A university employee logged on to the academic server and attempted to guess the system administrators' log-in credentials. Which of the following security measures should the university have implemented to detect the employee's attempts to gain access to the administrators' accounts?

  1. Two-factor authentication
  2. Firewall
  3. Intrusion prevention system
  4. User activity logs

Answer(s): D

Explanation:

User activity logs record user actions, including failed login attempts, account access patterns, and unusual
behaviors. By reviewing these logs, security teams can detect unauthorized access attempts, such as an employee attempting to guess administrator credentials.



Which of the following consequences would a retail chain most likely face from customers in the event the retailer is non-compliant with PCI DSS?

  1. Contractual impacts
  2. Sanctions
  3. Fines
  4. Reputational damage

Answer(s): D

Explanation:

While fines, sanctions, and contractual impacts are possible outcomes from regulatory bodies or payment processors, reputational damage is the primary consequence directly impacting customers. If customers learn that the retailer failed to protect their payment information, their trust in the brand may erode, potentially leading to a loss of business and harm to the retailer's reputation.



A security analyst is reviewing logs and discovers the following:



Which of the following should be used to best mitigate this type of attack?

  1. Input sanitization
  2. Secure cookies
  3. Static code analysis
  4. Sandboxing

Answer(s): A

Explanation:

Input sanitization ensures that any user-supplied data is properly filtered and cleaned before being processed by the application. By sanitizing inputs, the system can prevent malicious command injection attempts like the one shown in the log entry.



An administrator is installing an SSL certificate on a new system. During testing, errors indicate that the certificate is not trusted. The administrator has verified with the issuing CA and has validated the private key. Which of the following should the administrator check for next?

  1. If the wildcard certificate is configured
  2. If the certificate signing request is valid
  3. If the root certificate is installed
  4. If the public key is configured

Answer(s): C

Explanation:

If the certificate is not trusted, it's often because the root certificate (or intermediate certificate) from the issuing Certificate Authority (CA) is not installed or not recognized by the system. The root certificate verifies the chain of trust, and without it, the SSL certificate may not be trusted by the system or browser. Installing the root and any necessary intermediate certificates should resolve the trust issue.



Viewing page 26 of 102
Viewing questions 126 - 130 out of 804 questions


SY0-701 Exam Discussions & Posts

AI Tutor AI Tutor 👋 I’m here to help!