CompTIA SY0-701 Exam Questions
CompTIA Security+ (Page 4 )

Updated On: 2-May-2026

A company allows customers to upload PDF documents to its public e-commerce website. Which of the following would a security analyst most likely recommend?

  1. Utilizing attack signatures in an IDS
  2. Enabling malware detection through a UTM
  3. Limiting the affected servers with a load balancer
  4. Blocking command injections via a WAF

Answer(s): B

Explanation:

Option B is correct because enabling malware detection through a UTM provides comprehensive protection for file uploads by inspecting content and detecting malicious payloads across the network boundary, which is appropriate for preventing malware in PDFs from reaching internal systems.
A) Incorrect — attack signatures in an IDS detect known threats on the network but do not actively scan uploads for malware at the perimeter with PDF content.
C) Incorrect — a load balancer limits traffic distribution, not malware payload inspection or detection.
D) Incorrect — a WAF blocks web app attacks like SQLi or XSS but there is no explicit focus on detecting malware in uploaded PDFs.



A security analyst developed a script to automate a trivial and repeatable task. Which of the following best describes the benefits of ensuring other team members understand how the script works?

  1. To reduce implementation cost
  2. To identify complexity
  3. To remediate technical debt
  4. To prevent a single point of failure

Answer(s): D

Explanation:

Option D is correct because ensuring others understand the script reduces the risk of a single point of failure: if only one person knows how it works, outages or knowledge loss can halt automation. A) To reduce implementation cost is not directly about sharing knowledge; costs may vary. B) To identify complexity could be a byproduct but the primary benefit here is resilience against reliance on one person. C) To remediate technical debt involves addressing suboptimal code, not primarily collaboration or redundancy. INSUFFICIENT_KNOWLEDGE is not appropriate since the reasoning above is solid.



A company is decommissioning its physical servers and replacing them with an architecture that will reduce the number of individual operating systems. Which of the following strategies should the company use to achieve this security requirement?

  1. Microservices
  2. Containerization
  3. Virtualization
  4. Infrastructure as code

Answer(s): B

Explanation:

Option B is correct because containerization reduces the number of distinct OS instances by packaging applications with their dependencies in isolated containers, improving security through process isolation and easier patching. A) Microservices describe an architectural style, not a OS reduction strategy. C) Virtualization creates multiple VMs with separate OS instances, increasing OS count. D) Infrastructure as code is about managing infrastructure declaratively, not reducing OS instances.



An administrator needs to perform server hardening before deployment. Which of the following steps should the administrator take? (Choose two.)

  1. Disable default accounts.
  2. Add the server to the asset inventory.
  3. Remove unnecessary services.
  4. Document default passwords.
  5. Send server logs to the SIEM.
  6. Join the server to the corporate domain.

Answer(s): A,C

Explanation:

Option A is correct because disabling default accounts reduces attack surface and prevents common credential abuse.
Option C is correct because removing unnecessary services minimizes exposure, reduces potential vulnerabilities, and lowers maintenance risk.
B is incorrect because adding to asset inventory is a best practice but not a hardening action per se; it does not directly reduce attack surface.
D is incorrect because documenting default passwords is insecure; passwords should be changed or securely managed, not documented.
E is incorrect because forwarding logs to a SIEM is logging/monitoring, not a hardening step.
F is incorrect because joining to the domain is a configuration decision, not a core hardening action.



A Chief Information Security Officer would like to conduct frequent, detailed reviews of systems and procedures

to track compliance objectives. Which of the following will be the best method to achieve this objective?

  1. Third-party attestation
  2. Penetration testing
  3. Internal auditing
  4. Vulnerability scans

Answer(s): C

Explanation:

Option C is correct because internal auditing provides ongoing, formal reviews of processes, controls, and compliance objectives within an organization, enabling frequent assessments and independent assurance. A) Third-party attestation can validate controls but is external and not continuous. B) Penetration testing simulates attacks to find exploitable vulnerabilities, not a routine compliance review. D) Vulnerability scans identify known weaknesses but do not assess procedural adherence or control effectiveness across the organization.



Which of the following security concepts is accomplished with the installation of a RADIUS server?

  1. CIA
  2. AAA
  3. ACL
  4. PEM

Answer(s): B

Explanation:

Option B is correct because a RADIUS server provides Authentication, Authorization, and Accounting (AAA) services for centralized access control.
A) CIA is not specifically accomplished by RADIUS; confidentiality, integrity, and availability are broader objectives of security but not uniquely implemented by RADIUS.
C) ACLs are access control lists used on devices to permit/deny traffic, not a RADIUS service.
D) PEM refers to Privacy-Enhanced Mail or a certificate/key container format, not a RADIUS-based AAA solution.



After creating a contract for IT contractors, the human resources department changed several clauses. The contract has gone through three revisions. Which of the following processes should the human resources department follow to track revisions?

  1. Version validation
  2. Version changes
  3. Version updates
  4. Version control

Answer(s): D

Explanation:

Option D is correct because version control tracks changes to documents, preserves history, and supports auditability across revisions, which is essential for contractual documents with multiple revisions. Incorrect — A (version validation) implies checking validity of a version, not tracking changes. Incorrect — B (version changes) describes changes themselves, not the mechanism to manage versions. Incorrect — C (version updates) suggests updating versions but not the formal system that records all revisions and authors.



The executive management team is mandating the company develop a disaster recovery plan. The cost must be kept to a minimum, and the money to fund additional internet connections is not available. Which of the following would be the best option?

  1. Hot site
  2. Cold site
  3. Failover site
  4. Warm site

Answer(s): B

Explanation:

Option B is correct because a cold site provides minimal facility with basic power, cooling, and space but requires the longest time to recover and lowest ongoing costs, aligning with a low-cost DR strategy. A) Hot site is immediately usable with full replication and high cost, not suitable when funds are limited. C) Failover site is not a standard DR site type; it’s a process/ capability term often implying automatic switching, not a facility option. D) Warm site requires more infrastructure and faster failover than cold but higher cost than a cold site, which contradicts the cost constraint.



Viewing page 4 of 102
Viewing questions 25 - 32 out of 804 questions


SY0-701 Exam Discussions & Posts (Share your experience with others)

AI Tutor AI Tutor 👋 I’m here to help!