CompTIA SY0-701 Exam Questions
CompTIA Security+ (Page 5 )

Updated On: 27-Apr-2026

An administrator at a small business notices an increase in support calls from employees who receive a blocked page message after trying to navigate to a spoofed website. Which of the following should the administrator do?

  1. Deploy multifactor authentication.
  2. Decrease the level of the web filter settings.
  3. Implement security awareness training.
  4. Update the acceptable use policy.

Answer(s): C

Explanation:

Option C is correct because security awareness training helps users recognize phishing and spoofed websites, reducing clicks on malicious content and supporting safer browsing practices.
A) Incorrect — Multifactor authentication protects access to accounts but does not prevent users from visiting or recognizing spoofed sites or reduce the initial exposure from unsafe links.
B) Incorrect — Decreasing web filter settings would weaken defenses and likely increase exposure to malicious sites, not address the root cause of user susceptibility.
D) Incorrect — Updating the acceptable use policy informs behavior but does not directly improve users’ ability to identify or avoid spoofed websites; training is more effective.



Which of the following teams is best suited to determine whether a company has systems that can be exploited by a potential, identified vulnerability?

  1. Purple team
  2. Blue team
  3. Red team
  4. White team

Answer(s): C

Explanation:

Option C is correct because a red team emulates real-world attackers to identify exploitable vulnerabilities and assess impact, confirming whether systems can be compromised. A) Incorrect — Purple teams facilitate collaboration between blue (defense) and red (offense) teams, but do not primarily determine exploitation capabilities alone. B) Incorrect — Blue team focuses on defense, monitoring, and incident response, not offensive exploitation validation. D) Incorrect — White team typically oversees and evaluates events or exercises, not actively performing exploitation testing.



A company is reviewing options to enforce user logins after several account takeovers. The following conditions must be met as part of the solution:

Allow employees to work remotely or from assigned offices around the world.
Provide a seamless login experience.
Limit the amount of equipment required.
Which of the following best meets these conditions?

  1. Trusted devices
  2. Geotagging
  3. Smart cards
  4. Time-based logins

Answer(s): A

Explanation:

Option A is correct because Trusted devices enables seamless, certificate- or policy-based authentication tied to corporate devices, supporting remote and global work with minimal user friction and reduced need for additional equipment. Incorrect – B: Geotagging is metadata-based and not a robust auth method; it’s not a login mechanism and can be spoofed. C: Smart cards require physical card presence and readers, increasing hardware footprint and login steps, contrary to “limit equipment” and seamless access. D: Time-based logins rely on time constraints, not user/device context, and do not address remote/office access or reduce hardware requirements.



Which of the following methods can be used to detect attackers who have successfully infiltrated a network? (Choose two.)

  1. Tokenization
  2. CI/CD
  3. Honeypots
  4. Threat modeling
  5. DNS sinkhole
  6. Data obfuscation

Answer(s): C,E

Explanation:

Option C is correct because honeypots lure and attract attackers, allowing detection of unauthorized activity and analysis of attacker behavior within a controlled environment. Option E is correct because a DNS sinkhole redirects or blocks malicious domain requests, enabling detection of compromised hosts communicating with command-and-control or other malicious infrastructure.
A) Tokenization — Incorrect: replaces sensitive data with tokens for data at rest/in transit, not for attacker detection.
B) CI/CD — Incorrect: relates to software delivery pipelines, not intrusion detection.
D) Threat modeling — Incorrect: proactive risk assessment; helps design defenses but not real-time attacker detection.
F) Data obfuscation — Incorrect: hides data content; does not detect infiltrators.



A company wants to ensure that the software it develops will not be tampered with after the final version is completed. Which of the following should the company most likely use?

  1. Hashing
  2. Encryption
  3. Baselines
  4. Tokenization

Answer(s): A

Explanation:

Option A is correct because hashing provides integrity verification to detect tampering by producing a fixed-size digest that changes if the final build is altered. Incorrect — B: Encryption protects confidentiality, not integrity. Incorrect — C: Baselines define standard configurations for comparison, not tamper-evidence after release. Incorrect — D: Tokenization replaces data with tokens for confidentiality, not ensuring software integrity.



An organization completed a project to deploy SSO across all business applications last year. Recently, the finance department selected a new cloud-based accounting software vendor. Which of the following should most likely be configured during the new software deployment?

  1. RADIUS
  2. SAML
  3. EAP
  4. OpenID

Answer(s): B

Explanation:

Option B is correct because SAML is a common SSO federation protocol used to authenticate users across cloud-based apps, aligning with the existing SSO deployment. A) RADIUS is for network access authentication, not for web SSO with cloud apps. C) EAP is an authentication framework for network access, not for single sign-on to SaaS. D) OpenID is another SSO protocol, but the question specifies the previously deployed SSO (likely SAML-based), so B fits the established federation approach.



A user, who is waiting for a flight at an airport, logs in to the airline website using the public Wi-Fi, ignores a security warning and purchases an upgraded seat. When the flight lands, the user finds unauthorized credit card charges. Which of the following attacks most likely occurred?

  1. Replay attack
  2. Memory leak
  3. Buffer overflow attack
  4. On-path attack

Answer(s): D

Explanation:

Option D is correct because an on-path attack (a form of man-in-the-middle) occurs when an attacker intercepts or alters communications between the user and the service, enabling credential capture and fraudulent charges after the session, especially on insecure public Wi-Fi. Replay attack (A) involves resending captured messages to repeat actions, not necessarily credentials theft during a single session. Memory leak (B) and Buffer overflow (C) are software vulnerabilities causing stability or crashes, not credential theft via network interception. Incorrect — A describes repeated messages, not live tampering; Incorrect — B and C describe flaws in code, not interception of a session. Incorrect — A, B, C do not fit the scenario of on-path credential capture and unauthorized charges.



A network engineer deployed a redundant switch stack to increase system availability. However, the budget can only cover the cost of one ISP connection. Which of the following best describes the potential risk factor?

  1. The equipment MTBF is unknown.
  2. The ISP has no SLA.
  3. An RPO has not been determined.
  4. There is a single point of failure.

Answer(s): D

Explanation:

Option D is correct because a single ISP connection creates a single point of failure in an otherwise redundant switch stack, meaning if the ISP link fails, uptime is impacted despite local redundancy.
A) Incorrect — MTBF of equipment being unknown does not describe external connectivity vulnerability; it concerns hardware reliability, not network path redundancy.
B) Incorrect — An SLA status from the ISP isn’t specified; the risk here is the lack of redundancy, not contract terms.
C) Incorrect — RPO relates to disaster recovery data loss tolerance, not the network path redundancy or link availability.



Viewing page 5 of 102
Viewing questions 33 - 40 out of 804 questions


SY0-701 Exam Discussions & Posts

AI Tutor AI Tutor 👋 I’m here to help!