Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. CompTIA
  5. SY0-701

CompTIA SY0-701 Exam Questions
CompTIA Security+ (Page 5 )

Updated On: 31-Mar-2026
Page 5 of 91
PDF with 757 Questions

An administrator at a small business notices an increase in support calls from employees who receive a blocked page message after trying to navigate to a spoofed website.
Which of the following should the administrator do?

  1. Deploy multifactor authentication.
  2. Decrease the level of the web filter settings.
  3. Implement security awareness training.
  4. Update the acceptable use policy.

Answer(s): C

Explanation:

Safeguards that address user behavior reduce phishing and access to malicious sites. Implementing security awareness training (C) educates users to recognize spoofed sites, report incidents, and follow safe browsing practices, lowering risk and helpdesk calls. A) Deploy multifactor authentication helps with credential theft but doesn’t directly reduce exposure to spoofed sites or user-reported blocks. B) Decreasing web filter settings would increase risk and potentially allow more malicious content. D) Updating the acceptable use policy may help governance but does not train users to recognize or avoid spoofed sites; it’s less immediate in reducing calls. C) is the appropriate control.


Reference:



Which of the following teams is best suited to determine whether a company has systems that can be exploited by a potential, identified vulnerability?

  1. Purple team
  2. Blue team
  3. Red team
  4. White team

Answer(s): C

Explanation:

A detailed ethical hacking perspective: Red team simulates real-world attackers to determine exploitable systems and verify the presence of vulnerabilities from an attacker's view.
A) Purple team: coordinates red and blue efforts but does not primarily perform exploitation to prove exploitable vulnerabilities.
B) Blue team: defends and mitigates; detects and responds to incidents, not primarily exploitative assessment.
C) Red team: conducts controlled attacks to identify exploitable systems and validate security controls from an attacker’s perspective.
D) White team: oversight or governance role; not involved in active exploitation.


Reference:



A company is reviewing options to enforce user logins after several account takeovers. The following conditions must be met as part of the solution:

Allow employees to work remotely or from assigned offices around the world.

Provide a seamless login experience.

Limit the amount of equipment required.

Which of the following best meets these conditions?

  1. Trusted devices
  2. Geotagging
  3. Smart cards
  4. Time-based logins

Answer(s): A

Explanation:

A) Enables zero-trust style validation without relying on physical tokens; supports remote/off-site workers and seamless access with device posture and identity checks, reducing login friction while enforcing authentication after takedowns.
B) Geotagging relies on location data, but not robustly on login authentication and can be spoofed; it also doesn’t inherently enforce authentication post-takeover.
C) Smart cards provide strong authentication but require physical tokens and readers, increasing equipment and management needs, reducing seamlessness and scalability for global remote workers.
D) Time-based logins introduce temporal constraints but don’t address device posture or seamless access, and can hinder legitimate remote access.


Reference:



Which of the following methods can be used to detect attackers who have successfully infiltrated a network? (Choose two.)

  1. Tokenization
  2. CI/CD
  3. Honeypots
  4. Threat modeling
  5. DNS sinkhole
  6. Data obfuscation

Answer(s): C,E

Explanation:

A network defense goal is to detect intruders; honeypots and DNS sinkholes facilitate detection of compromised or malicious activity.
A) Tokenization - not used for detecting intruders; data substitution for protection, not monitoring.
B) CI/CD - software delivery practice; not a detection mechanism for intrusions.
C) Honeypots - decoy systems to attract attackers and alert on unauthorized access; suitable for detection.
D) Threat modeling - proactive risk assessment; not active detection of an ongoing intrusion.
E) DNS sinkhole - redirects or logs malicious domain requests, enabling detection of compromised hosts.
F) Data obfuscation - protects data; does not detect intruders.


Reference:



A company wants to ensure that the software it develops will not be tampered with after the final version is completed.
Which of the following should the company most likely use?

  1. Hashing
  2. Encryption
  3. Baselines
  4. Tokenization

Answer(s): A

Explanation:

A) Hashing is correct because it creates a unique digest of the final software version, enabling tamper detection; any modification changes the hash.
B) Encryption protects data confidentiality, not tamper detection of code integrity.
C) Baselines describe standard configurations to detect deviations, but do not provide a tamper-evident mechanism on the final artifact itself.
D) Tokenization replaces data with tokens for privacy, not for verifying software integrity.


Reference:



An organization completed a project to deploy SSO across all business applications last year. Recently, the finance department selected a new cloud-based accounting software vendor.
Which of the following should most likely be configured during the new software deployment?

  1. RADIUS
  2. SAML
  3. EAP
  4. OpenID

Answer(s): B

Explanation:

Implementing SAML enables SSO across the new cloud-based application, leveraging the existing centralized identity provider to federate authentication for the finance software. This aligns with prior SSO deployment and avoids reconfiguring local credentials.
A) RADIUS is a network access authentication protocol, not best for web-based SaaS SSO federation.
C) EAP is an authentication framework for network access, not specifically for web SSO or SaaS federations.
D) OpenID is an authentication protocol (not SAML) and would require different federation mechanisms; SAML is more common for enterprise SaaS SSO.


Reference:



A user, who is waiting for a flight at an airport, logs in to the airline website using the public Wi-Fi, ignores a security warning and purchases an upgraded seat.
When the flight lands, the user finds unauthorized credit card charges.
Which of the following attacks most likely occurred?

  1. Replay attack
  2. Memory leak
  3. Buffer overflow attack
  4. On-path attack

Answer(s): D

Explanation:

A) On-path attack is correct because the user connected over unsecured public Wi-Fi and ignored a security warning, enabling an attacker to perform a man-in-the-middle (on-path) interception of session tokens and payment data, leading to unauthorized charges.
B) Replay attack is incorrect because it involves capturing and reusing valid data to impersonate, not typically triggered by insecure Wi-Fi per se during a live transaction with payment processing.
C) Memory leak is incorrect as it is a software defect causing resource exhaustion, not related to interception or credential compromise over a network.
D) Buffer overflow attack is incorrect since it exploits memory safety to execute arbitrary code, not a standard mechanism for intercepting payment data on a public network.


Reference:



A network engineer deployed a redundant switch stack to increase system availability. However, the budget can only cover the cost of one ISP connection.
Which of the following best describes the potential risk factor?

  1. The equipment MTBF is unknown.
  2. The ISP has no SLA.
  3. An RPO has not been determined.
  4. There is a single point of failure.

Answer(s): D

Explanation:

A) A single point of failure in the redundant switch stack with only one ISP link means all traffic depends on one path; if the stack or link fails, there is no alternative route.
B) An SLA is not directly about risk from redundancy; even with an SLA, a single ISP connection can fail and affect availability.
C) RPO relates to data loss tolerance, not network topology redundancy or availability.
D) The core risk is a single point of failure because despite stacking, the lack of diverse network paths or multiple ISPs creates one vulnerable failure domain.


Reference:



Viewing page 5 of 91
Viewing questions 33 - 40 out of 757 questions



Post your Comments and Discuss CompTIA SY0-701 exam dumps with other Community members:

SY0-701 Exam Discussions & Posts

AI Tutor 👋 I’m here to help!