CompTIA SY0-701 Exam Questions
CompTIA Security+ (Page 7 )

Updated On: 27-Apr-2026

Which of the following best describes a use case for a DNS sinkhole?

  1. Attackers can see a DNS sinkhole as a highly valuable resource to identify a company's domain structure.
  2. A DNS sinkhole can be used to draw employees away from known-good websites to malicious ones owned by the attacker.
  3. A DNS sinkhole can be used to capture traffic to known-malicious domains used by attackers.
  4. A DNS sinkhole can be set up to attract potential attackers away from a company's network resources.

Answer(s): C

Explanation:

Option C is correct because a DNS sinkhole captures or redirects traffic destined for known-malicious domains to an undercontrolled IP, allowing detection, logging, and analysis of compromised hosts or attempted communications.
A) Incorrect — DNS sinkholes are not intended to reveal a company’s domain structure to attackers; they block or redirect, not expose assets.
B) Incorrect — sinkholes do not purposefully lure employees to malicious sites; they divert or quarantine such requests for analysis, not drive them to harm.
D) Incorrect — while sinkholes can attract attackers, the primary use is detection/containment, not serving as a lure for adversaries.



An incident analyst finds several image files on a hard disk. The image files may contain geolocation coordinates. Which of the following best describes the type of information the analyst is trying to extract from the image files?

  1. Log data
  2. Metadata
  3. Encrypted data
  4. Sensitive data

Answer(s): B

Explanation:

Option B is correct because image files often include metadata (EXIF) that can store geolocation coordinates, camera info, and timestamps, which analysts extract during investigations. Incorrect — A: Log data are records of events, not embedded in images. Incorrect — C: Encrypted data would require keys to reveal content; metadata itself is not encrypted. Incorrect — D: Sensitive data refers to content that needs protection, but the question focuses on extracting embedded contextual information (metadata), not classification of data sensitivity.



Which of the following most likely describes why a security engineer would configure all outbound emails to use S/MIME digital signatures?

  1. To meet compliance standards
  2. To increase delivery rates
  3. To block phishing attacks
  4. To ensure non-repudiation

Answer(s): D

Explanation:

Option D is correct because S/MIME provides digital signatures that ensure non-repudiation; the sender cannot deny sending the message, and recipients can verify authenticity and integrity. Incorrect — A: Compliance standards may require encryption or controls, but non-repudiation is the primary benefit of signing. B: S/MIME does not inherently increase delivery rates; it can affect delivery due to cryptographic processing. C: While signing verifies integrity, blocking phishing requires additional controls like DMARC/SPF/DKIM and user training. A correct reason for signing is non-repudiation, not primarily anti-phishing or delivery mechanics.



During a recent company safety stand-down, the cyber-awareness team gave a presentation on the importance of cyber hygiene. One topic the team covered was best practices for printing centers. Which of the following describes an attack method that relates to printing centers?

  1. Whaling
  2. Credential harvesting
  3. Prepending
  4. Dumpster diving

Answer(s): D

Explanation:

Option D is correct because dumpster diving involves collecting discarded documents or media to obtain sensitive information, a threat relevant to printing centers where printed outputs may be improperly discarded. Incorrect — A) Whaling targets high-profile individuals in phishing against executives, not printing-center specific. Incorrect — B) Credential harvesting aims to steal login credentials, not tied to printing practices. Incorrect — C) Prepending is a social engineering method where malicious content is added before legitimate data, not a printing-center attack vector.



Which of the following considerations is the most important regarding cryptography used in an IoT device?

  1. Resource constraints
  2. Available bandwidth
  3. The use of block ciphers
  4. The compatibility of the TLS version

Answer(s): A

Explanation:

Option A is correct because IoT devices have limited CPU, memory, and power; cryptographic algorithms must be lightweight to meet performance and energy constraints.
B is incorrect because while bandwidth matters, it is less critical than on-device resource limits for cryptographic operations and key management.
C is incorrect because the choice between block vs stream ciphers is secondary to resource constraints; the primary concern is feasibility within the device’s limits.
D is incorrect because TLS version compatibility is important for secure communication, but resource constraints more directly impact the viability of cryptography on IoT devices.



A coffee shop owner wants to restrict internet access to only paying customers by prompting them for a receipt number. Which of the following is the best method to use given this requirement?

  1. WPA3
  2. Captive portal
  3. PSK
  4. IEEE 802.1X

Answer(s): B

Explanation:

Option B is correct because a captive portal forces users to view a login/acceptance page before gaining access, enabling validation via a receipt number for paying customers. A) WPA3 provides encrypted Wi-Fi but not user admission control. C) PSK (pre-shared key) grants network access to anyone with the key, not customer-specific access. D) IEEE 802.1X authenticates devices, not typical receipt-based access control for public Wi-Fi; it requires a RADIUS server and client certificates, which is overkill for a simple portal check.



While performing digital forensics, which of the following is considered the most volatile and should have the contents collected first?

  1. Hard drive
  2. RAM
  3. SSD
  4. Temporary files

Answer(s): B

Explanation:

Option B is correct because RAM is the most volatile evidence; its contents are lost when power is removed, so live memory must be captured first in digital forensics to preserve running processes, open files, and encryption keys. A) Hard drive: non-volatile storage; can be collected after memory. C) SSD: non-volatile and typically slower to access but not volatile like RAM. D) Temporary files: non-volatile on disk; may be lost or overwritten but not as immediately volatile as RAM. However, if memory capture is not possible, then other volatile sources should be prioritized.



A hosting provider needs to prove that its security controls have been in place over the last six months and have sufficiently protected customer data. Which of the following would provide the best proof that the hosting provider has met the requirements?

  1. NIST CSF
  2. SOC 2 Type 2 report
  3. CIS Top 20 compliance reports
  4. Vulnerability report

Answer(s): B

Explanation:

Option B is correct because a SOC 2 Type 2 report provides independent auditor assurance that a service organization’s controls operated effectively over a defined period (typically six months), directly addressing data security and confidentiality for customers. A) NIST CSF is a framework, not an attestation of ongoing controls. C) CIS Top 20 (now CIS Controls) are controls, not an external validation report. D) Vulnerability report documents weaknesses but does not prove sustained control effectiveness or regulatory-style assurance over time.



Viewing page 7 of 102
Viewing questions 31 - 35 out of 804 questions


SY0-701 Exam Discussions & Posts

AI Tutor AI Tutor 👋 I’m here to help!