CompTIA SY0-701 Exam Prep
CompTIA Security+ (Page 80 )

Updated On: 31-Aug-2026

Which of the following enables the ability to receive a consolidated report from different devices on the network?

  1. IPS
  2. DLP
  3. SIEM
  4. Firewall

Answer(s): C

Explanation:

SIEM (Security Information and Event Management) systems aggregate and analyze log data from various devices across a network, enabling the collection, correlation, and analysis of security-related events. SIEM provides a consolidated report of activities, helping to identify potential security incidents by correlating data from multiple sources, which enhances visibility and response capabilities across the network.



Which of the following should an organization focus on the most when making decisions about vulnerability prioritization?

  1. Exposure factor
  2. CVSS
  3. CVE
  4. Industry impact

Answer(s): B

Explanation:

The Common Vulnerability Scoring System (CVSS) is a widely used standard that provides a numerical score reflecting the severity of a vulnerability. Organizations use CVSS scores to prioritize vulnerabilities based on their potential impact and exploitability, which helps in assessing which vulnerabilities need urgent remediation. This approach enables systematic vulnerability prioritization based on quantifiable metrics.



An organization needs to monitor its users’ activities in order to prevent insider threats.
Which of the following solutions would help the organization achieve this goal?

  1. Behavioral analytics
  2. Access control lists
  3. Identity and access management
  4. Network intrusion detection system

Answer(s): A

Explanation:

Behavioral analytics involves monitoring and analyzing user behaviors to detect unusual or suspicious patterns that may indicate insider threats. By establishing a baseline of normal behavior, behavioral analytics solutions can identify deviations that could signal potential malicious or risky activities by users, helping to prevent insider threats. This approach is effective in detecting unauthorized actions that traditional access control or identity management systems might miss.



A customer of a large company receives a phone call from someone claiming to work for the company and asking for the customer’s credit card information. The customer sees the caller ID is the same as the company's main phone number.
Which of the following attacks is the customer most likely a target of?

  1. Phishing
  2. Whaling
  3. Smishing
  4. Vishing

Answer(s): D

Explanation:

Vishing (voice phishing) is a social engineering attack where attackers impersonate a trusted entity over the phone to obtain sensitive information, such as credit card details. In this case, the attacker spoofed the company's main phone number on the caller ID to gain the customer’s trust, making it likely that the customer is the target of a vishing attack.



A security analyst is reviewing logs to identify the destination of command-and-control traffic originating from a compromised device within the on-premises network.
Which of the following is the best log to review?

  1. IDS
  2. Antivirus
  3. Firewall
  4. Application

Answer(s): C

Explanation:

Firewall logs are ideal for identifying the destination of command-and-control (C2) traffic because they log all inbound and outbound connections, including IP addresses, ports, and protocols used. By reviewing firewall logs, a security analyst can trace where the compromised device is attempting to send data and potentially identify the external command-and-control server, aiding in the containment of the threat.



Viewing page 80 of 198
Viewing questions 396 - 400 out of 985 questions


Post your Comments and Discuss CompTIA SY0-701 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!