Free CompTIA SY0-701 Practice Questions 2026 - Page 10

Explanation: The most important security concern when using legacy systems is the lack of vendor support. Without support from the vendor, systems may not receive critical security patches and updates, leaving them vulnerable to exploitation. This lack of support can result in increased risk of security breaches, as vulnerabilities discovered in the software may never be addressed.
References = CompTIA Security+ SY0-701 study materials, particularly in the context of risk management and the challenges posed by legacy systems.

Explanation:

C: is correct because a Cybersecurity Framework (CSF), such as the NIST Cybersecurity Framework, provides a high-level, strategic view of an information security program. It is built around core functions like Identify, Protect, Detect, Respond, and Recover. Adopting the same CSF provides a common language, a standardized set of goals, and a consistent methodology for managing cybersecurity risk across both organizations. This alignment is crucial for a merger, as it allows the new, combined entity to build a unified, cohesive, and effective security program from the top down, rather than trying to awkwardly stitch together two different security cultures and processes.

A: is incorrect because while deploying CIS (Center for Internet Security) baselines is an excellent technical control for standardizing system hardening (e.g., configuring OS and software settings), it is a tactical, technical solution. It does not provide the overarching strategic alignment needed for entire security programs, which encompass people, processes, and technology far beyond just system configuration.

B: is incorrect because "joint cybersecurity best practices" is a vague and informal concept. Without a defined framework to structure these practices, this approach would likely lead to confusion and disagreements over what constitutes a "best practice." A formal framework provides the necessary structure and authority for standardization.

D: is incorrect because an assessment of controls in a vulnerability report is a point-in-time, operational activity. It focuses on identifying technical weaknesses (vulnerabilities) and the controls that are missing or failing. This is a useful tool within a security program but is far too narrow and reactive to serve as the foundation for standardizing two entire security programs during a major business event like a merger.

Reference:
This question falls under Domain 5.0: Governance, Risk, and Compliance (GRC). It specifically addresses the use of frameworks, policies, and procedures to manage and align cybersecurity strategy, which is a primary objective of the GRC domain. The NIST CSF is a key industry framework highlighted in the SY0-701 objectives.

Explanation:
A) Estimating the recovery time of systems is a core component of the Business Impact Analysis (BIA) process. The BIA focuses on identifying and evaluating the potential effects of disruptions on critical business operations. Key tasks include:

Determining the Recovery Time Objective (RTO): The maximum acceptable time to restore a system or process after a disruption.

Determining the Recovery Point Objective (RPO): The maximum acceptable amount of data loss measured in time.

Identifying critical systems, processes, and their dependencies.

Assessing the financial, operational, and legal impacts of downtime.

Why the others are incorrect:

B) Identifying the communication strategy:
This is typically part of the incident response plan or crisis communication plan, not the BIA. The BIA informs these plans but does not directly develop them.

C) Evaluating the risk management plan:
The BIA provides input to the risk management plan by quantifying impacts, but it does not evaluate the plan itself.

D) Establishing backup and recovery procedures:
This is an outcome of the BIA (informed by RTO/RPO) but is detailed in the disaster recovery plan (DRP), not the BIA process itself.

E) Developing the incident response plan:
This is a separate process that addresses security incidents, while the BIA focuses on business continuity and disaster recovery planning.

Reference:
This question tests knowledge of Domain 5.4: Explain the importance of business continuity and disaster recovery concepts. The BIA is a foundational step in business continuity planning, as emphasized in the SY0-701 objectives. It prioritizes recovery efforts based on quantitative impacts (e.g., RTO/RPO), ensuring resources are allocated effectively.

Explanation:
File Integrity Monitoring (FIM) is a security control that continuously checks and alerts on unauthorized changes (modifications, deletions, or additions) to critical files, configurations, and directories. By implementing FIM on the server containing customers' PII (Personally Identifiable Information), the bank can ensure that any unauthorized modification to this sensitive data is immediately detected and investigated. This directly addresses the requirement to ensure data is not modified improperly.

Why the others are incorrect:

A) Full disk encryption:
This protects data at rest from unauthorized access if the physical disk is stolen or lost by encrypting the entire storage volume. However, it does not prevent modifications to files by authorized users or malware that has gained access to the system while it is running.

B) Network access control:
NAC regulates which devices are allowed to connect to a network based on security policies. It focuses on network access but does not monitor or protect against modifications to files on a server once access is granted.

D) User behavior analytics:
UBA analyzes user activities to detect anomalous behavior that might indicate insider threats or compromised accounts. While it can indirectly signal potential risks, it does not specifically monitor or prevent file modifications like FIM does.

Reference:
This aligns with SY0-701 Objective 3.2 ("Given a scenario, implement host or application security solutions") and data protection principles. FIM is a critical control for compliance with standards like PCI DSS, which requires monitoring changes to critical files to ensure data integrity. Tools like Tripwire or AWS GuardDuty (for cloud) are examples of FIM solutions.

Explanation:
Push notifications for Multi-Factor Authentication (MFA) best meet all the stated requirements:

Seamless & Integrates into Workflow:
A push notification is sent automatically to an app on the user's device (e.g., Microsoft Authenticator, Duo). The user simply reviews the login details and taps "Approve" or "Deny." This requires minimal effort and integrates smoothly into a modern digital workflow without interrupting it.

Utilize Employee-Owned Devices (BYOD):
Push notification MFA relies on a software app installed on a smartphone. This is ideal for a Bring Your Own Device (BYOD) model, as employees can easily install the required app on their personal phones without the company needing to provision hardware.

Why not B?
Phone call: While a phone call can use an employee-owned device, it is not seamless. It requires the user to answer the call and often press a specific number on the keypad. This is more disruptive and time-consuming than a simple push notification approval.

Why not C?
Smart card: A smart card is a physical hardware token that must be issued by the company. This does not utilize employee-owned devices and requires the company to manage the procurement, distribution, and lifecycle of the cards. It is also less seamless, as it requires a reader and the physical action of inserting the card.

Why not D?
Offline backup codes: These are one-time-use codes provided to users as a backup method if their primary MFA is unavailable. They are not a primary authentication method and are neither seamless nor integrated into a workflow. They are a manual, fallback option.

Reference:
Domain 1.4: "Given a scenario, analyze indicators of malicious activity." While this domain covers broader topics, understanding MFA methods is a core part of identity and access management, which is foundational to security. Push notifications are a recommended, user-friendly MFA method in modern security frameworks like NIST's guidelines on digital identity.

Explanation:
Zero Trust is a security model that aligns perfectly with all three requirements:

Provide a secure zone:
Zero Trust architecture creates micro-segments and secure enclaves within the network. Instead of a single "trusted" internal network, it establishes multiple "secure zones" where access is strictly controlled.

Enforce a company-wide access control policy:
A core principle of Zero Trust is "never trust, always verify." It mandates strict identity verification and least-privilege access controls for every user and device, regardless of whether they are inside or outside the corporate network. This is a universal (company-wide) policy.

Reduce the scope of threats:
By segmenting the network (creating secure zones) and enforcing granular access controls, Zero Trust contains potential breaches. If a threat actor compromises one system, their ability to move laterally to other systems (the "scope" of the threat) is severely limited.

Why not B?
AAA (Authentication, Authorization, and Accounting) is a framework for access control. While it is a critical component used within a Zero Trust model to "enforce access control policy," it is not the overarching framework that also provides "secure zones" and "reduces threat scope" through segmentation.

Why not C?
Non-repudiation is a legal concept that ensures a party cannot deny the authenticity of their signature on a document or a message they sent. It is achieved through techniques like digital signatures. It does not relate to creating secure zones or reducing threat scope.

Why not D?
CIA Triad (Confidentiality, Integrity, Availability) is the fundamental model of information security. It describes security goals (what to protect) but is not a specific architecture or solution that an administrator would "set up" to meet these technical requirements.

Reference:
Domain 2.1: "Explain the importance of security concepts in an enterprise environment." The SY0-701 objectives specifically list Zero Trust as a key security concept, describing it as a model that eliminates implicit trust and continuously validates every stage of digital interaction. The requirements in the question are a direct match for the goals and implementation of a Zero Trust architecture.

Explanation:
The vulnerability scan reported a high-severity issue because Telnet (port 23) is an insecure protocol that transmits data (including credentials) in cleartext, making it susceptible to eavesdropping.

However, the security analyst performed a follow-up test using an Nmap script (telnet-encryption) specifically designed to check if the Telnet service supports encryption. The result (Telnet server supports encryption) indicates that this particular Telnet implementation uses encryption to protect the data in transit, mitigating the inherent risk of the protocol.

Therefore, the original vulnerability scan incorrectly flagged this as a high-severity issue because it did not detect the encryption support. This makes the report a false positive—a finding that is incorrectly identified as a vulnerability when it is not actually present or is mitigated.

Why the others are incorrect:

B. A rescan is required:
A rescan might be useful for verification, but the analyst already conducted a targeted test that provided conclusive evidence (encryption is supported). No further scanning is needed to confirm this specific issue.

C. It is considered noise:
"Noise" in scanning refers to irrelevant or low-priority findings that clutter reports. This was a high-severity finding that required investigation, not mere noise.

D. Compensating controls exist:
Compensating controls are alternative measures (e.g., network segmentation) that reduce risk. Here, the encryption is a direct feature of the service itself, not an external compensating control.

Reference:
This aligns with SY0-701 Objective 4.1 ("Given a scenario, analyze indicators of malicious activity"). Vulnerability management includes validating scan results to eliminate false positives, as emphasized in best practices like NIST SP 800-115 ("Technical Guide to Information Security Testing and Assessment"). The use of tools like Nmap scripts for deeper verification is a key analyst skill.

Explanation: Analysis is the incident response activity that describes the process of understanding the source of an incident. Analysis involves collecting and examining evidence, identifying the root cause, determining the scope and impact, and assessing the threat actor’s motives and capabilities. Analysis helps the incident response team to formulate an appropriate response strategy, as well as to prevent or mitigate future incidents. Analysis is usually performed after detection and before containment, eradication, recovery, and lessons learned.
References = CompTIA Security+ Study Guide with over 500 Practice Test Questions: Exam SY0-701, 9th Edition, Chapter 6, page 223. CompTIA Security+ SY0-701 Exam Objectives, Domain 4.2, page 13.

Explanation:
The Annualized Loss Expectancy (ALE) is the most useful metric for comparing the long-term cost of risk transfer (e.g., purchasing insurance) against the impact of the risk itself. The ALE represents the expected monetary loss per year due to a specific risk. It is calculated as:

ALE = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO)

SLE is the cost of a single occurrence of the risk (e.g., $10,000 per incident).

ARO is the estimated number of times the risk is expected to occur in a year (e.g., 0.5 times per year).

If the annual cost of transferring the risk (e.g., insurance premium) is less than the ALE, it may be financially justified to transfer the risk. Conversely, if the transfer cost is higher than the ALE, it might be more cost-effective to accept or mitigate the risk.

Analysis of Incorrect Options:

A. ARO (Annualized Rate of Occurrence):
This represents how often a threat is expected to occur annually (e.g., twice a year). While it is a component of ALE, it does not account for the cost of the risk, so it alone cannot determine if transfer is cost-effective.

B. RTO (Recovery Time Objective):
This is the maximum acceptable downtime after a disaster before business operations must resume. It is a metric used in business continuity planning, not quantitative risk analysis for cost comparisons.

C. RPO (Recovery Point Objective):
This is the maximum acceptable amount of data loss measured in time (e.g., losing no more than 1 hour of data). Like RTO, it is used for disaster recovery planning and does not help calculate financial impacts for risk decisions.

E. SLE (Single Loss Expectancy):
This is the cost of a single occurrence of a risk (e.g., $50,000 per data breach). While it is part of the ALE calculation, it does not account for how often the risk occurs annually, so it cannot represent the long-term cost.

Reference:
This question falls under Domain 5.0: Security Program Management and Oversight, specifically quantitative risk analysis. ALE is a key formula used to prioritize risks and make cost-effective decisions about risk treatment (avoid, transfer, mitigate, accept). It is central to frameworks like NIST SP 800-30 (Risk Management Guide).

Explanation:
EDR (Endpoint Detection and Response) is a security solution that continuously monitors and collects endpoint data (e.g., workstations, servers), uses behavioral analysis to identify suspicious activities, and provides capabilities to investigate and respond to threats. It is specifically designed to detect and prevent the installation and execution of malware (like viruses and Trojans) and is highly effective at identifying and stopping lateral movement across a network by isolating compromised endpoints.

Why the others are incorrect:

A) IDS (Intrusion Detection System):
An IDS is a network-based (NIDS) or host-based (HIDS) monitoring system that detects and alerts on suspicious activity but typically lacks the integrated response capabilities to actively prevent the initial installation or stop lateral movement on its own.

B) ACL (Access Control List):
An ACL is a fundamental network security feature (on routers, switches, or firewalls) that filters traffic based on rules (e.g., allow/deny by IP address/port). While it can be used to segment a network and inhibit lateral movement, it is not specifically designed to protect an individual computer from malware installation. It operates at the network level, not the endpoint level.

D) NAC (Network Access Control):
NAC is a solution that enforces security policies on devices attempting to access the network. It checks for compliance (e.g., updated antivirus, OS patches) before granting access. Its primary role is to prevent initial network access by unauthorized or non-compliant devices, but it is not focused on continuous monitoring and response to threats after a device is already on the network, which is when lateral movement occurs.

Reference:
This aligns with SY0-701 Objective 3.2 ("Given a scenario, implement host or application security solutions") which specifically lists Endpoint Detection and Response (EDR) as a key security solution. EDR's role in containing threats and preventing lateral movement is a core concept in modern security architecture.