Free CompTIA SY0-701 Practice Questions 2026 - Page 20

Explanation: The organization should implement a retention policy to ensure that financial data records are kept for three years and customer data for five years. A retention policy specifies how long different types of data should be maintained and when they should be deleted. Retention: Ensures that data is kept for a specific period to comply with legal, regulatory, or business requirements. Destruction: Involves securely deleting data that is no longer needed, which is part of the retention lifecycle but not the primary focus here. Inventory: Involves keeping track of data assets, not specifically about how long to retain data. Certification: Ensures that processes and systems meet certain standards, not directly related to data retention periods.

Explanation: A bug bounty is a program that rewards security researchers for finding and reporting vulnerabilities in an application or system. Bug bounties are often used by companies to improve their security posture and incentivize ethical hacking. A bug bounty program typically defines the scope, rules, and compensation for the researchers. References = CompTIA Security+ Study Guide with over 500 Practice Test Questions: Exam SY0-701, 9th Edition, Chapter 1, page 10. CompTIA Security+ (SY0-701) Certification Exam Objectives, Domain 1.1, page 2.

Explanation: For a company located in an area prone to hurricanes and needing to immediately continue operations, the best type of site is a hot site. A hot site is a fully operational offsite data center that is equipped with hardware, software, and network connectivity and is ready to take over operations with minimal downtime. Hot site: Fully operational and can take over business operations almost immediately after a disaster. Cold site: A basic site with infrastructure in place but without hardware or data, requiring significant time to become operational. Tertiary site: Not a standard term in disaster recovery; it usually refers to an additional backup location but lacks the specifics of readiness. Warm site: Equipped with hardware and connectivity but requires some time and effort to become fully operational, not as immediate as a hot site.

Explanation: The vulnerability likely present in the application that is storing data using MD5 is a cryptographic vulnerability. MD5 is considered to be a weak hashing algorithm due to its susceptibility to collision attacks, where two different inputs produce the same hash output, compromising data integrity and security. Cryptographic: Refers to vulnerabilities in cryptographic algorithms or implementations, such as the weaknesses in MD5. Malicious update: Refers to the intentional injection of harmful updates, not related to the use of MD5. Zero day: Refers to previously unknown vulnerabilities for which no patch is available, not specifically related to MD5. Side loading: Involves installing software from unofficial sources, not directly related to the use of MD5. Reference: CompTIA Security+ SY0-701 Exam Objectives, Domain 1.4 - Explain the importance of using appropriate cryptographic solutions (MD5 vulnerabilities).

Explanation:
A security awareness program is designed to educate and empower employees to become active participants in an organization's security. A fundamental element of this is establishing clear, simple, and well-communicated channels for employees to report security concerns. Teaching employees how to recognize and, most importantly, immediately report phishing attempts and other suspicious activities is a cornerstone of any effective security awareness program. This turns the human layer into a defensive asset.

Why the others are incorrect:

B) Detecting insider threats using anomalous behavior recognition:
This describes a technical control (e.g., User and Entity Behavior Analytics - UEBA software) or a task for the security operations center (SOC), not a communicative element of an awareness program aimed at general employees.

C) Verifying information when modifying wire transfer data:
This is a specific procedure or action that would be taught during training (e.g., for accounting staff), often as part of a response to Business Email Compromise (BEC) scams. However, it is a specific policy compliance item, not the broad, foundational element of communication itself (like a reporting mechanism) that is central to the entire awareness program.

D) Performing social engineering as part of third-party penetration testing:
This is an activity conducted by security professionals or ethical hackers to test the effectiveness of the awareness program. It is not an element of communication within the program for employees.

Reference:
This aligns with SY0-701 Objective 5.5 ("Explain the importance of policies to organizational security"), specifically the requirement for a security awareness and training policy. This policy mandates programs that include communication elements such as reporting procedures for incidents, which is a primary method for engaging employees and improving the organization's overall security posture.

Explanation:
To determine whether the connection to the link in the phishing email was successful, the analyst should review network logs. These logs capture details about network connections, such as:

Outbound HTTP/HTTPS requests from the user's device.

DNS queries resolving the phishing domain.

Successful establishment of TCP/IP connections to the external server.

Data transfers (e.g., indicating a payload was downloaded).

Network logs (e.g., from firewalls, proxies, or IDS/IPS) provide direct evidence of whether the user's device communicated with the malicious server.

Why not the others?

B. System logs:
Focus on OS-level events (e.g., logons, process creation) but may not explicitly show successful external connections.

C. Application logs:
Record application-specific actions (e.g., browser activity) but might not be as comprehensive for network-level verification.

D. Authentication logs:
Track login attempts and access controls, unrelated to outbound connections.

Reference:
Domain 4.3: "Given an incident, utilize appropriate data sources to support an investigation." Network logs are critical for tracing communication with external entities, a key step in phishing incident analysis. The SY0-701 objectives emphasize using diverse log sources for forensic investigations.

Explanation:
The scenario describes a likely credential theft attack (e.g., phishing, keylogging, or password reuse) where an attacker obtained user passwords and logged in from suspicious locations. Resetting passwords addresses the immediate breach but does not prevent future attacks if credentials are stolen again.

Multifactor authentication (MFA) adds an extra layer of security by requiring users to provide two or more verification factors (e.g., something they know [password] + something they have [authenticator app code] or something they are [biometrics]). Even if a password is compromised, the attacker cannot authenticate without the second factor, effectively preventing unauthorized logins from suspicious IP addresses.

Why the others are incorrect:

B. Permissions assignment:
This involves granting users appropriate access rights (principle of least privilege). While important for security, it does not prevent initial unauthorized access via stolen credentials.

C. Access management:
This is a broad term encompassing policies and tools for controlling user access. MFA is a specific component of access management, but the other options are less direct. Permissions assignment (B) is part of access management but does not solve the credential theft issue.

D. Password complexity:
Enforcing strong passwords is a good practice, but complex passwords can still be stolen through phishing, malware, or data breaches. MFA provides stronger protection beyond password strength.

Reference:
This aligns with SY0-701 Objective 3.3 ("Given a scenario, implement secure identity and access management"). Multifactor authentication (MFA) is a critical defense against credential theft and unauthorized access, as emphasized in security frameworks like NIST SP 800-63B and compliance standards (e.g., PCI DSS, GDPR). It is specifically recommended to mitigate risks from stolen passwords.

Explanation:

D) SLA (Service Level Agreement) is the correct answer.
An SLA is a formal document between a service provider and a client that defines the level of service expected, including specific metrics like uptime guarantees (e.g., 99.99%). It outlines: Service performance standards (availability, responsiveness).

Responsibilities of both parties.

Remedies or penalties if the service provider fails to meet the agreed-upon levels (e.g., service credits).

In this scenario, the client's demand for 99.99% uptime is a key performance indicator (KPI) that should be documented in the SLA.

Why the others are incorrect:

A) MOA (Memorandum of Agreement):
An MOA is a non-binding document that expresses a common line of action between parties. It is less formal and does not typically include detailed performance metrics like uptime.

B) SOW (Statement of Work):
An SOW defines the specific tasks, deliverables, and timeline for a project. It focuses on the "what" and "when" of work to be performed, not ongoing service levels like uptime.

C) MOU (Memorandum of Understanding):
An MOU is a preliminary agreement that outlines the intent to collaborate. It is often used before formal contracts are drafted and does not include enforceable service levels.

Reference:
This question tests knowledge of Domain 5.3: Explain the importance of policies to organizational security. SLAs are critical for managing relationships with third-party providers and ensuring accountability, as emphasized in the SY0-701 objectives. They are legally binding and specifically address measurable service standards like uptime, which aligns with the client’s demand.

Explanation:
A Web Application Firewall (WAF) is specifically designed to protect web applications by filtering and monitoring HTTP traffic between a web application and the internet. It can detect and block common web-based attacks, including buffer overflows, SQL injection, cross-site scripting (XSS), and other OWASP Top 10 vulnerabilities. By deploying a WAF, the organization can add a layer of defense that inspects incoming requests for malicious patterns and prevents exploits from reaching the web application, thus protecting against similar attacks in the future.

Analysis of Incorrect Options:

A. NGFW (Next-Generation Firewall):
An NGFW provides advanced network-level security (e.g., stateful inspection, intrusion prevention, application awareness). While it can offer some protection, it is not as specialized as a WAF for detecting and mitigating application-layer attacks like buffer overflows in web applications.

C. TLS (Transport Layer Security):
TLS encrypts data in transit between the client and server, ensuring confidentiality and integrity. However, it does not protect against buffer overflow exploits; it only secures the communication channel. An attacker can still exploit a buffer overflow over an encrypted TLS connection.

D. SD-WAN (Software-Defined Wide Area Network):
SD-WAN optimizes and manages wide area network connectivity, improving performance and reliability. It is not a security tool and provides no protection against web application attacks like buffer overflows.

Reference:
This question falls under Domain 3.0: Security Architecture, specifically web application security. Buffer overflows are a common application-layer vulnerability, and the WAF is the recommended control for mitigating such threats, as highlighted in the OWASP Top 10 and frameworks like NIST SP 800-44 (Guidelines on Securing Public Web Servers).

Explanation:
An Acceptable Use Policy (AUP) is a preventive security control. It is designed to prevent security incidents by defining rules and guidelines for the appropriate use of organizational resources (e.g., computers, networks, internet access). By setting clear expectations and prohibiting certain behaviors (e.g., visiting malicious websites, downloading unauthorized software), the AUP aims to reduce the risk of incidents before they occur. It is an administrative control that helps avoid misuse and potential breaches.

Analysis of Incorrect Options:

A. Detective:
Detective controls identify and respond to incidents after they happen (e.g., intrusion detection systems, logging). An AUP does not detect incidents; it tries to prevent them.

B. Compensating:
Compensating controls are alternative measures used when primary controls are not feasible (e.g., additional monitoring if encryption isn’t possible). An AUP is a primary preventive measure, not a compensation.

C. Corrective:
Corrective controls mitigate damage after an incident (e.g., backups, patch management). An AUP is proactive, not reactive.

Reference:
This aligns with Domain 5.0: Security Program Management and Oversight, specifically policies and procedures. AUPs are categorized as preventive administrative controls in frameworks like NIST SP 800-53 (PL-4: Rules of Behavior) and are essential for establishing a security-aware culture.