Free CompTIA SY0-701 Practice Questions 2026 - Page 26

Explanation:
SMS-based OTP (One-Time Password) authentication is considered riskier than TOTP (Time-based One-Time Password) primarily due to the interception risk. SMS messages are transmitted over cellular networks and can be vulnerable to several attacks:

SIM swapping:
An attacker social engineers a mobile carrier to transfer the victim's phone number to a SIM card they control, intercepting all SMS messages (including OTP codes).

SS7 protocol exploits:
Vulnerabilities in the Signaling System No. 7 (SS7) used by telecom networks can allow attackers to redirect or intercept SMS messages.

Malware on mobile devices:
Malicious apps might read SMS messages containing OTP codes.

In contrast, TOTP codes are generated locally on a user's device (e.g., via an authenticator app like Google Authenticator or Authy) and do not rely on cellular networks. This makes them resistant to interception via telecom vulnerabilities or SIM swapping.

Why not the others?
A: While SMS OTP requires active mobile service, this is not the primary security risk; it is a usability or accessibility issue.

B: Longer validity windows (e.g., 15 minutes for SMS vs. 30 seconds for TOTP) do increase the window for attack, but the core risk is interception, not just time validity.

D: The algorithm strength is not the issue; both methods typically use similar cryptographic principles (e.g., HMAC-based OTPs). The weakness lies in the delivery mechanism (SMS vs. local generation).

Reference:
Domain 2.4: "Explain authentication and authorization controls." The SY0-701 objectives highlight the vulnerabilities of SMS-based MFA (e.g., interception risks) and recommend more secure methods like TOTP or hardware tokens. NIST guidelines also discourage SMS for high-risk scenarios due to these threats.

Explanation:
The requirement is to protect data on employees' laptops. Laptops are high-risk assets due to their portability, making them susceptible to loss or theft. The goal is to protect all data on the device in such an event.

C. Full disk encryption (FDE) (Correct):
Full disk encryption encrypts the entire hard drive, including the operating system, applications, and all user data. If the laptop is lost or stolen, the data remains inaccessible without the proper decryption key (e.g., a password, PIN, or hardware token). This is the industry standard and most comprehensive method for protecting data at rest on mobile devices like laptops.

Why the other options are incorrect:

A. Partition encryption (Incorrect):
This encrypts only a specific partition or volume on the hard drive. While this can protect data stored on that specific partition, it leaves the boot partition, operating system files, and swap space unencrypted. This is less secure than full disk encryption, as an attacker could potentially access unencrypted data or use forensic tools to recover sensitive information from the unencrypted areas.

B. Asymmetric encryption (Incorrect):
Asymmetric encryption (or public-key cryptography) is a type of encryption algorithm that uses a pair of keys (public and private). It is excellent for tasks like secure key exchange (e.g., in TLS) or digital signatures. However, it is computationally expensive and not practical for encrypting an entire disk volume. Symmetric encryption algorithms (like AES) are used for full disk encryption due to their high speed.

D. Database encryption (Incorrect):
Database encryption is an application-level or database-level control that encrypts specific data within a database (e.g., certain tables or columns). It would only protect data if it were stored in a database application on the laptop. It would not protect the operating system, other applications, documents on the file system, browser cache, or any other data outside the specific database. It is not a comprehensive solution for a whole laptop.

Reference:
This question falls under Domain 3.0: Security Architecture, specifically covering cryptography and its practical applications for protecting data at rest. Technologies like BitLocker (Windows) and FileVault (macOS) are common implementations of full disk encryption.

Explanation:
Hashing is the most appropriate and secure method for protecting stored passwords in a login database. A hash function is a one-way mathematical process that converts plaintext (like a password) into a fixed-length string of characters (a hash). The key security benefits are:

Irreversibility:
It is computationally infeasible to reverse the hash back to the original password.

Deterministic:
The same input always produces the same hash, allowing for verification without storing the actual password.

Impact Limitation:
In the event of a breach, attackers only steal the hashes, not the actual passwords. They would then need to crack each hash (e.g., via brute-force or rainbow tables), which is time-consuming and difficult, especially if strong, salted hashing algorithms (like bcrypt, Argon2) are used. This significantly limits the potential impact. Why the other options are incorrect:

A. Tokenization:
This is the process of substituting sensitive data with a non-sensitive equivalent (a token) that has no exploitable value. It is primarily used for protecting data like credit card numbers or SSNs in payment systems, not for storing passwords for authentication. Tokens can often be reversed by the tokenization system, which is not desirable for password storage.

C. Obfuscation:
This involves making data difficult to understand or read, but it is not a secure cryptographic method. Techniques like encoding (e.g., Base64) or masking are easily reversible and provide no real protection if the method is discovered. It is considered "security through obscurity" and is ineffective against a determined attacker.

D. Segmentation:
Network segmentation involves dividing a network into subnetworks to control traffic and limit the spread of breaches. While segmenting the login database server is a good complementary security practice to limit lateral movement, it does not directly protect the data within the database itself if the server is compromised. The question focuses on protecting the data ("limit potential impact to its log-in database"), making hashing the direct and primary control.

Reference:
This question tests core knowledge of cryptography and identity management.

This falls under Domain 2.2: Implement cryptography for security purposes and Domain 3.1: Given a scenario, implement authentication and authorization controls of the CompTIA Security+ SY0-701 exam objectives.

The use of strong, salted hashes for password storage is a fundamental security practice mandated by frameworks like NIST (Special Publication 800-63B) and is a critical defense against credential theft in the event of a data breach.

Explanation:
Mean Time To Repair (MTTR) is a key performance indicator that measures the average time required to troubleshoot and repair a failed component or system, restoring it to full operational status. The question explicitly describes calculating the "time needed to resolve a hardware issue," which is the precise definition of MTTR.

Why the other options are incorrect:

A. Recovery Point Objective (RPO):
This refers to the maximum acceptable amount of data loss measured in time (e.g., the last 4 hours of transaction data). It is concerned with data, not the repair time of hardware.

B. Mean Time Between Failures (MTBF):
This is a reliability metric that predicts the average time between one system failure and the next. It measures how long a component is expected to last, not how long it takes to fix it.

C. Recovery Time Objective (RTO):
This is the target amount of time within which a business process must be restored after a disruption to avoid unacceptable consequences. While related to repair time, RTO is a broader business-level objective. MTTR is an operational metric that directly contributes to achieving a specific RTO

Reference:
These metrics are fundamental to incident response, disaster recovery, and business continuity planning, all of which are covered in Domain 5.1 (Explain the importance of business continuity and disaster recovery concepts) of the CompTIA Security+ SY0-701 exam objectives. MTTR is a standard operational metric used in IT service management (ITSM) and frameworks like ITIL.

Explanation:
The security engineer's response is best described as an understanding of the organization's risk appetite. Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its strategic objectives. In this scenario, the business is demonstrating a high risk appetite by prioritizing speed and a business goal over security due diligence. The security engineer recognizes that the proposed action (rushing implementation) would exceed the level of risk the security function believes is acceptable, indicating a misalignment with the organization's defined (or implied) risk appetite. The engineer is essentially stating that the risk introduced by skipping due diligence is beyond what the organization should be willing to "stomach."

Analysis of Incorrect Options:

A. Risk tolerance:
Risk tolerance is the acceptable deviation from the risk appetite. It is often a more quantitative measure of the variation in outcomes an organization is willing to withstand. While related to appetite, the scenario describes a high-level strategic decision about how much risk to take, which is the definition of appetite.

B. Risk acceptance:
Risk acceptance is a formal decision to acknowledge a risk and not take any action to mitigate, avoid, or transfer it, typically because the cost of mitigation outweighs the potential impact. This is a specific treatment for an identified risk. The security engineer is not accepting a risk; they are identifying that the business's action would create an unacceptable risk that should not be accepted without proper review.

C. Risk importance:
This is not a standard term in risk management frameworks. The core concepts are Risk Appetite, Tolerance, Acceptance, Avoidance, Mitigation, and Transfer.

Reference:
This question falls under Domain 5.0: Security Program Management and Oversight, specifically objective 5.1: Explain the importance of governance, risk, and compliance components. A core component of risk management is understanding and defining the organization's risk appetite and risk tolerance to guide strategic decision-making, exactly as illustrated in this scenario. The engineer is acting as a key control in the governance process.

Explanation:
When formulating a training curriculum for a security awareness program, the most important factors to address are:

C. Threat vectors based on the industry:
Training should be tailored to the specific risks and threats relevant to the organization's industry (e.g., ransomware for healthcare, phishing for finance, insider threats for government). This ensures the content is practical and directly applicable, increasing engagement and effectiveness.

E. Cadence and duration of training events:
Regular, ongoing training (e.g., quarterly modules) with appropriate duration (short, focused sessions) helps reinforce knowledge, adapt to evolving threats, and avoid learner fatigue. One-time training is insufficient; a structured schedule ensures sustained awareness.

Why not the others?

A. Channels for customer communication:
While important for customer service, this is not a core security awareness topic for general employees.

B. Reporting mechanisms for ethics violations:
This is part of ethics or compliance training but is not the primary focus of security awareness (which targets threats like phishing or social engineering).

D. Secure software development training:
This is highly specialized for developers, not general personnel. Security awareness programs target all employees.

F. Retraining for phishing failures:
While retraining is important, it is a reactive component rather than a foundational curriculum planning factor. The core plan should prioritize proactive, industry-specific content and consistent scheduling.

Reference:
This aligns with Domain 5.0: Security Program Management and Oversight, specifically security awareness training. NIST SP 800-50 (Building an Information Technology Security Awareness and Training Program) emphasizes role-based, relevant content and continuous training to address evolving threats. Industry-specific threats ensure relevance, while cadence ensures retention.

Explanation:
The security controls described—checking in with a photo ID and using an access control vestibule (such as a mantrap or turnstile)—are physical security controls. These controls are designed to protect physical assets, facilities, and personnel by restricting entry to authorized individuals through tangible barriers, verification processes, and surveillance mechanisms. The photo ID check validates identity, while the access control vestibule physically regulates entry, preventing unauthorized access or tailgating.

Analysis of Incorrect Options:

B. Managerial:
Managerial controls are administrative policies, procedures, or guidelines that govern security practices (e.g., security policies, risk assessments, training programs). While the rule requiring visitors to check in might be part of a managerial policy, the actual implementation (ID check, vestibule) is physical.

C. Technical:
Technical controls involve technology-based solutions like firewalls, encryption, access control lists, or authentication systems. The vestibule and ID check are physical, not software- or hardware-based in the IT sense (though the vestibule might incorporate technical elements like card readers, the primary function is physical restriction).

D. Operational:
Operational controls are day-to-day security practices executed by people (e.g., incident response, user access reviews). While the act of checking in is performed by personnel, the infrastructure (vestibule) and the process (ID verification) are fundamentally physical safeguards.

Reference:
This question aligns with Domain 1.0: General Security Concepts, which covers types of security controls. Physical controls are categorized as preventive (e.g., locks, fences) or detective (e.g., CCTV). The access control vestibule is a classic example of a physical preventive control, often used in high-security environments to enforce entry protocols.

Explanation: A responsibility matrix clarifies the division of responsibilities between the cloud service provider (CSP) and the customer, ensuring that each party understands and implements their respective security controls.References: Security+ SY0-701 Course Content.

Explanation:
When designing a high-availability (HA) network, the primary goals are to ensure continuous operation and minimize downtime. Two critical considerations are:

A. Ease of recovery:
High-availability designs must include mechanisms for rapid recovery from failures (e.g., redundant components, failover systems, backup links). The easier and faster the recovery process, the lower the downtime, which is essential for maintaining availability.

E. Attack surface:
High-availability often involves redundant systems, load balancers, and complex configurations, which can expand the attack surface. If not properly secured, these additional components may introduce vulnerabilities. Reducing and hardening the attack surface is crucial to prevent compromises that could disrupt availability (e.g., DDoS attacks, exploits on redundant systems).

Why not the others?

B. Ability to patch:
While patching is important for security, it is not a core design principle specific to high-availability. HA focuses on redundancy and failover, not patch management.

C. Physical isolation:
This is more relevant to security (e.g., air-gapped networks) than high-availability. HA often relies on geographic distribution, not isolation.

D. Responsiveness:
This is a goal of HA (e.g., low latency) but not a design consideration—it is an outcome of proper HA design.

F. Extensible authentication:
This relates to identity and access management, not high-availability. HA is about resilience, not authentication methods.

Reference:
This aligns with Domain 3.0: Security Architecture, specifically network design principles for availability and resilience (e.g., NIST SP 800-53 SC-24). HA requires balancing redundancy with security to avoid introducing weaknesses.