Free CompTIA SY0-701 Practice Questions 2026 - Page 27

Explanation:

C) Rescan the network is the correct next step.
After the operations team remediates the vulnerabilities identified in the initial assessment, the security practitioner should rescan the network to:

Verify that the remediation efforts were successful and the vulnerabilities are truly resolved.

Ensure no new vulnerabilities were introduced during the remediation process (e.g., due to configuration changes or patches).

Confirm the organization's risk posture has improved and meet compliance requirements.

This closure of the vulnerability management lifecycle (scan → remediate → rescan) is critical for validating security improvements.

Why the others are incorrect:

A) Conduct an audit:
Audits are broader examinations of policies, controls, and compliance. They are not the immediate next step after technical remediation of vulnerabilities.

B) Initiate a penetration test:
Penetration testing is an active assessment that exploits vulnerabilities to simulate real attacks. It is typically conducted independently or after vulnerability management cycles to test defenses, but it is not the direct follow-up to remediation.

D) Submit a report:
Reporting is done throughout the process (e.g., after the initial assessment and after verification). However, the immediate next step after remediation is to rescan for verification, which then feeds into final reporting.

Reference:
This question tests knowledge of Domain 4.3: Given an incident, utilize appropriate data sources to support an investigation and Domain 5.2: Explain elements of the risk management process. The vulnerability management lifecycle (identify, assess, remediate, verify) is a key practice, as emphasized in the SY0-701 objectives. Rescanning ensures remediation effectiveness and reduces residual risk.

Explanation:
Sanitization refers to the process of permanently removing data from storage devices to prevent its recovery. securely wiping hard drives (e.g., using tools like DBAN, secure erase, or cryptographic erasure) ensures that data cannot be retrieved when the decommissioned systems are sent to recycling. This aligns with the company's policy of rendering data unrecoverable before disposal.

Why not A?

Enumeration:
This involves listing or identifying items (e.g., network resources, users), not data removal.

Why not C?

Destruction:
Physical destruction (e.g., shredding, degaussing) is another method for data disposal, but the policy specifies "securely wiped," which is sanitization. Destruction is more extreme and typically used when devices cannot be reused.

Why not D?

Inventory:
This involves tracking assets, not data removal.

Reference:
Domain 2.7: "Explain the importance of data privacy and protection." The SY0-701 objectives cover data sanitization methods for ensuring data cannot be recovered from decommissioned devices, which is critical for compliance and preventing data breaches.

Explanation:
The scenario requires a quick method to restrict access to specific data on a file server. This is a direct problem of improperly configured file permissions.

D. Access control lists (ACLs) is correct.
ACLs are the native mechanism within a file system (like NTFS on Windows or POSIX on Linux) that explicitly defines which users or groups have what permissions (Read, Write, Execute) to files and folders. The administrator can directly modify the ACLs on the confidential data to remove inappropriate access and grant it only to authorized groups or users. This is the most direct and fastest way to resolve the issue.

A. Group Policy is incorrect.
Group Policy is a Windows feature used to centrally manage operating system, application, and user settings across a domain. While it can be used to deploy security settings and permissions, it is not the quickest or most direct tool for fixing permissions on a specific set of files on a single server. It's a broader, administrative tool for policy enforcement.

B. Content filtering is incorrect.
Content filtering is a network-level technology used to control the content that can be accessed or transmitted by users (e.g., blocking certain websites or file types). It is designed to prevent users from accessing unwanted external content or exfiltrating data, not to manage internal file permissions on a server.

C. Data loss prevention (DLP) is incorrect.
DLP is a suite of tools and processes designed to detect and prevent the unauthorized transmission of sensitive data. It is a broader, more complex solution that monitors data in use, in motion, and at rest. While it could eventually help enforce policies, it is not the tool an administrator would use to "quickly" change file-level permissions. Configuring DLP policies is a longer process.

Reference:
CompTIA Security+ SY0-701 Objective 3.7: "Given a scenario, implement identity and account management controls." Managing file system security through permissions and Access Control Lists (ACLs) is a fundamental skill covered under this objective for controlling data access.

Explanation:
Phishing is a type of social engineering attack where attackers send fraudulent messages (often emails) that appear to come from a reputable source, such as a payment website. The goal is to trick recipients into revealing sensitive information (like login credentials) or installing malware. In this scenario, the email impersonated a payment website and lured the employee into entering login information on a fake site, which is a classic phishing attack.

Why the other options are incorrect:

A. Brand impersonation:
This is a technique used within phishing attacks where the attacker mimics a well-known brand (like a payment website) to gain trust. However, it is not the overarching attack type itself—it is a component of the phishing attempt.

B. Pretexting:
This involves creating a fabricated scenario (a pretext) to steal information. For example, an attacker might pose as an IT support technician asking for a password. While the email created a false scenario, the specific mechanism of using a fake website and link is hallmark phishing.

C. Typosquatting:
This is a technique where attackers register domain names similar to legitimate ones (e.g., "paypai.com" instead of "paypal.com") to catch users who make typos. While the malicious site in this attack might have used a typosquatted domain, the primary attack vector was the deceptive email, making "phishing" the broader and more accurate category.

Reference:
This question tests the ability to identify specific social engineering techniques.

This falls under Domain 1.1: Compare and contrast common social engineering techniques of the CompTIA Security+ SY0-701 exam objectives.

Phishing is a well-documented attack method in frameworks like NIST SP 800-63 and the OWASP Top 10, and it remains one of the most common threats organizations face. The scenario describes a typical credential harvesting phishing attack.

Explanation: To reduce the number of individual operating systems while decommissioning physical servers, the company should use containerization. Containerization allows multiple applications to run in isolated environments on a single operating system, significantly reducing the overhead compared to running multiple virtual machines, each with its own OS. Containerization: Uses containers to run multiple isolated applications on a single OS kernel, reducing the need for multiple OS instances and improving resource utilization. Microservices: An architectural style that structures an application as a collection of loosely coupled services, which does not necessarily reduce the number of operating systems. Virtualization: Allows multiple virtual machines to run on a single physical server, but each VM requires its own OS, not reducing the number of OS instances. Infrastructure as code: Manages and provisions computing infrastructure through machine-readable configuration files, but it does not directly impact the number of operating systems.

Explanation:
The primary purpose of root cause analysis (RCA) in incident response is to identify the underlying, fundamental reason(s) an incident occurred. By understanding the root cause (e.g., a missing patch, misconfigured firewall, human error, or flawed process), organizations can implement corrective actions to address the weakness and prevent similar incidents from happening in the future. RCA transforms incident response from a reactive process into a proactive improvement cycle, enhancing overall security posture.

Analysis of Incorrect Options:

A. To gather IOCs for the investigation:
Indicators of Compromise (IOCs) are collected during the detection and analysis phases of incident response to identify malicious activity. RCA occurs later, focusing on why the incident happened, not just what happened.

B. To discover which systems have been affected:
Determining the scope of impact (affected systems) is part of the containment and analysis phases, not the goal of RCA. RCA digs deeper after the scope is known.

C. To eradicate any trace of malware on the network:
Eradication is a separate phase where threats are removed. RCA is a post-incident activity that follows eradication to learn from the event.

Reference:
This aligns with Domain 4.0: Security Operations, specifically the incident response lifecycle (NIST SP 800-61). RCA is a key step in the post-incident activity phase, aimed at continuous improvement. It is emphasized in frameworks like ISO/IEC 27035 (Incident Management) and best practices for turning incidents into lessons that strengthen defenses.

Explanation:
Social engineering is the broad term for psychological manipulation tactics used to deceive individuals into divulging confidential information or performing actions that compromise security. In this scenario, the attacker is impersonating human resources (a trusted entity) via email and using deceptive links (that do not lead to legitimate company sites) to trick the new employee. This is a classic social engineering attack, specifically a form of phishing.

Why the other options are incorrect:

A. Business email compromise (BEC):
This is a specific type of social engineering attack where attackers compromise legitimate business email accounts to conduct fraudulent activities (e.g., wire transfer fraud). While the email might appear to be from HR, the scenario does not indicate that a legitimate HR email account was compromised—only that the message is deceptive. The key indicator is the fraudulent links, which align more broadly with social engineering.

C. Unsecured network:
This refers to risks associated with using insecure Wi-Fi or networks where data can be intercepted. The attack is occurring via email content, not network eavesdropping.

D. Default credentials:
This involves attackers using unchanged default passwords to gain access to systems. The scenario focuses on deceptive email links, not credential exploitation.

Reference:
This question tests recognition of social engineering tactics, a core topic in security awareness.

This falls under Domain 1.1: Compare and contrast common social engineering techniques and Domain 5.2: Explain the importance of personnel security and security awareness training of the CompTIA Security+ SY0-701 exam objectives.

Training employees to verify email sources and hover over links to check URLs is a fundamental defense against social engineering, as emphasized in frameworks like NIST SP 800-50 (Building an Information Technology Security Awareness and Training Program).

Explanation:
A tabletop exercise is a discussion-based session where stakeholders gather to review and discuss their roles, responsibilities, and actions in response to a hypothetical scenario, such as a security incident or disaster. Participants talk through the steps they would take, identify gaps in plans, and improve coordination without actually executing any actions. This low-pressure environment helps ensure everyone understands their part in a real emergency.

Analysis of Incorrect Options:

A. Penetration test:
This is a hands-on simulated attack on systems to identify vulnerabilities, not a discussion of roles and responsibilities.

B. Continuity of operations planning:
This involves developing strategies to maintain essential functions during a disruption. While related, it is a broader planning process, not the specific meeting described.

D. Simulation:
A simulation is a more immersive, practice-based exercise that may involve executing responses (e.g., activating backup systems). The scenario describes a discussion, not an active simulation.

Reference:
This falls under Domain 4.0: Security Operations, specifically incident response and disaster recovery preparedness. Tabletop exercises are recommended in frameworks like NIST SP 800-61 (Incident Handling Guide) and are a key part of validating and refining response plans.

Explanation:
The scenario describes a security best practice known as network segmentation and the use of a jump server (also called a bastion host) to provide secure, controlled access to a sensitive network segment.

Jump Server:
This is a hardened server that provides a single, secured gateway for administrators to access devices in an isolated network segment (like one containing critical database servers). Instead of connecting directly to the database servers, the database administrator (DBA) first connects to the jump server. From there, the DBA can initiate a second connection to the target database server. This setup:

Reduces the attack surface by eliminating direct access paths to critical systems.

Centralizes logging and monitoring of all administrative access attempts.

Allows for stricter security controls (e.g., multi-factor authentication) on the jump server itself.

This approach ensures that administrative access is tightly controlled and audited, aligning with the principle of least privilege.

Why the other options are incorrect:
B. RADIUS (Remote Authentication Dial-In User Service):
RADIUS is a protocol used for centralized authentication, authorization, and accounting (AAA) for network access (e.g., for VPNs or Wi-Fi). It is not a tool for accessing servers; it is a backend service that validates credentials during the authentication process.

C. HSM (Hardware Security Module):
An HSM is a physical device that securely generates, stores, and manages cryptographic keys. It is used for tasks like encryption, decryption, and digital signatures. It does not provide access to servers or network segments.

D. Load Balanc:
A load balancer distributes network traffic across multiple servers to optimize resource use, maximize throughput, and ensure high availability. It is not used for administrative access to servers; it is a traffic-routing tool for client requests.

Exam Objective Reference:
This question relates to Domain 3.0: Architecture and Design, specifically the concepts of secure network architecture (segmentation) and security controls (jump servers) for managing privileged access to critical systems. It also touches on Domain 4.0: Operations and Incident Response regarding best practices for administrative access and auditing.

Explanation:
Input validation (C) is the correct answer. The policy describes using regular expressions to remove (or sanitize) specific special characters from user input collected via web forms. This is a classic example of input validation, a security technique designed to ensure that only properly formatted and expected data is processed by an application. By removing characters that have special meaning in command shells (e.g., $, |, ;, &, `, ?), the organization is preventing injection attacks (such as command injection or SQL injection) where attackers could trick the application into executing unintended commands.

Why the others are incorrect:

A. Identify embedded keys:
This refers to searching for and removing hardcoded secrets (like API keys or passwords) in source code. The policy is about sanitizing user input, not inspecting code for embedded credentials.

B. Code debugging:
Debugging is the process of finding and fixing bugs or errors in code functionality. While input validation might be added during debugging, the technique itself is a security measure, not a debugging activity.

D. Static code analysis (SAST):
This is an automated process of analyzing source code for vulnerabilities without executing it. While SAST tools might identify a lack of input validation, the policy describes the actual implementation of the validation technique, not the analysis method used to find the need for it.

Reference:
This question tests knowledge of Domain 3.2: Given a scenario, implement secure coding techniques. Input validation is a fundamental secure coding practice to mitigate injection attacks, which are a top vulnerability according to frameworks like OWASP Top 10. The specific characters mentioned ($, |, ;, etc.) are common in shell command injection attempts.