Free CompTIA SY0-701 Practice Questions 2026 - Page 34

Explanation:
Authorization is the process of granting or denying access to specific resources or actions after a user has been authenticated (i.e., after they have logged in and proven their identity). It determines what an authenticated user is allowed to do, such as accessing files, running applications, or modifying data. This aligns directly with the scenario of granting access post-login.

Why the others are incorrect:

B. Identification:
This is the initial step where a user claims an identity (e.g., by providing a username). It occurs before logging in and does not involve granting access.

C. Non-repudiation:
This ensures that a user cannot deny having performed an action (e.g., through digital signatures or audit logs). It is unrelated to granting access after login.

D. Authentication:
This is the process of verifying a user's identity (e.g., via password, biometrics) during login. It occurs before authorization and does not itself grant access to resources.

Reference:
This aligns with SY0-701 Objective 3.3 ("Given a scenario, implement secure identity and access management"). The concepts of authentication (verifying identity) and authorization (granting permissions) are fundamental to access control, as defined in frameworks like NIST SP 800-53 (Security and Privacy Controls for Information Systems and Organizations).

Explanation:
Pass-the-hash (PtH) is an attack where a threat actor steals the hashed version of a user's password (NTLM hash) and uses it to authenticate to other systems without needing to decrypt it to the plaintext password. This attack is particularly effective against privileged accounts, like domain administrators, because it bypasses standard password defenses.

A Privileged Access Management (PAM) solution is specifically designed to mitigate such attacks. It works by:

Isolating privileged credentials in a secure vault.

Enforcing just-in-time (JIT) access, where privileges are granted only for specific tasks and short periods.

Rotating passwords automatically after each use, making stolen hashes useless.

Monitoring and auditing all privileged sessions.

This strategy directly prevents the misuse of domain admin accounts even if a hash is stolen.

Why the others are incorrect:

A) Audit each domain administrator account weekly for password compliance:
While auditing is good practice, it is reactive. It might catch non-compliant passwords but does nothing to prevent the use of a stolen hash in real-time. PtH attacks do not require knowledge of the plaintext password.

C) Create IDS policies to monitor domain controller access:
An Intrusion Detection System (IDS) can detect suspicious access attempts but cannot prevent the attack from occurring. It is a monitoring tool, not a preventive control.

D) Use Group Policy to enforce password expiration:
Regularly expiring passwords is a general hygiene practice, but it is ineffective against PtH attacks. If a hash is stolen, it can be used immediately before the password expires. Furthermore, frequent password changes can lead to weaker passwords and are not recommended by modern security guidelines (e.g., NIST).

Reference:
This aligns with SY0-701 Objective 3.3 ("Given a scenario, implement secure identity and access management"). Mitigating pass-the-hash attacks is a key security goal, and Privileged Access Management (PAM) is the industry-standard solution, as outlined in frameworks like Microsoft's "Mitigating Pass-the-Hash Attacks" and other best practices for protecting privileged accounts.

Explanation
The scenario describes a program designed to change employee behavior by applying game-like elements to a serious security topic.

Why D. Gamification is the Correct Answer
Gamification is the application of typical elements of game playing (e.g., point scoring, competition with others, rules of play, rewards) to other areas of activity—in this case, security awareness—to encourage engagement and participation. Let's break down the scenario:

"After multiple phishing simulations":
This establishes a baseline and a recurring activity (the "game").

"announces a new program that incentivizes employees":
This is the core of gamification. An incentive (e.g., a prize, recognition, a bonus, or a points system) is introduced to reward desired behavior.

"to not click phishing links in the upcoming quarter":
This is the specific rule or goal of the "game." Employees are being challenged to achieve a perfect score or improve their performance over a defined period.

The program transforms the serious task of avoiding phishing from a passive training exercise into an active, competitive, and rewarding challenge. This technique is highly effective for improving engagement and long-term retention of security principles.

Why the Other Options Are Incorrect

A. Computer-based training

What it is:
This is a form of education where users complete interactive, often mandatory, training modules on their computers. It is a common method for delivering security awareness content.

Why it's incorrect:
The scenario does not describe a training module. It describes an incentive program built on top of the existing phishing simulations. Computer-based training is the tool used to educate employees, while gamification is the technique used to motivate them to apply that education.

B. Insider threat awareness

What it is:
This is a specific topic or subject of security awareness training. It educates employees on the risks posed by malicious or negligent insiders and how to report suspicious activity.

Why it's incorrect:
This is a distractor. While phishing is a common method used by outsiders to gain access and become an insider threat, the technique described is not "insider threat awareness." The technique is about how the training is executed (gamification), not the subject of the training (phishing).

C. SOAR playbook

What it is:
A SOAR (Security Orchestration, Automation, and Response) playbook is a predefined, automated workflow for security analysts to follow in response to a specific type of security incident (e.g., a phishing email reported by an employee).

Why it's incorrect:
A SOAR playbook is an internal tool for the security operations center (SOC), not an awareness technique for general employees. It is a technical response mechanism, not a motivational or educational program for staff.

Reference to Exam Objectives
This question aligns with the CompTIA Security+ (SY0-701) Exam Objective 5.2: Explain the importance of applicable regulations, standards, or frameworks that impact organizational security posture.

Part of a strong security posture is an effective security awareness and training program. Frameworks like NIST often recommend using innovative techniques like gamification to increase the effectiveness of training and ensure employees are engaged and retain critical information, such as how to identify phishing attempts.

Explanation
The scenario describes a multi-stage attack where the key detail is how the attacker reused credentials to move laterally without needing to know the plaintext passwords.

Why D. Pass-the-hash is the Correct Answer
Pass-the-hash (PtH) is a lateral movement technique that exploits the authentication process in Windows and other systems.

How it works:
Instead of cracking passwords to get the plaintext, attackers steal the hashed version of the password from memory (RAM) on a compromised machine. These hashes are stored to facilitate single sign-on (SSO) to other network resources.

"Without cracking these credentials":
This is the definitive clue. In a PtH attack, the attacker does not need to crack the hash to reveal the password. They can simply take the stolen hash and use it directly to authenticate to other systems (e.g., file shares, remote desktop, admin tools) as the user whose hash they stole. The system accepts the hash as proof of identity.

Matching the Scenario:

Initial Access:
Gained via phishing.

Credential Access:
The attacker "scraped the PC’s memory" to find hashed credentials.

Lateral Movement:
The attacker used the stolen hashes "without cracking" them to move to other systems.

This sequence of steps is a classic example of a Pass-the-hash attack.

Why the Other Options Are Incorrect

A. Privilege escalation

What it is:
Privilege escalation is the act of exploiting a bug, design flaw, or configuration oversight to gain elevated access to resources that are normally protected from an application or user.

Why it's incorrect:
While the attacker's ultimate goal might be to escalate privileges, the specific technique described for moving laterally is not privilege escalation. Lateral movement is about expanding access to other systems at the same privilege level. PtH is a method for achieving that movement.

B. Buffer overflow

What it is:
A buffer overflow is a software vulnerability that occurs when a program writes more data to a block of memory (a buffer) than it was allocated to hold. This can corrupt data, crash the program, or allow an attacker to execute malicious code.

Why it's incorrect:
The scenario describes a post-exploitation technique using stolen credentials. There is no mention of the attacker exploiting a software vulnerability to overwrite memory. The memory is being "scraped" or read, not overflowed.

C. SQL injection

What it is:
SQL injection (SQLi) is a web application vulnerability that allows an attacker to interfere with the queries an application makes to its database. This can be used to view, modify, or delete data they shouldn't have access to.

Why it's incorrect:
The initial compromise was via phishing, not attacking a web application. The lateral movement technique involves using stolen Windows authentication hashes from memory, not injecting SQL commands into a database query.

Reference to Exam Objectives
This question aligns with the CompTIA Security+ (SY0-701) Exam Objective 1.4: Given a scenario, analyze potential indicators to determine the type of attack.

Specifically, it tests knowledge of credential access and lateral movement techniques. Pass-the-hash is a critical attack method to understand, as it highlights why protecting credential stores in memory is essential and why simply having complex passwords is not enough if hashes can be stolen.

Explanation
The question asks for the security principle whose core tenet is to verify explicitly (validate) before granting any access, including network traffic between systems.

Why C. Zero Trust Architecture is the Correct Answer
Zero Trust is a security model founded on the principle of "never trust, always verify." It assumes that no entity—whether inside or outside the network perimeter—should be trusted by default.

"Requires validation before allowing traffic":
This is the fundamental rule of Zero Trust. Under this model, every request to access a resource (including traffic between two systems on the same network) is treated as if it originates from an untrusted source. Before any communication is allowed, the system must:

Verify Identity:
Authenticate the user and device.

Validate Permissions:
Check authorization policies to ensure the request is permitted.

Assess Device Health:
Ensure the device meets security standards (e.g., is patched, has antivirus running).

This continuous validation happens regardless of the source or destination of the traffic, making it the principle that most likely requires this strict verification step.

Why the Other Options Are Incorrect

A. Policy enforcement

What it is:
Policy enforcement is the mechanism or action of applying security rules (e.g., using a firewall to block a port). It is the result of a decision, not the principle that mandates the decision-making process itself.

Why it's incorrect:
A policy could be "allow all traffic between these two systems," which requires no validation. Zero Trust is the principle that dictates the policy should be "deny all, then validate each request before allowing it."

B. Authentication

What it is:
Authentication is the process of verifying an identity (e.g., with a username and password). It is a crucial component of validation but is only one part of it.

Why it's incorrect:
Authentication alone does not necessarily happen before allowing traffic. In traditional network security models, once a user is authenticated at the network perimeter, their internal traffic is often trusted. Zero Trust is the principle that mandates authentication (and more) is required specifically for allowing traffic.

D. Confidentiality

What it is:
Confidentiality is a goal of security—ensuring that data is not disclosed to unauthorized individuals. It is often achieved through encryption.

Why it's incorrect:
Confidentiality protects the content of traffic after it is allowed to flow. It does not dictate whether the traffic should be allowed in the first place. Zero Trust is the principle that governs the decision to permit or deny the traffic flow itself.

Reference to Exam Objectives
This question aligns with the CompTIA Security+ (SY0-701) Exam Objective 3.3: Given a scenario, implement secure network designs.

Zero Trust architecture is a modern, critical secure network design principle. The exam requires you to understand that its core implementation involves micro-segmentation and strict identity and access management, which enforce validation at every step before allowing any communication.

Explanation:

Why A. Containment is the Correct Answer
The scenario states that the security analyst "identifies an incident." This means the Detection phase is complete. The immediate priority after confirming an incident is to prevent it from causing further damage.

Containment is the next logical step. The goal of containment is to isolate the affected systems to limit the scope and impact of the incident. This can involve:

Disconnecting infected machines from the network.

Blocking malicious IP addresses at the firewall.

Disabling compromised user accounts.

Redirecting traffic away from a attacked server.

This step is crucial to stop the attacker's lateral movement, prevent further data exfiltration, and stabilize the situation before moving on to more permanent solutions.

Why the Other Options Are Incorrect

B. Detection

What it is:
Detection is the phase where indicators of a potential incident are discovered and investigated to determine if a security breach has actually occurred.

Why it's incorrect:
The question explicitly states the analyst has already "identified an incident." Therefore, the Detection phase is complete, and it is not the next step.

C. Eradication
What it is:
Eradication is the phase where the root cause of the incident is removed from the affected systems. This involves actions like:

Removing malware.

Patching vulnerabilities.

Rebuilding compromised servers from clean backups.

Why it's incorrect:
Eradication is a permanent removal of the threat. It is unsafe and illogical to attempt eradication before the threat is contained. If you try to remove malware from a system while it's still connected to the network, the attacker could still have access or could re-infect the system. Containment must come first.

D. Recovery

What it is:
Recovery is the phase where systems are restored and returned to normal operational status. This involves: Restoring data from backups.

Restarting services.
Monitoring systems to ensure they are functioning normally and the threat has not returned.

Why it's incorrect:
Recovery is one of the final steps. You cannot recover a system to a known good state until after the threat has been eradicated. Attempting recovery before eradication would likely result in immediately re-introducing the vulnerability or malware.

Reference to Exam Objectives
This question aligns with the CompTIA Security+ (SY0-701) Exam Objective 4.4: Explain the key aspects of digital forensics.

The incident response process is deeply intertwined with digital forensics. The exam requires you to know the order of operations/volatility during an investigation. Containment is a priority to prevent evidence from being destroyed or altered and to prevent further damage, making it the critical step immediately after detection and analysis.

Explanation
This question tests your knowledge of a fundamental risk management formula: the Annualized Loss Expectancy (ALE). The ALE calculates the expected monetary loss from a risk per year. It allows organizations to budget for security investments and understand the financial impact of risks over time.

The formula for ALE is:
ALE = Annualized Rate of Occurrence (ARO) × Single Loss Expectancy (SLE)

Let's break down the components using the information given in the scenario:

Single Loss Expectancy (SLE):
This is the cost of a single occurrence of the risk event.

The scenario states:
"a financial impact of $15,000."

Therefore, SLE = $15,000

Annualized Rate of Occurrence (ARO):
This is the number of times you expect the risk event to happen in a single year.

The scenario states the event is "expected to occur twice within a three-year period."

To find the ARO, you divide the number of occurrences by the number of years: 2 occurrences / 3 years = 2/3 ≈ 0.666 Therefore, ARO = 2/3

Calculate the ALE:
ALE = ARO × SLE

ALE = (2/3) × $15,000

ALE = $30,000 / 3

ALE = $10,000

Why the Other Options Are Incorrect

A. $7,500:
This might be a miscalculation, perhaps by incorrectly averaging the cost ($15,000 / 2) without considering the time period correctly.

C. $15,000:
This is the Single Loss Expectancy (SLE), or the cost of one incident. It is an input to the ALE calculation, not the final result.

D. $30,000:
This is the total cost over the three-year period (2 occurrences × $15,000). However, the question asks for the Annualized Loss Expectancy, which must be expressed as a cost per year.

Reference to Exam Objectives
This question aligns with the CompTIA Security+ (SY0-701) Exam Objective 5.4: Explain the importance of risk management processes and concepts.

Understanding quantitative risk analysis, including the concepts of ALE (Annualized Loss Expectancy), SLE (Single Loss Expectancy), and ARO (Annualized Rate of Occurrence), is a critical part of the risk management process. This calculation is used to justify cybersecurity spending—a control should not cost more than the ALE of the risk it mitigates.

Explanation
The organization is dealing with a business-critical legacy system. Legacy systems often cannot be secured using modern methods (e.g., they can't be patched to current standards, may not support modern encryption, or might rely on outdated protocols).

The actions taken are:

Disabling unneeded services:
This reduces the system's attack surface by removing potential vulnerabilities.

Placing a firewall in front of it:
This controls and monitors all network traffic to and from the system, blocking unauthorized access and potentially malicious traffic.

These controls are implemented because the system itself likely lacks sufficient built-in (inherent) security controls. They compensate for the weaknesses of the legacy system, thereby reducing its risk to an acceptable level without altering the core system itself, which could be risky or impossible.

Why the Other Options Are Incorrect

A. Exception:
An exception is a formal, temporary allowance to bypass a security policy. It doesn't describe the proactive security measures (disabling services, adding a firewall) that were implemented. The organization is securing the system, not making an excuse to leave it unsecured.

B. Segmentation:
While placing a firewall in front of the system is a form of network segmentation (it isolates the system into a different network segment), this term is too narrow. It does not encompass the action of "disabling unneeded services" on the host itself. "Compensating controls" is the broader and more accurate term that includes both network-based and host-based actions taken to compensate for a lack of inherent security.

C. Risk transfer:
This involves shifting the financial burden of a risk to a third party, such as by purchasing insurance. The organization is not transferring the risk; it is actively implementing technical measures to reduce (mitigate) the risk itself.

Reference
CompTIA Security+ (SY0-701) Exam Objectives: This scenario directly aligns with Domain 5.2: Explain the importance of applicable regulations, standards, or frameworks that impact organizational security posture.

The concept of compensating controls is a fundamental principle in risk management and is featured in many frameworks. For example, the NIST Risk Management Framework (RMF) and NIST SP 800-53 discuss compensating controls as alternative measures used when a primary security control is not feasible. The actions described are classic examples of using compensating controls to manage the risk of a legacy system.

Explanation
A Virtual Machine (VM) escape attack is a specific, severe type of vulnerability in a virtualized environment. In this attack, an attacker who has achieved code execution within a guest virtual machine (VM) breaks out of the isolation provided by the hypervisor. This allows the attacker to interact directly with the host operating system or, critically, with other guest VMs running on the same host.

"Attacking a system" refers to compromising the initial guest VM.
"To access adjacent hosts" refers to breaking out of the isolated VM environment to access the host machine or other VMs on that host, which are the "adjacent" systems in this architecture.

This is considered one of the most critical vulnerabilities in cloud and virtualized data centers because it breaches the fundamental security boundary (isolation) between tenants.

Why the Other Options Are Incorrect

B. Side loading:
This is an application-based attack, typically on mobile devices, where a user is tricked into installing an unverified application from a source outside the official app store. It does not involve breaking out of an isolated environment to access other systems on the same host; it's about bypassing distribution controls.

C. Remote code execution (RCE):
This is a very broad category of vulnerability where an attacker can execute arbitrary code or commands on a target system from a remote location. While an RCE vulnerability could be the initial vector used to gain access to a VM, it does not specifically describe the action of then breaking out of that environment to access adjacent hosts. RCE is the how, not the what of the final objective (which in this case is VM escape).

D. Resource exhaustion:
This is a type of denial-of-service (DoS) attack. The goal is to consume all available system resources (like CPU, memory, or bandwidth) to make a service or system unavailable for its intended users. It does not involve gaining access to or executing code on adjacent systems; its goal is to disrupt service, not to access data.

Reference
CompTIA Security+ (SY0-701) Exam Objectives: This question falls under Domain 1.2: Explain common threat vectors and attack surfaces. Virtualization-specific threats, like VM escape, are explicitly part of the modern threat landscape that the exam covers.

The severity of VM escape vulnerabilities is a key topic in cloud security discussions and is highlighted in security advisories from major hypervisor vendors like VMware, Microsoft (Hyper-V), and Citrix (Xen).

Explanation
When a security analyst is prioritizing a large list of vulnerabilities from a scan, they need a standardized, objective, and efficient way to compare the inherent severity of one vulnerability against another. The Common Vulnerability Scoring System (CVSS) provides a framework for doing exactly that.

Efficiency:
CVSS scores are typically provided automatically by vulnerability scanning tools. The analyst doesn't have to calculate them manually for each finding. The score (ranging from 0.0 to 10.0) allows for immediate, at-a-glance prioritization. A critical vulnerability with a CVSS score of 9.8 can be immediately identified as a higher priority to patch than one with a score of 4.3.

Risk-Based Approach:
While CVSS measures severity (based on exploitability and impact), severity is the primary technical input for calculating risk. It provides a consistent and common language for the initial triage of vulnerabilities before layering on organizational context.

Why the Other Options Are Incorrect

A. Business Impact Analysis (BIA):
A BIA is a high-level process that identifies and evaluates the potential effects of disruptions to critical business operations. It is not an efficient tool for prioritizing individual technical vulnerabilities. Its output is too broad (e.g., "the e-commerce server is a critical asset") and not granular enough to decide which specific CVE on that server to patch first.

C. Risk Register:
A risk register is a repository of identified risks, often with their assessed level of risk and mitigation plans. It is an output of the risk management process, not an efficient input for the initial technical prioritization of raw vulnerability scan results. The analyst would add the highest-priority vulnerabilities to the risk register after assessment.

D. Exposure Factor (EF):
Exposure Factor is a component of the quantitative risk calculation formula (Single Loss Expectancy = Asset Value x Exposure Factor). It represents the percentage of loss a realized threat would have on a specific asset. Like the BIA, it is a high-level business metric that is not efficiently applied to the initial prioritization of a long list of technical vulnerabilities. Calculating SLE for every vulnerability in a scan would be incredibly time-consuming and inefficient.

Reference
CompTIA Security+ (SY0-701) Exam Objectives: This question falls under Domain 1.5: Explain vulnerability management activities and tools.

The objectives specifically mention the importance of "Prioritization of vulnerabilities based on CVSS" as a key activity. CVSS is the industry standard for scoring vulnerabilities, making it the most efficient starting point for any risk-based prioritization effort.

FIRST.org: The Forum of Incident Response and Security Teams (FIRST) is the official maintainer of the CVSS standard, which underscores its role as a critical resource for security professionals.