Free CompTIA SY0-701 Practice Questions 2026 - Page 35

Explanation
Data is categorized into three primary states, each requiring specific security controls:

Data at rest:
Data stored on a medium (e.g., on a hard drive, in a database file, on a USB drive). It is typically protected by encryption (e.g., full-disk encryption).

Data in transit (or in motion):
Data actively moving between systems across a network (e.g., from a web server to a user's browser). It is typically protected by encryption protocols (e.g., TLS/SSL).

Data in use:
Data that is being actively processed by a computer's CPU or memory. This includes data being created, retrieved, updated, or deleted by an application.

When a database server is actively processing a query (e.g., performing calculations, sorting records, updating values), the relevant data is loaded from storage (at rest) into the server's memory (RAM) and registers for processing. This state is the very definition of "in use."

Why the Other Options Are Incorrect

B. At rest:
This describes the data when it is stored on the database server's disk. The moment the server reads it from the disk to process it, the state changes from "at rest" to "in use."

C. In transit:
This would apply to data moving to or from the database server over a network. For example, a query sent from a web application to the database or the results sent back are "in transit." However, the question specifies the data is "being actively processed by" the server itself, which happens internally after the data has been received.

D. Being hashed:
Hashing is a specific type of processing. Therefore, data that is "being hashed" is a subset of data that is "in use." The question asks for the general data state, and "in use" is the broader, correct category that encompasses all forms of active processing, including hashing, encrypting, compiling, or calculating.

Reference
CompTIA Security+ (SY0-701) Exam Objectives: Understanding data states is a fundamental concept covered under various domains, most notably Domain 4.3: Explain data security and privacy concepts. The objectives emphasize applying appropriate security controls to data based on its state (at rest, in transit, in use).

This classification is a core principle in cybersecurity frameworks from NIST (National Institute of Standards and Technology), which guides the selection of security controls for protecting information and information systems.

Explanation
A SQL injection attack occurs when a threat actor inserts malicious SQL code into input fields of a web application (like a login form or search bar). The application, failing to properly validate or sanitize this input, forwards the malicious code to the underlying database server.

The application log is the most direct source to identify the exact command used because:

It typically records the specific queries and requests made to the application.

For a web application, this would include the raw HTTP requests, which contain the parameters and input values sent by the user (the threat actor).

The malicious SQL snippet is often visible within these request parameters (e.g., in a POST body or a GET query string).

Reviewing the application log allows the forensic engineer to see the precise malicious input that triggered the compromise.

Why the Other Options Are Incorrect

A. Metadata:
Metadata is "data about data," such as file creation dates, author, or modification timestamps. While crucial in other forensic investigations (e.g., determining when a file was exfiltrated), it does not contain the contents of user requests or database queries. It cannot reveal the specific SQL command used in the attack.

C. System log:
System logs (e.g., Windows Event Logs or Linux syslog) record operating system events, such as user logins, service failures, and driver issues. While they might show that a service like a database server crashed or had high CPU usage (an effect of the attack), they do not record the specific application-level SQL query that was executed.

D. Netflow log:
Netflow (or similar data like sFlow or IPFIX) provides metadata about network traffic. It records information like source/destination IP addresses, ports, protocols, and the volume of data transferred. It could show a connection from the threat actor to the application server, but it does not capture the actual content or payload of the communication. It can show that communication happened, but not what was said—it cannot reveal the specific SQL command.

Reference

CompTIA Security+ (SY0-701) Exam Objectives:
This question falls under Domain 4.4: Given a scenario, analyze potential indicators of malicious activity. A key part of analysis is reviewing the correct log source to find evidence of a specific attack.

Digital Forensics and Incident Response (DFIR):
A core principle in forensics is identifying the right source of evidence. For application-layer attacks like SQL injection, cross-site scripting (XSS), or command injection, the application server logs are always the primary source for the initial malicious payload. This is a standard practice outlined in guides from organizations like NIST (SP 800-86) and the SANS Institute.

Explanation
The question states the need for "additional data about the executable running on the machine." This is a clear request for endpoint-level data.

Endpoint logs are generated by software running directly on the device (the laptop itself). This includes:

Operating System Logs:
Such as Windows Event Logs (e.g., Security, System, Application logs) that record process creation, authentication events, and service activity.

Endpoint Detection and Response (EDR) / Antivirus (AV) Logs:
These are specifically designed to provide deep visibility into processes, executable files, hashes, network connections made by processes, and parent/child process relationships.

This data is essential for investigating what a specific executable is doing, when it started, who launched it, and what other system changes it made.

Why the Other Options Are Incorrect

A. Application:
Application logs record events related to a specific software application (e.g., a web server, a database). They are useful for detecting application-level attacks like SQL injection but do not provide system-wide visibility into all executables running on an endpoint. They are too narrow for this request.

B. IPS/IDS:
Intrusion Prevention/Detection System logs alert on malicious network patterns or known attack signatures. They are excellent for identifying that malicious traffic exists (which is what started this investigation) but do not provide details about the specific executable on the endpoint that is generating that traffic. They see the symptom (bad traffic) but not the source (the process).

C. Network:
Network logs (e.g., NetFlow, PCAP, firewall logs) provide information about communication between devices—source/destination IPs, ports, protocols, and volume. Like IPS/IDS, they are critical for detecting the malicious traffic but cannot see inside the endpoint to identify the exact executable responsible for generating that traffic.

Reference
CompTIA Security+ (SY0-701) Exam Objectives: This question aligns with Domain 4.3: Given a scenario, analyze data using the appropriate tool. The objectives emphasize using the right tool for the job, specifically:

Endpoint analysis is performed with tools like EDR, which provide process monitoring, hashing, and asset management data. Network analysis is performed with tools like a SIEM’s network module, NGFW logs, and packet captures.

The key is to match the data source (endpoint) to the investigative need (information about a running executable).

Explanation
Quarantining a system in cybersecurity means isolating it to prevent a potential threat from spreading to other network resources. The goal is to contain the system while preserving its state for further investigation (forensics). Moving the device into an air-gapped environment is the most effective form of quarantine. This involves physically or logically disconnecting the device from all networks (wired, wireless, Bluetooth). This action:

Contains the Threat:
Prevents the malware from communicating with its command-and-control (C2) server or spreading laterally to other systems on the network.

Preserves Evidence:
Keeps the system's memory and disk state intact for malware analysis and forensic investigation.

Allows for Safe Analysis:
The system can then be analyzed in a controlled, isolated lab environment without risk to the production network.

Why the Other Options Are Incorrect

B. Disable remote log-in through Group Policy:
While this might seem like a containment action, it is slow, unreliable, and incomplete for quarantine.

Slow:
Group Policy updates are not instantaneous.

Unreliable:
If the system is already compromised, malware may interfere with Group Policy processing

Incomplete:
This only blocks one specific access method (remote login). The infected system would still be connected to the network, allowing the malware to continue spreading or communicating externally.

C. Convert the device into a sandbox:
A sandbox is an isolated testing environment used to analyze suspicious software. You do not "convert" a production machine into a sandbox; you would move a suspicious file into a pre-existing sandbox environment. This action is an analysis step that would happen after the infected system has been quarantined and the malware sample has been extracted.

D. Remote wipe the device using the MDM platform:
This is a destructive action of last resort, not a quarantine action. A remote wipe erases all data on the device.

Destroys Evidence:
It eliminates any possibility of performing forensic analysis to determine the root cause, extent of the infection, or data that was exfiltrated.

Not a Containment Tactic:
Wiping is a recovery action, not a containment action. It is typically used for lost or stolen devices to protect data confidentiality, not for infected devices on the corporate network that need to be investigated.

Reference
CompTIA Security+ (SY0-701) Exam Objectives: This scenario falls under Domain 4.2: Explain the importance of policies and processes for incident response. A key phase of the incident response process (e.g., NIST SP 800-61) is Containment. The objectives cover appropriate containment strategies, such as isolation and segmentation, to prevent an incident from causing further damage.

Explanation
The key constraint in the question is performing a risk assessment "without using proprietary company information." This means the administrator cannot use internal data, scan internal systems, or access confidential company resources.

Open-source intelligence (OSINT) is the collection and analysis of information that is publicly available. This includes data from:

Public websites and social media

News articles and press releases

Government databases (e.g., SEC filings)

Publicly accessible technical information (e.g., domain name registration details, certificates)

Threat intelligence feeds that discuss general vulnerabilities and threat actor tactics

Using OSINT, an administrator can identify potential threats, threat actors, and vulnerabilities that could target their industry or technology stack—all without ever touching an internal company system or using proprietary data.

Why the Other Options Are Incorrect

A. Network scanning:
This involves actively probing the company's internal network to discover devices, services, and vulnerabilities. This directly uses and interacts with proprietary company information (internal IP addresses, system configurations) and is therefore not permitted under the question's constraint.

B. Penetration testing:
This is an authorized simulated attack on company systems to evaluate security. It requires actively exploiting vulnerabilities in proprietary systems, making it the opposite of what the question asks for.

D. Configuration auditing:
This involves reviewing the security settings and configurations of internal systems, servers, and applications against a baseline or standard. This process requires direct access to proprietary company systems and their configuration data, which is explicitly ruled out.

Reference
CompTIA Security+ (SY0-701) Exam Objectives: This question aligns with Domain 5.3: Explain the processes for performing third-party risk assessment and management.

When assessing the risk posed by a vendor or partner, an organization will often start with OSINT gathering to understand the vendor's public footprint, history of security incidents, and overall reputation before requesting proprietary information. OSINT is a fundamental tool in the initial stages of external risk assessment.

Explanation
COPE (Corporate-Owned, Personally Enabled) is a mobile device management model where the organization purchases and issues the device to the employee. The employee is allowed to use the device for personal activities (email, apps, web browsing) in addition to work.

Because the device is corporate-owned and contains both corporate and personal data, the organization's policy must focus on protecting corporate data and assets while allowing some personal use.

The two most critical security controls for any corporate-owned device are:

B. Data Encryption:
This ensures that if the device is lost or stolen, the data stored on it is unreadable without the proper credentials. This protects both corporate and personal information from unauthorized access and is a fundamental security requirement.

A. Remote Wiping of the Device:
This is a crucial administrative control. If a COPE device is lost, stolen, or the employee is terminated, the organization must have the ability to remotely erase the device to prevent unauthorized data access. This primarily protects corporate data but also serves to protect the former employee's personal data from falling into the wrong hands.

Why the Other Options Are Incorrect

C. Requiring passwords with eight characters:
While password requirements are important, specifying an exact length like "eight characters" is a weak and outdated practice. Modern policies enforce complexity and minimum length (e.g., 12+ characters) rather than a specific short count. Furthermore, this is a single example of a security control, but the question asks for the best inclusions, and encryption and remote wipe are more comprehensive and critical.

D. Data usage caps:
This is a cost-control measure for cellular data plans, not a core security control for protecting data on the device itself. It is related to telecom expense management, not MDM security policy.

E. Employee data ownership:
This is a legal and HR concept, not a technical security control. In a COPE model, the device is owned by the company. The policy will define the boundaries between corporate data and personal data, but "employee data ownership" is not something "included" in the MDM policy; it's a principle that the policy is built around.

F. Personal application store access:
A key feature of COPE is that it allows personal use. Therefore, restricting personal application store access would contradict the "Personally Enabled" aspect of COPE. The policy would focus on ensuring security (e.g., by vetching apps for malware) rather than outright blocking access to personal stores.

Reference
CompTIA Security+ (SY0-701) Exam Objectives: This falls under Domain 3.5: Explain the importance of mobile device management (MDM) and mobility management concepts.

The objectives specifically differentiate between deployment models like COPE, BYOD (Bring Your Own Device), and CYOD (Choose Your Own Device).

Explanation
Data can be in one of three states: at rest, in transit, or in use. Data in transit (also called data in motion) is data actively moving from one location to another, such as across the internet or through a private network.

Encryption (A) is the primary and most often used method to protect data in transit. It uses cryptographic algorithms to transform readable data (plaintext) into an unreadable, scrambled format (ciphertext) during transmission. Only authorized parties with the correct decryption key can convert it back to plaintext. Common protocols like TLS (Transport Layer Security) for web traffic (HTTPS), SSH for secure remote access, and IPsec for VPNs all use encryption to secure data in transit against eavesdropping and man-in-the-middle attacks.

Why the other options are incorrect:

B. Obfuscation:
Obfuscation is the process of making data difficult to understand to deter reverse engineering, but it does not use a cryptographic key for security. It is easily reversible and is not considered a secure method for protecting sensitive data during transmission. It is more commonly used to hide code or data structures, not to secure communications.

C. Permission Restrictions:
Permission restrictions (or access controls) are crucial for protecting data at rest and in use. They dictate who or what can access data stored on a system. However, they do not inherently protect the data itself as it travels across a network between the source and the authorized destination. Once data is in transit, permissions are no longer the primary defense.

D. Hashing:
Hashing is a one-way cryptographic function that generates a unique fixed-size string (a hash) from data. It is primarily used to verify the integrity of data (e.g., ensuring a file was not altered in transit). However, it does not provide confidentiality. The original data is not hidden; if intercepted, the data is still fully readable. Therefore, hashing alone is not used to protect the data itself during transmission.

Reference
CompTIA Security+ SY0-701 Objective 4.1: Explain the importance of security concepts in an enterprise environment. The objective specifically lists "Data in transit" as a key concept, and encryption is the prescribed control for ensuring its confidentiality.

Explanation
The question states that the penetration tester gained unauthorized access to the hypervisor platform itself. The hypervisor is the underlying software, firmware, or hardware that creates and runs virtual machines (VMs). It is the host system that manages all guest VMs.

VM Escape (D) is a specific, severe vulnerability where an attacker breaks out of the isolated environment of a virtual machine (the guest) and gains unauthorized access to the hypervisor (the host) or other VMs on the same host. This directly aligns with the scenario described, as compromising the hypervisor gives an attacker control over all the resources and VMs it manages. This is a classic hypervisor-level compromise.

Why the other options are incorrect:

A. Cross-site scripting (XSS):
XSS is a vulnerability typically found in web applications. It allows an attacker to inject malicious scripts into content viewed by other users. It is not a vulnerability that would be used to compromise a hypervisor's core platform.

B. SQL injection (SQLi):
SQLi is a vulnerability that exploits improper input sanitization in applications that interact with a database. An attacker can manipulate SQL queries to view, modify, or delete database data. Like XSS, it is an application-layer attack and is not a typical vector for attacking a hypervisor's management system (unless that management system is itself a vulnerable web app, which is not the most likely exploit path for hypervisor access).

C. Race condition:
A race condition is a vulnerability where a system's output is dependent on the sequence or timing of uncontrollable events. Exploiting it (e.g., Time of Check to Time of Use - TOCTOU) can lead to privilege escalation or unauthorized actions. While a race condition could potentially exist in hypervisor software, it is a generic software flaw type and not the most specific or likely answer for a direct hypervisor compromise compared to VM escape.

Reference
CompTIA Security+ SY0-701 Objective 3.2: Explain concepts related to vulnerability management.

Understanding specific vulnerability types, like those associated with virtualization (VM escape), is key to vulnerability management.

CompTIA Security+ SY0-701 Objective 2.2: Explain the security implications of embedded and specialized systems.

Virtualization technologies are considered a type of specialized system. The hypervisor is a critical component, and VM escape is a paramount threat to its security model, which is based on isolating guest VMs from the host and from each other. A successful VM escape attack breaches this fundamental isolation.

Explanation
Sideloading is the process of installing an application on a mobile device (or sometimes other systems) without using the official, sanctioned app store (like the Apple App Store or Google Play Store). This often involves enabling "Unknown Sources" or using developer tools.

The primary security risk of sideloading is that the application does not undergo the security vetting and code review typically performed by the official app store. This allows malicious code to be easily introduced onto the device. Rootkit (B) is the most likely threat to be introduced via sideloading. A malicious actor can embed a rootkit within a seemingly legitimate application offered for download on a third-party website. Once the user sideloads and installs this app, the rootkit can gain privileged (root-level) access to the operating system, hide its presence, and create a persistent backdoor on the device. Sideloading is a common distribution vector for such deep-system malware.

Why the other options are incorrect:

A. User Impersonation:
User impersonation is a social engineering or identity theft technique where an attacker pretends to be another user. It is not a piece of malware or code that can be "introduced" or packaged inside an application. It is an action performed by an attacker, not a payload delivered via an app.

C. On-path Attack:
An on-path (or man-in-the-middle) attack is a network-based attack where an attacker intercepts or alters communication between two parties. It is not a software payload or malware that is contained within an application. It is an attack methodology that occurs during data transmission, not at the time of application installation.

D. Buffer Overflow:
A buffer overflow is a specific software vulnerability or coding error. While a malicious sideloaded app could exploit a buffer overflow vulnerability present on the device, the buffer overflow itself is not the thing being "introduced." The thing being introduced is the malicious app or its payload (e.g., a rootkit) that then takes advantage of the existing flaw.

Reference
CompTIA Security+ SY0-701 Objective 2.3: Explain the importance of secure development practices and controls.

This objective covers application security risks, including those from unvetted application sources. Sideloading bypasses the secure development and review controls enforced by official stores.

Mobile Device Management (MDM) / Application Management: A core security practice is to restrict sideloading on corporate devices precisely to prevent the introduction of malware like rootkits, spyware, and trojans that can compromise the entire device and corporate network.

Explanation
The process described involves determining the importance, sensitivity, and regulatory requirements of a file to assign it an appropriate label (e.g., Public, Internal, Confidential, Restricted).

Classification (C) is the exact process of categorizing data based on its value, sensitivity, and regulatory requirements to apply appropriate security controls, including labels. These labels then dictate how the data should be handled, stored, and transmitted.

Why the other options are incorrect:

A. Verification:
Verification is the process of confirming that something is true, accurate, or justified. For example, verifying a user's identity or verifying that a control is functioning correctly. It is not the process of initially selecting a category or label.

B. Certification:
Certification is a formal process where an authoritative body validates that a system, product, or process meets a specific set of standards. For example, a system may be certified against the ISO 27001 standard. It is a high-level assurance activity, not the granular process of labeling individual files.

D. Inventory:
Inventory is the process of creating a list or catalog of assets. A data inventory would list what data an organization has and where it is stored. While classification often relies on an inventory to know what data exists, the act of selecting a label for each data set based on its properties is classification itself.

Reference
CompTIA Security+ SY0-701 Objective 5.1: Explain the importance of data protection.

Data Classification is a fundamental concept under this objective. It is the first and most critical step in data protection, as it ensures that security controls (like encryption, access permissions, and retention policies) are applied appropriately based on the data's sensitivity level.