Free CompTIA SY0-701 Practice Questions 2026 - Page 5

Explanation
To answer this, we need to understand the two common ways security controls are classified:

Control Type (Category):
This describes what the control is. The main categories are Technical, Managerial, and Physical.

Control Function:
This describes what the control does. The main functions are Preventative, Detective, Corrective, Deterrent, and Compensating.

Let's analyze the two security measures being implemented:

1. Multi-Factor Authentication (MFA)

What it is:
A technical system that requires a user to provide two or more verification factors to gain access to a resource.

Control Category (What it is):
MFA is implemented through software, hardware, or protocols. Therefore, it is a Technical control.

Control Function (What it does):
The primary purpose of MFA is to stop unauthorized access before it happens. It prevents an attacker from gaining access even if they have a username and password. Therefore, its function is Preventative.

2. Patch Management

What it is:
The process of acquiring, testing, and installing patches (code changes) on systems to fix vulnerabilities.

Control Category (What it is):
While the policy that mandates patching is a Managerial control, the act of implementing the patches involves deploying software updates to systems, servers, and applications. This is a hands-on, technical process. Therefore, the implementation is a Technical control.

Control Function (What it does):
The primary purpose of patching is to fix known software vulnerabilities. By fixing these holes, it prevents attackers from being able to exploit them. Therefore, its function is Preventative.

Why the Other Options Are Incorrect

A. Physical:
Physical controls are tangible, real-world objects like fences, locks, security guards, and CCTV cameras. Neither MFA nor patch management are physical items; they are digital processes.

B. Managerial:
Managerial controls are administrative in nature. They are the policies, procedures, and guidelines that govern how security is implemented. The policy requiring MFA or a patching schedule would be managerial. However, the question specifies the security manager is "implementing" them, which is the technical execution of those policies.

C. Detective:
Detective controls are designed to identify and alert on security events as they are happening or after they have occurred. Examples include intrusion detection systems (IDS) and log monitoring. MFA and patching do not detect incidents; they work to stop them from happening in the first place.

D. Administrator:
This is a distractor. "Administrator" is a job role, not a standard category or function for classifying security controls.

Reference to Exam Objectives
This question aligns with the CompTIA Security+ (SY0-701) Exam Objective 5.1: Explain the importance of security concepts in an enterprise environment.

A core security concept is understanding and applying security controls. You must be able to classify controls by their type (Technical, Managerial, Physical) and by their function (Preventative, Detective, Corrective, etc.). MFA and patch management are two of the most critical technical, preventative controls in any security program.

Explanation
An Intrusion Prevention System (IPS) is a network security technology that examines network traffic to identify and respond to malicious activity. A key feature that distinguishes it from its cousin, the Intrusion Detection System (IDS), is its ability to actively block threats.

Why D. Active is the Correct Answer
The question explicitly states the goal is to "block" signature-based attacks. This requires a mode of operation where the IPS can take automated, corrective action.

Active Mode:
In this mode, the IPS is placed inline with the network traffic (meaning all traffic must pass through it). When it detects a packet that matches the signature of a known attack (like a specific exploit or malware), it can immediately take actions to block the threat. These actions include:

Dropping the malicious packets.

Resetting the connection (sending a TCP RST packet to both ends).

Blocking all future traffic from the offending source IP address for a period of time.

"Best Accomplish This Task":
Because the requirement is to block attacks, the Active mode is the only one designed to perform this function automatically and in real-time.

Why the Other Options Are Incorrect

A. Monitor

What it is:
Monitor mode is typically used by an Intrusion Detection System (IDS). The sensor is connected to a network port configured for port mirroring (SPAN) and sees a copy of all traffic. It analyzes this traffic and generates alerts for suspicious activity.

Why it's incorrect:
An IDS in monitor mode is a passive, detective control. It "monitors" and "alerts" but does not block traffic. It cannot stop an attack; it can only tell you that one is happening. This does not meet the requirement to "block."

B. Sensor

What it is:
A "sensor" is not an operational mode; it is the physical or virtual appliance itself that performs the monitoring or prevention. You install a sensor and then configure it to operate in a specific mode (e.g., Active or Monitor).

Why it's incorrect:
This is a distractor. The question asks for the mode the sensor should be configured for, not what is being installed.

C. Audit

What it is:
Audit mode is similar to monitor mode. It is a passive mode where the IPS/IDS records events and generates alerts for later analysis and auditing. Its primary function is logging and alerting, not blocking.

Why it's incorrect:
Like monitor mode, audit mode is passive. It might write to a log or send an email to a security analyst, but it will not actively block the malicious traffic. It does not fulfill the requirement to "block."

Reference to Exam Objectives
This question aligns with the CompTIA Security+ (SY0-701) Exam Objective 3.2: Given a scenario, implement secure network designs.

Part of secure network design is understanding the placement and function of security appliances like firewalls, IPS, and IDS. A key distinction is between preventative controls (IPS in Active mode) and detective controls (IDS in Monitor/Audit mode). The exam requires you to know that an IPS must be inline and in an Active mode to block threats.

Explanation
This question tests your understanding of security alert fatigue and the real-world implications of different types of alerts generated by security systems like IDS, IPS, or SIEM.

Let's first define the terms:

True Positive:
A legitimate attack that is correctly detected and alerted. (Good)

True Negative:
Normal, legitimate activity that is correctly ignored. (Good)

False Positive:
Normal, legitimate activity that is incorrectly flagged as an attack. (Bad)

False Negative:
A legitimate attack that is not detected. (Very Bad)

Why C. False Positive is the Correct Answer
False positives are the primary cause of alert fatigue.

What is Alert Fatigue?
This is a phenomenon where security analysts become desensitized to security alerts due to the high volume of notifications, many of which turn out to be harmless.

Why False Positives Cause It:
When a security tool constantly generates alerts for benign activity (e.g., alerting on a user's legitimate remote login, flagging a safe application as malware), analysts waste time and resources investigating non-issues.

The Result of Alert Fatigue:
Over time, analysts begin to subconsciously assume that new alerts are also false alarms. This leads to them: Prioritizing alerts lower.

Investigating them more slowly.

Ignoring them altogether.

The Ultimate Danger:
This complacency creates an environment where a true positive (an actual attack) could easily be missed because it looks identical to the hundreds of false positives that came before it.

Why the Other Options Are Incorrect

A. True positive
A true positive is a correctly identified attack. This is what security teams are paid to find. Analysts will not ignore a confirmed attack; they will investigate and remediate it. These alerts validate the purpose of the security team.

B. True negative
This is normal activity that the system correctly does not generate an alert for. Since no alert is produced, there is nothing for an analyst to see or ignore. This is the ideal, silent operation of a well-tuned system.

D. False negative
A false negative is the most dangerous type of alert failure, but it is not "ignored" by analysts—it is completely unseen. The security system failed to generate any alert at all, so the analyst has no opportunity to investigate or ignore it. The attack proceeds undetected.

Reference to Exam Objectives
This question aligns with the CompTIA Security+ (SY0-701) Exam Objective 4.3: Given an incident, implement appropriate response.

A key part of incident response is the analysis phase. Alert fatigue, caused predominantly by false positives, directly hinders effective analysis. The exam expects you to understand the operational challenges of managing security tools and the importance of tuning them (adjusting rules and sensitivity) to reduce false positives and make the alert queue manageable and actionable.

Explanation
Expanding a cloud business internationally is a complex legal and operational undertaking. While all the options are important considerations, one is a fundamental prerequisite that governs all others and carries significant legal and financial consequences if not addressed first.

Why A. Local Data Protection Regulations is the Correct Answer
Data sovereignty and data protection laws are the most critical and immediate concerns when establishing a physical data center presence in a new country.

Legal Compliance:
Every country (and sometimes regions within countries) has its own unique set of laws governing how data must be stored, processed, and protected. The most famous example is the European Union's General Data Protection Regulation (GDPR), which imposes strict rules on data transfer outside the EU and severe fines for non-compliance. Other countries have similar regulations (e.g., Brazil's LGPD, China's PIPL).

Impact on Business Model:
These regulations can dictate:

Where data can be stored:
Some countries mandate that certain types of data (e.g., citizen data, financial records, government data) must reside on servers physically located within the country's borders.

How data can be transferred:
Regulations may prohibit or restrict moving data out of the country.

Data subject rights:
Laws grant individuals specific rights (e.g., right to be forgotten, right to access) that the provider must be able to operationally support.

First Consideration:
Understanding these local laws is the first and most important step because they will determine:

If the provider can even offer services in that location.

What architectural and security controls must be in place from the start.

Who they can sell to and what data they can handle.
Failure to consider this first can lead to massive fines, legal battles, and an inability to operate in that market.

Why the Other Options Are Incorrect (or Secondary)

B. Risks from hackers residing in other countries
This is a general cybersecurity threat that exists everywhere. While the threat landscape may vary by region, it is a constant. The provider will need to implement a robust security framework regardless of location. This is an operational security concern that is addressed after the legal and regulatory framework is established.

C. Impacts to existing contractual obligations
This is a very important secondary consideration. The provider must review existing Service Level Agreements (SLAs) and contracts to ensure that moving data or services to a new international location doesn't violate terms promised to current customers (e.g., regarding data jurisdiction, performance, or availability). However, you cannot even begin to assess this impact until you first understand the local regulations that will shape your new offerings.

D. Time zone differences in log correlation
This is an operational and technical challenge for the Security Operations Center (SOC). While correlating logs across multiple time zones requires careful planning and tool configuration, it is a solvable engineering problem. It is a tactical concern that is addressed long after the strategic legal and business decisions have been made.

Reference to Exam Objectives
This question aligns with the CompTIA Security+ (SY0-701) Exam Objective 5.3: Explain the importance of policies to organizational security.

This objective covers compliance and legal considerations. Understanding the impact of jurisdictional laws and regulations on data is a fundamental aspect of organizational security policy. A company's security policies must be designed to ensure compliance with all applicable local laws, making this the paramount concern when expanding internationally.

Explanation
The company's development model introduces a specific challenge: it does not have full control over the entire codebase it uses. It depends on external, third-party open-source libraries. The difficulty in remediating a vulnerability depends heavily on where that vulnerability exists and who is responsible for fixing it.

Why D. Zero Day is the Correct Answer
A Zero-day vulnerability is a flaw in software that is unknown to the vendor or developer who should be mitigating it. There are "zero days" of advance warning or time to prepare a patch.

Why it's the most difficult to remediate in this scenario:

Dependency on Upstream Fix:
If a zero-day is discovered in one of the open-source libraries the company uses, the company is completely dependent on the external maintainers of that library to:

Become aware of the issue.

Develop a patch.

Release a fixed version.

No Control Over Timeline:
The company has no control over how quickly this happens. The library maintainers might be volunteers with limited time, or the vulnerability might be complex and require a long time to fix properly.

Immediate Exploitation Risk:
Once the zero-day becomes public knowledge (or is discovered by attackers), it can be exploited immediately. During the window of time between public disclosure and the library maintainers releasing a patch, the company's software is critically vulnerable, and there is absolutely nothing the company's developers can do to fix the root cause themselves. They are forced to wait, making remediation extremely difficult.

This lack of control and the unpredictable timeline for an external fix make a zero-day in a dependency the most difficult scenario to remediate.

Why the Other Options Are Incorrect

A. Buffer overflow, B. SQL injection, C. Cross-site scripting
These are all common vulnerability types (e.g., CWE-120, CWE-89, CWE-79). The key differentiator is that these are typically introduced by the company's own developers in the custom code they write.

Why they are easier to remediate:
Because the vulnerability exists in code the company controls, its developers can:

Immediately diagnose the problem.

Write a patch.

Test the fix.

Deploy an update to their software.
The remediation timeline is entirely within the company's control. They don't have to wait for an external party. While fixing any bug takes effort, the process is straightforward and manageable compared to the helpless waiting involved in a third-party zero-day scenario.

Reference to Exam Objectives
This question aligns with the CompTIA Security+ (SY0-701) Exam Objective 1.5: Explain different threat actors, vectors, and intelligence sources.

Zero-day vulnerabilities are a premier threat vector. The exam requires you to understand the unique challenge they pose, especially in modern software development which heavily relies on software supply chains (like open-source libraries). Managing this risk involves processes like Software Composition Analysis (SCA) to inventory dependencies and vigilant monitoring of sources for new vulnerability disclosures.

Explanation:
A "spoofed identity" in the context of a digital certificate means an attacker has created a certificate that fraudulently claims to represent a legitimate domain or entity (e.g., yourcompany.com).

C. Private key and self-signed certificate is correct.
This is the most likely scenario for a spoofed identity.

Self-Signed Certificate:
Anyone can create a self-signed certificate for any domain name without any validation or approval from a Certificate Authority (CA). This makes it trivial for an attacker to generate a certificate that spoofs a company's identity.

Private Key:
The attacker would possess the private key that corresponds to the public key in the fraudulent, self-signed certificate. This allows them to complete the TLS handshake and make the spoofed certificate appear valid to a user's browser, which would then display a trust error (as it's not signed by a trusted CA).

A. Private key and root certificate is incorrect.
A root certificate is the top-most, highly protected certificate in a PKI hierarchy that belongs to a trusted Certificate Authority (CA). If an attacker had the private key for a legitimate root certificate, they could sign any certificate and it would be trusted by every browser and operating system. This is called a "compromised CA" and is an extremely severe, but much rarer, event than simple self-signed certificate spoofing.

B. Public key and expired certificate is incorrect.
The public key is not a secret; it is designed to be publicly shared. An expired certificate would cause a browser warning but would not inherently indicate a spoofed identity—it would just be an old, legitimate certificate.

D. Public key and wildcard certificate is incorrect.
A wildcard certificate (e.g., for *.yourcompany.com) is a legitimate type of certificate issued by a trusted CA. Like Option B, the public key is not secret. While an attacker might try to steal the private key for a wildcard certificate, the certificate itself is not inherently spoofed; it's a valid certificate that has been misused.

Reference:
CompTIA Security+ SY0-701 Objective 3.9: "Explain public key infrastructure (PKI) concepts." This objective covers certificate types (like root, wildcard, and self-signed), the role of public/private keys, and common certificate issues, which include trust errors and identity spoofing.

Explanation:
Secure configuration guide (D) is the correct answer. A secure configuration guide (or baseline) is a set of detailed, step-by-step instructions and settings designed to harden a system against attacks. It provides a standardized, secure starting point for deploying new devices (like servers). This is exactly what the security analyst is creating for the server team to follow.

Why the others are incorrect:

A) Change management procedure:
This is a process that governs how changes are proposed, approved, tested, and implemented in an IT environment. It is a procedural workflow to prevent disruptions, not a technical document with specific security settings for hardening a new device.

B) Information security policy:
This is a high-level management document that outlines the organization's overall security goals, roles, and responsibilities. It sets the "what" and "why" for security but does not provide the low-level, technical "how" for hardening a specific server OS or application.

C) Cybersecurity framework:
A framework (like NIST CSF or ISO 27001) provides a broad structure of best practices, standards, and guidelines for managing an organization's cybersecurity risk. It is a strategic tool, not a tactical, technical document for system hardening.

Reference:
This question tests knowledge of Domain 5.4: Explain the importance of personnel management and security awareness training and Domain 3.2: Given a scenario, implement security hardening strategies. Creating a secure configuration guide is a fundamental step in the hardening process, ensuring consistency and security across all new deployments. These guides are often based on industry benchmarks from organizations like CIS (Center for Internet Security).

Explanation:

C) Password, authentication token, thumbprint is the correct answer. This option perfectly aligns with the three factors of authentication:

Something you know:
Password (a secret only the user should know).

Something you have:
Authentication token (a physical device like a hardware token or a software-generated code, such as from an authenticator app).

Something you are:
Thumbprint (a biometric factor, unique to the individual)

This combination provides strong multifactor authentication (MFA) for securing VPN access.

Why the others are incorrect:

A) Domain name, PKI, GeoIP lookup:
- Domain name is public information (not something you know secretly).

- PKI (Public Key Infrastructure) is a technology framework, not an authentication factor.

- GeoIP lookup is a location-based check, which is not a standard MFA factor (it might be used for risk-based authentication but doesn't fit the classic three factors).

B) VPN IP address, company ID, facial structure:
- VPN IP address is public or assigned information (not a secret).

- Company ID is something you have, but facial structure (something you are) is valid. However, the first factor (IP address) is not "something you know."

D) Company URL, TLS certificate, home address:
- Company URL is public information.

- TLS certificate is a cryptographic entity (not something you have in the typical MFA sense).

- Home address is public information (not biometric).

Reference:
This question tests knowledge of Domain 2.4: Explain authentication and authorization controls and Domain 3.6: Given a scenario, implement authentication and authorization solutions. Multifactor authentication (MFA) is a core security principle, and the SY0-701 objectives emphasize the use of multiple factors (knowledge, possession, inherence) to enhance security for remote access solutions like VPNs.

Explanation:
Detective controls are designed to identify and detect security incidents after they have occurred. Reviewing log files is a classic example of a detective control. It allows administrators to investigate past events, understand the scope of an incident (like a ransomware attack), and gather evidence for analysis and response.

Why not A?
Compensating: Compensating controls are alternative measures put in place when primary controls are not feasible or effective. They are proactive rather than reactive. For example, if encryption isn't possible, strict access controls might compensate. Log review doesn't compensate for a lack of other controls; it detects breaches.

Why not C?
Preventive: Preventive controls aim to stop security incidents from happening in the first place. Examples include firewalls, access controls, and encryption. Reviewing logs after an attack does not prevent the attack; it helps discover what already happened.

Why not D?
Corrective: Corrective controls focus on mitigating damage and restoring systems after an incident. Examples include restoring from backups (for ransomware) or patching vulnerabilities. While log review might inform corrective actions, the act of reviewing logs itself is detective, not corrective.

Reference:
Domain 5.1: "Explain the importance of security concepts in an enterprise environment." The SY0-701 objectives categorize security controls into preventive, detective, corrective, and compensatory. Detective controls, such as log reviews and intrusion detection systems, are essential for identifying and understanding security events post-occurrence.

Explanation:
Replacing an expired SSL/TLS certificate is a common administrative task. The process requires generating a new certificate signing request from the server that will use the certificate.

A. CSR (Certificate Signing Request) is correct.
A CSR is a standardized block of encoded text that contains the public key and identifying information (e.g., common name/domain name, organization, locality) for the entity requesting the certificate. The administrator generates this on the web server. This CSR is then submitted to a Certificate Authority (CA) to be validated and signed. The CA uses the information in the CSR to create the new, trusted SSL certificate.

B. OCSP (Online Certificate Status Protocol) is incorrect.
OCSP is a protocol used to check the revocation status of a certificate in real-time (i.e., to see if it has been revoked before its expiration date). It is not used to create a new certificate.

C. Key is incorrect.
While a new public/private key pair is often generated as part of the process of creating a CSR, the key itself is not what is sent to the CA. The private key must be kept secret on the server. The public key is embedded within the CSR. The term "Key" alone is too vague and not the specific item needed for the creation request.

D. CRL (Certificate Revocation List) is incorrect.
A CRL is a list of certificates that have been revoked by the CA before their expiration date. It is another method (like OCSP) for checking revocation status. It is not used to create new certificates.

Reference:
CompTIA Security+ SY0-701 Objective 3.9: "Explain public key infrastructure (PKI) concepts." The process of obtaining a certificate, which includes generating a CSR and the role of the Certificate Authority, is a core concept within this objective.