Amazon
Anthropic
Avaya
Cisco
CompTIA
CrowdStrike
EC-Council
EXIN
Fortinet
Google
ISC
ISC2
ITIL
Juniper
Microsoft
NVIDIA
Palo Alto Networks
Salesforce
SAP
VMware
All Vendors

CompTIA Security+ SY0-701 Dumps in PDF

Free CompTIA SY0-701 Real Questions (page: 11)

SY0-701 PDF — 985 Questions

A security analyst recently read a report about a flaw in several of the organization's printer models that causes credentials to be sent over the network in cleartext, regardless of the encryption settings.
Which of the following would be best to use to validate this finding?

  1. Wireshark
  2. netcat
  3. Nessus
  4. Nmap

Answer(s): A



A development team is launching a new public-facing web product. The Chief Information Security Officer has asked that the product be protected from attackers who use malformed or invalid inputs to destabilize the system.
Which of the following practices should the development team implement?

  1. Fuzzing
  2. Continuous deployment
  3. Static code analysis
  4. Manual peer review

Answer(s): A



During an annual review of the system design, an engineer identified a few issues with the currently released design.
Which of the following should be performed next according to best practices?

  1. Risk management process
  2. Product design process
  3. Design review process
  4. Change control process

Answer(s): D



Which of the following is best to use when determining the severity of a vulnerability?

  1. CVE
  2. OSINT
  3. SOAR
  4. CVSS

Answer(s): D



An organization experienced a security breach that allowed an attacker to send fraudulent wire transfers from a hardened PC exclusively to the attacker's bank through remote connections. A security analyst is creating a timeline of events and has found a different PC on the network containing malware. Upon reviewing the command history, the analyst finds the following:
PS>.\mimikatz.exe "sekurlsa::pth /user:localadmin /domain:corp-domain.com / ntlm:B4B9B02E1F29A3CF193EAB28C8D617D3F327
Which of the following best describes how the attacker gained access to the hardened PC?

  1. The attacker created fileless malware that was hosted by the banking platform.
  2. The attacker performed a pass-the-hash attack using a shared support account.
  3. The attacker utilized living-off-the-land binaries to evade endpoint detection and response software.
  4. The attacker socially engineered the accountant into performing bad transfers.

Answer(s): B



Which of the following is the best resource to consult for information on the most common application exploitation methods?

  1. OWASP
  2. STIX
  3. OVAL
  4. Threat intelligence feed
  5. Common Vulnerabilities and Exposures

Answer(s): A



A security analyst is reviewing the logs on an organization's DNS server and notices the following unusual snippet:

Which of the following attack techniques was most likely used?

  1. Determining the organization's ISP-assigned address space
  2. Bypassing the organization's DNS sinkholing
  3. Footprinting the internal network
  4. Attempting to achieve initial access to the DNS server
  5. Exfiltrating data from fshare.int.complia.org

Answer(s): C



A security analyst at an organization observed several user logins from outside the organization's network. The analyst determined that these logins were not performed by individuals within the organization.
Which of the following recommendations would reduce the likelihood of future attacks? (Choose two.)

  1. Disciplinary actions for users
  2. Conditional access policies
  3. More regular account audits
  4. Implementation of additional authentication factors
  5. Enforcement of content filtering policies
  6. A review of user account permissions

Answer(s): B,D



PDF
Viewing page 11 of 125

Share your comments for CompTIA SY0-701 exam with other users:

A
AI Tutor Explanation
8/19/2026 12:31:46 PM

What are incident response processes?
Incident response processes are the organized steps an organization follows to identify, manage, and recover from a security incident.
Typical stages are:

  1. Preparation – Create policies, response plans, communication procedures, tools, backups, and training.
  2. Detection and analysis – Identify suspicious activity through alerts, logs, monitoring, or user reports, then determine whether an incident occurred and assess its scope.
  3. Containment – Limit the incident’s impact, such as isolating an affected system or blocking malicious traffic.
  4. Eradication – Remove the root cause, such as malware, compromised accounts, or unauthorized persistence.
  5. Recovery – Restore systems to normal operation, validate that they are secure, and monitor for recurrence.
  6. Lessons learned / post-incident activity – Document what happened, preserve evidence, update controls, and improve the response plan.

For the page’s Question 209, Detection is the first active response stage listed among the choices. However, many formal incident-response frameworks place Preparation before detection as part of the overall lifecycle.

Ashton-Under-Lyne, United Kingdom
A
AI Tutor Explanation
8/17/2026 10:31:48 AM

Question 142:
Correct answer: A — Determining the root cause of the incident
The post-incident review—also called a lessons-learned review—analyzes what happened and why. Determining the root cause helps the organization fix the underlying weakness and prevent recurrence.
Why the other options are less suitable:

  • B: Developing steps to mitigate risks — May result from the review, but mitigation planning is generally part of remediation and corrective action.
  • C: Validating evidence accuracy — Occurs during the investigation, before the post-incident review.
  • D: Reestablishing system configuration — This is part of recovery and restoration.

A useful sequence is:
  1. Investigate and validate evidence.
  2. Contain and eradicate the threat.
  3. Recover systems.
  4. Conduct a post-incident review, including root-cause analysis.

Ashton-Under-Lyne, United Kingdom
AI Tutor 👋 I’m here to help!