SY0-701 Exam dumps PDF | Exam-Dumps.net (Page: 14)

QUESTION: 105

Which of the following topics would most likely be included within an organization's SDLC?

Service-level agreements
Information security policy
Penetration testing methodology
Branch protection requirements

Answer(s): D

Explanation:

An SDLC (Software Development Life Cycle) includes security requirements and controls such as branch protection to safeguard code repositories and CI/CD pipelines.
A) Service-level agreements relate to operational performance of services, not specifically to SDLC security controls.
B) Information security policy governs overarching security rules, not the lifecycle processes for software development.
C) Penetration testing methodology is typically part of security testing phases, not core SDLC control measures like branch protection.
D) Branch protection requirements directly secure source code repositories during development, aligning with SDLC risk management and secure coding practices.

Reveal Solution Next Question

QUESTION: 106

Which of the following control types is AUP an example of?

Physical
Managerial
Technical
Operational

Answer(s): D

Explanation:

A) AUP is an operational control because it governs day-to-day user behavior and procedures in the organization.
B) Managerial is incorrect because AUP does not involve policy-level governance or strategic oversight, but rather guidelines for operations.
C) Technical is incorrect because AUP does not rely on technical implementations, system configurations, or automated controls.
D) Correct: AUP (acceptable use policy) directly guides user actions and operational practices, aligning with operational controls.

Reveal Solution Next Question

QUESTION: 107

An organization is adopting cloud services at a rapid pace and now has multiple SaaS applications in use. Each application has a separate log-in, so the security team wants to reduce the number of credentials each employee must maintain.
Which of the following is the first step the security team should take?

Enable SAML.
Create OAuth tokens.
Use password vaulting.
Select an IdP.

Answer(s): D

Explanation:

Adopt a central identity provider (IdP) first to enable single sign-on across multiple SaaS apps, reducing credential management for users. A) Enable SAML is a specific SSO protocol, but requires an IdP as the source; the first step is selecting the IdP. B) Create OAuth tokens are for delegated access, not initial SSO consolidation. C) Use password vaulting helps credential management for admins, not end-user SSO across apps. D) Select an IdP provides centralized authentication, enabling SSO and federated access across cloud apps, aligning with rapid SaaS adoption and reduced login counts.

Reveal Solution Next Question

QUESTION: 108

A company's online shopping website became unusable shortly after midnight on January 30, 2023.
When a security analyst reviewed the database server, the analyst noticed the following code used for backing up data:

Which of the following should the analyst do next?

Check for recently terminated DBAs.
Review WAF logs for evidence of command injection.
Scan the database server for malware.
Search the web server for ransomware notes.

Answer(s): B

Explanation:

A) Review WAF logs for evidence of command injection.
B) is correct because the scenario implies a potential web-based exploit leading to abnormal database activity; examining Web Application Firewall logs helps detect command injection attempts that could compromise the database.
A) Check for recently terminated DBAs is not directly related to an active exploit; insider threats are possible but less immediate than web-based injection indicators.
C) Scan the database server for malware may be relevant post-compromise but does not address the initial intrusion vector evidenced by the code snippet suggesting command execution from web requests.
D) Search the web server for ransomware notes focuses on ransom indicators after encryption, not the likely cause of the outage.

Reveal Solution Next Question

QUESTION: 109

Which of the following would be the best way to test resiliency in the event of a primary power failure?

Parallel processing
Tabletop exercise
Simulation testing
Production failover

Answer(s): D

Explanation:

A) D) Production failover is the best method to test resiliency during a primary power failure because it validates real-world recovery procedures, failover automation, and continuity of operations by switching to backup systems or sites under actual conditions. B) Tabletop exercises simulate scenarios but lack hands-on validation of systems and failover tooling. C) Simulation testing models behavior but may not reproduce full failover dynamics or confirm performance in production. A) Parallel processing is not focused on resiliency testing or failover capabilities.

Reveal Solution Next Question

QUESTION: 110

Which of the following would be the most appropriate way to protect data in transit?

SHA-256
SSL3.0
TLS 1.3
AES-256

Answer(s): C

Explanation:

A secure data-in-transit protection is best achieved with modern TLS protocols.
A) SHA-256 is a hashing algorithm, not used to protect data in transit.
B) SSL 3.0 is deprecated due to vulnerabilities; not recommended for protecting data in transit.
C) TLS 1.3 provides strong encryption, integrity, and forward secrecy for data in transit.
D) AES-256 is a symmetric cipher used for encryption at rest or in session, but TLS 1.3 is the protocol that governs secure transit protections.

Reveal Solution Next Question

QUESTION: 111

Which of the following is a common, passive reconnaissance technique employed by penetration testers in the early phases of an engagement?

Open-source intelligence
Port scanning
Pivoting
Exploit validation

Answer(s): A

Explanation:

A) Open-source intelligence is a common passive reconnaissance technique used in early engagement to gather publicly available information without directly interacting with target systems. B) Port scanning is active and intrusive, revealing open ports on a host. C) Pivoting is a post-exploitation technique used to access other networks after compromise. D) Exploit validation involves confirming exploit effectiveness, a hands-on activity after gaining access.

Reveal Solution Next Question

QUESTION: 112

Which of the following threat actors is the most likely to seek financial gain through the use of ransomware attacks?

Organized crime
Insider threat
Nation-state
Hacktivists

Answer(s): A

Explanation:

Organized crime groups are primarily motivated by financial gain. Ransomware attacks are a popular tool for these groups because they can encrypt a victim's data and demand a ransom payment (often in cryptocurrency) to restore access. This form of attack can yield a high financial return if victims choose to pay.

Reveal Solution Next Question

CompTIA SY0-701 Exam (page: 14) CompTIA Security+ Updated on: 31-Mar-2026

QUESTION: 105

Explanation:

QUESTION: 106

Explanation:

QUESTION: 107

Explanation:

QUESTION: 108

Explanation:

QUESTION: 109

Explanation:

QUESTION: 110

Explanation:

QUESTION: 111

Explanation:

QUESTION: 112

Explanation:

CompTIA SY0-701 Exam (page: 14)
CompTIA Security+
Updated on: 31-Mar-2026