SY0-701 Exam dumps PDF | Exam-Dumps.net (Page: 4)

QUESTION: 25

An administrator at a small business notices an increase in support calls from employees who receive a blocked page message after trying to navigate to a spoofed website.
Which of the following should the administrator do?

Deploy multifactor authentication.
Decrease the level of the web filter settings.
Implement security awareness training.
Update the acceptable use policy.

Answer(s): C

Explanation:

Safeguards that address user behavior reduce phishing and access to malicious sites. Implementing security awareness training (C) educates users to recognize spoofed sites, report incidents, and follow safe browsing practices, lowering risk and helpdesk calls. A) Deploy multifactor authentication helps with credential theft but doesn’t directly reduce exposure to spoofed sites or user-reported blocks. B) Decreasing web filter settings would increase risk and potentially allow more malicious content. D) Updating the acceptable use policy may help governance but does not train users to recognize or avoid spoofed sites; it’s less immediate in reducing calls. C) is the appropriate control.

Reference:

Reveal Solution Next Question

QUESTION: 26

Which of the following teams is best suited to determine whether a company has systems that can be exploited by a potential, identified vulnerability?

Purple team
Blue team
Red team
White team

Answer(s): C

Explanation:

A detailed ethical hacking perspective: Red team simulates real-world attackers to determine exploitable systems and verify the presence of vulnerabilities from an attacker's view.
A) Purple team: coordinates red and blue efforts but does not primarily perform exploitation to prove exploitable vulnerabilities.
B) Blue team: defends and mitigates; detects and responds to incidents, not primarily exploitative assessment.
C) Red team: conducts controlled attacks to identify exploitable systems and validate security controls from an attacker’s perspective.
D) White team: oversight or governance role; not involved in active exploitation.

Reference:

Reveal Solution Next Question

QUESTION: 27

A company is reviewing options to enforce user logins after several account takeovers. The following conditions must be met as part of the solution:

Allow employees to work remotely or from assigned offices around the world.

Provide a seamless login experience.

Limit the amount of equipment required.

Which of the following best meets these conditions?

Trusted devices
Geotagging
Smart cards
Time-based logins

Answer(s): A

Explanation:

A) Enables zero-trust style validation without relying on physical tokens; supports remote/off-site workers and seamless access with device posture and identity checks, reducing login friction while enforcing authentication after takedowns.
B) Geotagging relies on location data, but not robustly on login authentication and can be spoofed; it also doesn’t inherently enforce authentication post-takeover.
C) Smart cards provide strong authentication but require physical tokens and readers, increasing equipment and management needs, reducing seamlessness and scalability for global remote workers.
D) Time-based logins introduce temporal constraints but don’t address device posture or seamless access, and can hinder legitimate remote access.

Reference:

Reveal Solution Next Question

QUESTION: 28

Which of the following methods can be used to detect attackers who have successfully infiltrated a network? (Choose two.)

Tokenization
CI/CD
Honeypots
Threat modeling
DNS sinkhole
Data obfuscation

Answer(s): C,E

Explanation:

A network defense goal is to detect intruders; honeypots and DNS sinkholes facilitate detection of compromised or malicious activity.
A) Tokenization - not used for detecting intruders; data substitution for protection, not monitoring.
B) CI/CD - software delivery practice; not a detection mechanism for intrusions.
C) Honeypots - decoy systems to attract attackers and alert on unauthorized access; suitable for detection.
D) Threat modeling - proactive risk assessment; not active detection of an ongoing intrusion.
E) DNS sinkhole - redirects or logs malicious domain requests, enabling detection of compromised hosts.
F) Data obfuscation - protects data; does not detect intruders.

Reference:

Reveal Solution Next Question

QUESTION: 29

A company wants to ensure that the software it develops will not be tampered with after the final version is completed.
Which of the following should the company most likely use?

Hashing
Encryption
Baselines
Tokenization

Answer(s): A

Explanation:

A) Hashing is correct because it creates a unique digest of the final software version, enabling tamper detection; any modification changes the hash.
B) Encryption protects data confidentiality, not tamper detection of code integrity.
C) Baselines describe standard configurations to detect deviations, but do not provide a tamper-evident mechanism on the final artifact itself.
D) Tokenization replaces data with tokens for privacy, not for verifying software integrity.

Reference:

Reveal Solution Next Question

QUESTION: 30

An organization completed a project to deploy SSO across all business applications last year. Recently, the finance department selected a new cloud-based accounting software vendor.
Which of the following should most likely be configured during the new software deployment?

RADIUS
SAML
EAP
OpenID

Answer(s): B

Explanation:

Implementing SAML enables SSO across the new cloud-based application, leveraging the existing centralized identity provider to federate authentication for the finance software. This aligns with prior SSO deployment and avoids reconfiguring local credentials.
A) RADIUS is a network access authentication protocol, not best for web-based SaaS SSO federation.
C) EAP is an authentication framework for network access, not specifically for web SSO or SaaS federations.
D) OpenID is an authentication protocol (not SAML) and would require different federation mechanisms; SAML is more common for enterprise SaaS SSO.

Reference:

Reveal Solution Next Question

QUESTION: 31

A user, who is waiting for a flight at an airport, logs in to the airline website using the public Wi-Fi, ignores a security warning and purchases an upgraded seat.
When the flight lands, the user finds unauthorized credit card charges.
Which of the following attacks most likely occurred?

Replay attack
Memory leak
Buffer overflow attack
On-path attack

Answer(s): D

Explanation:

A) On-path attack is correct because the user connected over unsecured public Wi-Fi and ignored a security warning, enabling an attacker to perform a man-in-the-middle (on-path) interception of session tokens and payment data, leading to unauthorized charges.
B) Replay attack is incorrect because it involves capturing and reusing valid data to impersonate, not typically triggered by insecure Wi-Fi per se during a live transaction with payment processing.
C) Memory leak is incorrect as it is a software defect causing resource exhaustion, not related to interception or credential compromise over a network.
D) Buffer overflow attack is incorrect since it exploits memory safety to execute arbitrary code, not a standard mechanism for intercepting payment data on a public network.

Reference:

Reveal Solution Next Question

QUESTION: 32

A network engineer deployed a redundant switch stack to increase system availability. However, the budget can only cover the cost of one ISP connection.
Which of the following best describes the potential risk factor?

The equipment MTBF is unknown.
The ISP has no SLA.
An RPO has not been determined.
There is a single point of failure.

Answer(s): D

Explanation:

A) A single point of failure in the redundant switch stack with only one ISP link means all traffic depends on one path; if the stack or link fails, there is no alternative route.
B) An SLA is not directly about risk from redundancy; even with an SLA, a single ISP connection can fail and affect availability.
C) RPO relates to data loss tolerance, not network topology redundancy or availability.
D) The core risk is a single point of failure because despite stacking, the lack of diverse network paths or multiple ISPs creates one vulnerable failure domain.

Reference:

Reveal Solution Next Question

CompTIA SY0-701 Exam (page: 4) CompTIA Security+ Updated on: 31-Mar-2026

QUESTION: 25

Explanation:

Reference:

QUESTION: 26

Explanation:

Reference:

QUESTION: 27

Explanation:

Reference:

QUESTION: 28

Explanation:

Reference:

QUESTION: 29

Explanation:

Reference:

QUESTION: 30

Explanation:

Reference:

QUESTION: 31

Explanation:

Reference:

QUESTION: 32

Explanation:

Reference:

CompTIA SY0-701 Exam (page: 4)
CompTIA Security+
Updated on: 31-Mar-2026