CompTIA · Free Practice Questions · Last reviewed May 2026

SY0-701 Exam Questions and Answers

30 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.

0
90 min time limit
Pass at 750 / 1000
5 exam domains
1

Domain 1: General Security Concepts

12% of exam · 6 sample questions below

All General Security Concepts questions

A security engineer writes a script that computes SHA-256 hashes of critical server configuration files every night and sends an alert if any hash value has changed since the previous night. Which security goal is this control primarily designed to protect?

A

Confidentiality

B

Integrity

Integrity ensures that data has not been tampered with or altered by unauthorized parties. Comparing hashes allows the engineer to detect any unauthorized changes to the configuration files, directly supporting the integrity goal. This is the correct answer.

C

Availability

D

Authentication

Why: The use of cryptographic hashes to detect changes in files is a mechanism for enforcing data integrity. Integrity ensures that data has not been altered by unauthorized entities. In this scenario, the script ensures that any modification to the configuration files is promptly detected, preserving the trustworthiness of the data.

A financial institution updates its access control policy to require that two different system administrators must approve and execute any changes to the core transaction processing database. Which security principle is this practice primarily designed to enforce?

A

Defense in depth

B

Separation of duties

Correct. Separation of duties ensures that no single person has exclusive authority over critical functions. By splitting approval and execution between two administrators, the risk of unauthorized or malicious changes is significantly reduced.

C

Least privilege

D

Need to know

Why: Requiring two different administrators to approve and execute changes prevents any single individual from having unchecked control over critical operations. This directly supports the separation of duties principle, which reduces the risk of fraud, errors, or malicious activity by dividing responsibilities among multiple people.

A security architect is designing the network security posture for a new branch office. The plan includes a next-generation firewall at the perimeter, an intrusion prevention system on the internal network, mandatory multi-factor authentication for all remote access, and quarterly security awareness training for employees. The architect explains that these controls are independent of each other so that a failure in any single control does not leave the entire network unprotected. Which security concept is the architect primarily implementing?

A

Least privilege

B

Defense in depth

Defense in depth uses multiple overlapping and independent security controls to protect an environment, ensuring that if one control fails, others continue to provide protection. The architect's design directly implements this principle.

C

Zero trust

D

Separation of duties

Why: The scenario describes multiple, independent security controls deployed in layers to protect the network. This is the core idea behind defense in depth, where overlapping controls provide redundancy and resilience. If one control fails, others are still in place to mitigate threats. Least privilege (A) focuses on granting only the minimum necessary permissions. Zero trust (C) is a model that requires continuous verification of every access request, not just layering controls. Separation of duties (D) involves splitting critical tasks among multiple individuals to prevent fraud. Therefore, defense in depth is the best answer.

A security analyst at a hospital is reviewing user permissions in the electronic health record (EHR) system. The analyst discovers that all nursing staff accounts are members of the 'Administrators' group, which grants full read and write access to all patient records, as well as the ability to modify system configuration settings. The nursing staff's job responsibilities only require viewing and updating records for patients currently assigned to them. Which security principle is most directly violated by this configuration?

A

Defense in depth

B

Least privilege

The principle of least privilege dictates that users should have only the minimum permissions needed to perform their duties. Granting nursing staff full administrative rights violates this principle because the staff only need limited, role-specific access to patient records.

C

Non-repudiation

D

Availability

Why: The principle of least privilege requires that users be granted only the minimum permissions necessary to perform their job functions. In this scenario, nursing staff have been given administrative privileges that far exceed their actual job requirements (e.g., modifying system configurations and accessing all patient records), which directly violates least privilege. In contrast, defense in depth involves multiple layers of security controls, non-repudiation ensures that actions cannot be denied by the actor, and availability focuses on ensuring systems are accessible when needed. None of these other principles are directly implicated by the excessive permissions granted.

A defense contractor is deploying a new document management system that will store classified military intelligence. The security policy requires that user access to each document is strictly determined by the document's classification label (e.g., Confidential, Secret, Top Secret) and the user's verified security clearance level. Furthermore, system administrators must not be able to change these access rules or grant themselves access to documents above their clearance. Which access control model is best suited for this requirement?

A

Discretionary Access Control (DAC)

B

Role-Based Access Control (RBAC)

C

Mandatory Access Control (MAC)

MAC is the correct model. It uses system-enforced security labels (clearance for users, classification for documents) and prevents any user, including administrators, from overriding the access rules.

D

Attribute-Based Access Control (ABAC)

Why: This scenario describes Mandatory Access Control (MAC), where access decisions are based on fixed security labels assigned to subjects (users) and objects (documents) by a central authority. MAC enforces the system-wide policy and prevents even administrators from overriding the clearance-based restrictions. This is in contrast to DAC, where resource owners set permissions; RBAC, which uses roles rather than clearance levels; and ABAC, which evaluates attributes but does not inherently enforce a mandatory, non-overridable policy.

A security analyst is investigating a data integrity incident where an attacker exploited a vulnerability in a web application to alter customer account balance records in the database. The analyst identifies the exact records that were modified and restores those records from a verified read-only backup taken prior to the attack. Which security goal is the analyst primarily addressing by restoring the records from backup?

A

Confidentiality

B

Integrity

Integrity ensures data is accurate and has not been improperly altered. By restoring the database to a state before the unauthorized modifications, the analyst is directly correcting a breach of integrity.

C

Availability

D

Non-repudiation

Why: Restoring data from a known-correct backup directly addresses the integrity goal by reverting altered data to its original, uncorrupted state. While backups are also used to support availability, the primary objective in this scenario is to ensure the data is accurate and has not been tampered with, which is the definition of integrity. Confidentiality would involve preventing unauthorized disclosure, and non-repudiation involves proving actions were taken by specific entities, neither of which is the immediate focus of this restoration action.

Want more General Security Concepts practice?

Practice this domain
2

Domain 2: Threats, Vulnerabilities, and Mitigations

22% of exam · 6 sample questions below

All Threats, Vulnerabilities, and Mitigations questions

A security analyst is reviewing web server logs from an e-commerce application. The logs show repeated requests containing URLs with appended strings such as: `' OR '1'='1' --` and `'; DROP TABLE Users; --`. The application returned HTTP 200 responses with unexpected data in several instances. Which type of attack is most likely being attempted?

A

SQL injection

Correct. The log entries show SQL syntax such as `OR '1'='1'` and `DROP TABLE`, which are classic indicators of SQL injection attempts. This attack exploits improper input sanitization to manipulate database queries.

B

LDAP injection

C

Command injection

D

Cross-site scripting (XSS)

Why: The observed patterns are classic SQL injection attempts. The `' OR '1'='1' --` string attempts to bypass authentication by creating a true condition, and `'; DROP TABLE Users; --` attempts to execute a destructive SQL command. A successful SQL injection can allow an attacker to read, modify, or delete database contents. LDAP injection targets directory services, command injection executes OS commands, and XSS injects client-side scripts.

A security analyst is reviewing the source code of a custom network service written in C. The service allocates a 256-byte buffer and uses the strcpy() function to copy incoming data into that buffer without verifying the length of the input. If an attacker sends a specially crafted payload that exceeds 256 bytes, which security control would be most effective at detecting and preventing the resulting exploitation at runtime?

A

Stack canaries

Correct. Stack canaries are placed before the return address on the stack. If a buffer overflow overwrites the canary, the program terminates, preventing control-flow hijacking. This is a highly effective runtime defense against stack-based buffer overflows.

B

Transport Layer Security (TLS)

C

Code signing

D

Data Execution Prevention (DEP)

Why: The vulnerability is a classic buffer overflow that can overwrite the return address on the stack. Stack canaries are small values placed before the return address; if a buffer overflow occurs, the canary is corrupted, and the program terminates before control can be hijacked. This makes stack canaries the most direct runtime mitigation for stack-based buffer overflows. Transport Layer Security (TLS) encrypts data in transit but does not prevent buffer overflows in the application. Code signing ensures the integrity and authenticity of the binary but does not stop exploitation once the code runs. Data Execution Prevention (DEP) prevents execution of code in non-executable memory regions; however, attackers can bypass DEP using return-oriented programming (ROP), while a stack canary would still detect the overflow and abort.

A CFO at a mid-sized company receives an urgent email that appears to come from the CEO's email address, requesting an immediate wire transfer of $50,000 to a new vendor for a time-sensitive project. The email address displayed is 'ceo@cornpany.com' instead of the legitimate 'ceo@company.com'. The CFO follows the instruction and initiates the transfer. Later, the real CEO denies sending such a request. Which of the following security controls would have been MOST effective in preventing this type of attack from succeeding?

A

Deploying a stronger email spam filter that blocks all emails from unrecognized domains

B

Requiring multi-factor authentication (MFA) for all corporate email accounts

C

Implementing a policy that all financial transfers over a certain threshold must be verbally verified via a known phone number before execution

An out-of-band verification procedure, such as calling the requester on a known phone number, directly addresses the impersonation risk by confirming the request through an independent communication channel.

D

Enabling Transport Layer Security (TLS) encryption for all outgoing email communications

Why: This attack is a form of business email compromise (BEC) or CEO fraud, where the attacker spoofs or uses a lookalike domain to impersonate an executive. The most effective prevention is implementing a mandatory out-of-band verification procedure, such as a phone call to a known number, before processing financial requests. Email filtering might catch some spoofed emails, but lookalike domains often bypass filters. Multi-factor authentication (MFA) protects account logins, not email-based impersonation. Encryption ensures confidentiality but does not validate sender identity. Security awareness training is helpful but human error can still occur; a hard validation procedure is more reliable for high-risk actions.

A user receives a phone call from someone who claims to be a member of the company's IT support team. The caller states that the user's account has been compromised and requests the user's username, password, and the current multi-factor authentication (MFA) code to 'verify identity and secure the account.' Which type of social engineering attack is being attempted?

A

Spear phishing

B

Vishing

Vishing (voice phishing) is a social engineering attack conducted over the phone. The attacker impersonates a trusted entity to trick the victim into revealing sensitive information such as passwords and MFA codes.

C

Pretexting

D

Tailgating

Why: This scenario describes a vishing attack, which is a form of social engineering conducted over the phone. The attacker uses a fabricated pretext (a security emergency) to pressure the victim into disclosing sensitive credentials and MFA codes. Unlike spear phishing, which is email-based, vishing relies on voice communication. Pretexting is the broader act of creating a fabricated scenario, but the specific medium (phone) and goal (obtaining passwords and MFA) make vishing the most precise term. Tailgating involves physical unauthorized entry, not phone calls.

A security analyst is reviewing the source code of a custom authentication service. The service uses a function that compares a user-supplied password to the stored password hash by iterating through each byte and returning false immediately upon the first mismatch. The analyst measures the function's execution time and discovers it varies measurably depending on how many initial bytes match. Which type of attack is this vulnerability most likely to facilitate?

A

Brute-force attack

B

Dictionary attack

C

Replay attack

D

Timing attack

A timing attack exploits measurable variations in the time it takes to execute a cryptographic operation. In this case, the early-exit comparison enables an attacker to deduce the correct secret byte by byte, making it the correct classification.

Why: The described vulnerability is a timing side-channel. When a comparison function returns early upon the first mismatch, an attacker can send many carefully crafted guesses and measure the response time. A slightly longer execution time indicates that more initial bytes matched. By iterating through all possible byte values, the attacker can recover the entire secret (password or hash), byte by byte. This is a well-known attack against non-constant-time cryptographic comparisons. Mitigations include using constant-time comparison functions.

A security analyst is reviewing the results of a dynamic application security test (DAST) on a new e-commerce application. The report indicates that the application's product search functionality is vulnerable to blind SQL injection. The analyst is tasked with recommending a remediation to the development team. The developers currently concatenate user input directly into SQL queries. Which of the following recommendations would most effectively and permanently mitigate this vulnerability?

A

Implement a web application firewall (WAF) rule to block suspicious SQL keywords in search parameters.

B

Sanitize user input by escaping single quotes and other special characters before concatenation.

C

Replace dynamic SQL queries with parameterized prepared statements.

Parameterized prepared statements ensure that user input is always treated as data, not executable code. The database compiles the SQL statement with parameter placeholders, and the actual values are bound separately. This completely prevents SQL injection because the input cannot alter the query structure. This is the industry-standard permanent fix.

D

Encode all user input using HTML entity encoding before database operations.

Why: SQL injection occurs when untrusted user input is concatenated directly into SQL queries, allowing an attacker to manipulate the query logic. The most effective and permanent fix is to use parameterized queries (also called prepared statements), which separate SQL code from data. The database engine treats parameters as data only, preventing injection even if the input contains malicious SQL syntax. A web application firewall (WAF) can block some attacks but is a compensating control that can be bypassed and does not fix the root cause. Escaping special characters is error-prone and insufficient because modern databases have complex encoding contexts. HTML entity encoding is used for output encoding to prevent cross-site scripting, not for SQL injection prevention.

Want more Threats, Vulnerabilities, and Mitigations practice?

Practice this domain
3

Domain 3: Security Architecture

18% of exam · 6 sample questions below

All Security Architecture questions

A company is redesigning its network to host a public-facing web application that accesses a confidential database. The security team needs to minimize the risk of a direct attack against the database server while still allowing the web server to retrieve and update data. Which network architecture best achieves this objective?

A

Place both the web server and the database server in the same DMZ segment and rely on host-based firewalls for protection.

B

Place the web server in the DMZ and the database server on the internal network. Configure the firewall to allow inbound traffic from the web server to the database server on the required port only.

This architecture follows the principle of defense in depth. The DMZ provides an additional security layer for the web server, while the database is isolated on the internal network with a restrictive firewall rule that limits access to only the web server, reducing the attack surface.

C

Connect both servers to a single internal VLAN and use a reverse proxy to forward external traffic to the web server.

D

Use a site-to-site VPN to connect the web server and database server, and place both behind a single NAT gateway.

Why: The preferred architecture for a public-facing web application with a backend database is to place the web server in a DMZ (or screened subnet) and the database server on the internal network with a firewall rule that permits only the web server's IP address to communicate with the database over the required port (e.g., 3306 for MySQL). This ensures that external users can only access the web server, and the database is not directly reachable from the internet. All other options introduce unnecessary exposure or complexity.

A security architect is designing a new data center network that will host public-facing web servers and internal application servers handling confidential employee data. The architect places the web servers in a DMZ and the internal application servers on a separate internal network segment. A stateful firewall is configured to allow inbound HTTP/HTTPS traffic from the internet to the web servers only. The firewall also permits only the web servers to initiate outbound connections to the internal application servers on a specific TCP port, and all such traffic is encrypted using TLS. Which security architecture principle is this design primarily intended to enforce?

A

Least privilege

B

Defense in depth

Correct. The design uses network segmentation, firewalls, and encryption to create multiple layers of defense. This is the core concept of defense in depth, ensuring that a failure in one layer does not compromise the entire system.

C

Separation of duties

D

Zero trust

Why: The design incorporates multiple layers of security controls: network segmentation (DMZ vs. internal), restrictive firewall rules, and encryption of inter-server communications. This layered approach is the hallmark of defense in depth. While the design also applies least privilege by limiting which servers can communicate and on which ports, the primary intent of combining these different controls is to ensure that if one layer fails, other layers still provide protection. Separation of duties relates to dividing administrative privileges among multiple individuals, not network zoning. Zero trust would require continuous verification of every request, which is not fully implemented here because the firewall rule implicitly trusts the web servers to communicate with the internal application servers without further authentication.

A company's current remote access solution uses a traditional VPN that grants users full network-layer access to the internal LAN once authenticated. The security architect wants to adopt a zero trust architecture to reduce the risk of lateral movement by compromised endpoints. Which of the following implementations best aligns with zero trust principles?

A

Implement a next-generation firewall and require all remote traffic to pass through it with strict rules.

B

Deploy a secure web gateway and require all remote users to browse through a proxy.

C

Use a software-defined perimeter that authenticates each user and device before granting access only to specific applications.

A software-defined perimeter (SDP) or zero trust network access (ZTNA) solution authenticates and authorizes each connection request individually, creating an encrypted tunnel only to the requested application. This prevents lateral movement because the user never receives a network-level address on the internal LAN.

D

Enable multi-factor authentication for VPN and implement a VPN concentrator with split tunneling.

Why: Zero trust architecture operates on the principle of 'never trust, always verify' and typically grants access only to specific resources on a per-session basis after verifying user identity, device health, and other contextual factors. A software-defined perimeter (SDP) or a zero trust network access (ZTNA) solution directly enforces this by creating an encrypted, micro-segmented connection to each application rather than broad network access. Option C is the correct choice. Option A (firewall with strict rules) still provides network-layer access after authentication, which violates the least-privilege and micro-segmentation goals. Option B (secure web gateway) only handles web traffic and does not replace the need for application-specific zero trust controls for all remote services. Option D (MFA plus VPN with split tunneling) improves authentication but still grants broad LAN access once inside, failing to contain lateral movement.

A security architect is designing a solution to process highly sensitive financial transactions in a shared cloud environment. The architect needs to ensure that the processor and memory used to handle transaction data are isolated from the host operating system and other virtual machines, even if the hypervisor is compromised. Which technology is specifically designed to provide this level of isolation for code and data during runtime?

A

Trusted Platform Module (TPM)

B

Hardware Security Module (HSM)

C

Secure enclave (e.g., Intel SGX)

A secure enclave, such as Intel Software Guard Extensions (SGX), creates hardware-enforced encrypted regions of memory that protect code and data from access by the host OS, hypervisor, or other processes, even if those lower layers are compromised.

D

UEFI Secure Boot

Why: The scenario requires hardware-enforced isolation of runtime processes and memory from the underlying OS and hypervisor. This is a core capability of a secure enclave (e.g., Intel SGX, AMD SEV). A TPM provides attestation and secure storage but does not isolate runtime memory. An HSM protects cryptographic keys and operations but is not designed for general-purpose code execution isolation. Secure Boot ensures only trusted bootloaders are loaded but does not protect applications at runtime.

A security architect is redesigning remote administration for a set of critical Linux servers in a private cloud. Currently, system administrators connect directly from their corporate laptops to the servers over the internet using SSH. The architect's primary goal is to eliminate direct inbound SSH connections from the internet while still allowing authorized administrators to perform maintenance tasks. Which of the following architectural changes would best achieve this objective?

A

Deploy a VPN concentrator and require all administrators to connect to the VPN before initiating SSH sessions directly to the servers.

B

Deploy a jump server (bastion host) in a management subnet and require all administrative SSH connections to originate from the jump server, with the jump server accessible only via the corporate VPN.

This is the correct architecture. The jump server acts as a secure intermediary. No SSH traffic from the internet reaches the target servers; all connections must first authenticate to the VPN, then to the jump server, and finally the jump server initiates outbound SSH to the target servers. This eliminates direct inbound SSH and provides a centralized audit point.

C

Replace SSH with a web-based console proxy that uses HTTPS and multi-factor authentication, and allow direct internet access to the console proxy on port 443.

D

Configure each Linux server with a public IP address but restrict inbound SSH to the known public IP addresses of the administrators' corporate laptops.

Why: The goal is to remove direct internet-facing SSH access to critical servers. A jump server (bastion host) placed in a management subnet, accessible only through a corporate VPN, provides a centralized, audited gateway. Administrators must first authenticate to the VPN, then connect to the jump server via SSH, and finally initiate SSH sessions from the jump server to the target servers. This architecture ensures no direct external SSH connection reaches the critical servers, and all administrative activity is logged on the jump server. Option A (VPN + direct SSH) still allows direct SSH from the VPN network to the servers, which does not eliminate direct inbound SSH; it only adds a VPN layer. Option C (web-based console proxy) reduces the attack surface but still exposes a service directly to the internet unless the proxy itself is protected by VPN or other access controls; the description allows public HTTPS access, which is not as secure as a jump server behind VPN. Option D (public IP with IP allow-listing) is a poor practice because it still exposes SSH to the internet and is vulnerable to source IP spoofing or compromised laptops.

A security architect is designing the network security for a web application hosted in a public cloud environment such as AWS. The application uses an Application Load Balancer (ALB) that distributes traffic to a fleet of web servers. The web servers must only accept traffic from the ALB, and all other inbound traffic must be blocked. The ALB itself needs to accept HTTP/HTTPS traffic from anywhere on the internet. Which of the following cloud security controls should the architect configure on the web servers' network interface to best meet this requirement, assuming the cloud provider offers both stateful and stateless network filtering options?

A

A stateless network ACL that allows inbound traffic from the ALB's subnet only.

B

A stateful security group that allows inbound traffic from the ALB's security group only.

Correct. Security groups are stateful and can use another security group as a source. This configuration cleanly allows only traffic originating from the ALB, automatically handles return traffic, and is the recommended cloud-native approach for controlling instance-level access.

C

A web application firewall (WAF) that inspects all traffic for SQL injection.

D

A host-based firewall on each web server that allows traffic from the ALB's private IP address.

Why: A security group is a stateful virtual firewall that controls inbound and outbound traffic at the instance level. By configuring the web server's security group to allow inbound traffic only from the ALB's security group, the architect ensures that only the ALB can initiate connections to the web servers. Security groups automatically allow return traffic, so no additional rules are needed. This is the most efficient and secure approach. Network ACLs are stateless and require separate inbound and outbound rules, making them more complex to manage for this scenario. A WAF operates at the application layer and is not a network-level access control. A host-based firewall is an additional measure but does not leverage the cloud's native security group features for simplified management.

Want more Security Architecture practice?

Practice this domain
4

Domain 4: Security Operations

28% of exam · 6 sample questions below

All Security Operations questions

A SOC analyst receives an alert from the EDR system indicating that the process 'C:\Program Files\Vendor\Updater.exe' attempted to modify the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key on a user's workstation. The analyst checks the file hash and finds it matches a known legitimate software updater. Which of the following actions is most appropriate for the analyst to take?

A

Disable the software updater immediately to prevent further registry modifications.

B

Create an exception rule in the EDR to suppress future alerts for this process.

C

Investigate the user's recent activity and check for signs of process hollowing or DLL injection.

This is the correct next step. The analyst should examine the process's behavior in depth, including checking for anomalies such as unexpected command-line arguments, suspicious parent processes, or indicators of code injection, before concluding whether the alert is a false positive.

D

Isolate the workstation from the network and reimage the system immediately.

Why: Legitimate processes can be abused by attackers using techniques such as process hollowing, DLL sideloading, or command-line injection. The analyst should not immediately assume the process is benign simply because the file hash matches a known good file. Further investigation, such as checking for suspicious parent-child process relationships, unusual command-line arguments, or signs of injection, is necessary to determine if the updater is being used maliciously. Creating an exception blindly could allow malicious activity to persist undetected, while disabling the updater may disrupt necessary software updates. Isolation and reimaging are too aggressive without confirmed compromise.

A SOC analyst is reviewing logs from a Windows domain controller and notices a large number of failed logon attempts (Event ID 4625) from a single source IP address within a five-minute window. The account names used are random strings such as "a1b2c3", "x9y8z7", etc. The analyst then checks the source IP and finds it is a known external address from a foreign country. Which of the following is the most appropriate next step for the analyst to take?

A

Immediately block the IP address at the perimeter firewall.

B

Investigate whether any of the attempted accounts correspond to actual domain users.

This is the correct first step. If any of the random account names match legitimate domain accounts, it indicates a targeted attack and possible credential compromise. Even if no failures are logged, a successful authentication might have been recorded separately. This investigation guides subsequent containment and remediation.

C

Run a full antivirus scan on the domain controller.

D

Notify the company's legal department for law enforcement involvement.

Why: The pattern of failed logon attempts with random account names from an external IP is indicative of a password spraying or dictionary-based brute-force attack. The primary concern is whether any of the targeted accounts are valid domain users because a successful login could have occurred and might not appear as a failure. Before taking irreversible actions such as blocking the IP or escalating to legal, the analyst should investigate if any valid accounts were attempted, as that could indicate a potential compromise. Running an antivirus scan on the domain controller is not directly relevant to the immediate threat, and notifying legal is premature without more evidence.

A security operations analyst is tuning a SIEM correlation rule designed to detect brute-force password attacks against domain user accounts. The current rule generates an alert when a single user account has more than 10 failed logon attempts within a 5-minute window. The SOC team is overwhelmed by thousands of alerts each day, the vast majority of which are triggered by legitimate users who accidentally mistype their passwords. Which of the following modifications to the rule would most effectively reduce false positives while still detecting actual brute-force attacks?

A

Increase the failed attempt threshold to 20 attempts within the same 5-minute window.

B

Modify the rule to trigger only when the failed attempts originate from multiple distinct source IP addresses.

This is correct because a genuine brute-force attack often uses a distributed set of source IPs to evade rate limiting, whereas a legitimate user mistyping typically connects from a single IP. This change filters out most false positives while still detecting distributed attacks.

C

Modify the rule to trigger only when the failed attempts are against multiple distinct user accounts.

D

Add an exception to suppress alerts for any user account that has a valid password reset request within the same time period.

Why: The goal is to distinguish between accidental mistypes (single IP, low volume) and true brute-force attacks (often distributed across multiple IPs). Option B achieves this by requiring the failed attempts to come from multiple distinct source IPs, which is a strong indicator of an automated attack using proxies/botnets. Option A simply raises the threshold, which may miss slower or cautious attackers. Option C targets password spraying (multiple accounts, single password) rather than single-account brute force. Option D is unreliable because users may not submit password reset requests, and it could be bypassed by an attacker who also requests a reset. Therefore, B is the most effective tuning technique.

A security analyst is responding to a potential ransomware incident on a Windows server that is still running. The analyst needs to preserve forensic evidence for analysis. Which of the following actions should the analyst perform first, based on the order of volatility?

A

Capture a full memory dump of the server

Correct. Memory is the most volatile data and should be captured first to preserve evidence such as running processes, network connections, and malware in memory. Any delay or system shutdown may cause this data to be lost.

B

Shut down the server to prevent further damage

C

Create a forensic disk image of the hard drive

D

Run a full antivirus scan on the system

Why: The order of volatility (OOV) dictates that the most volatile data (data that changes rapidly or is lost when power is removed) should be captured first. Memory (RAM) is the most volatile because it contains running processes, network connections, and encryption keys that disappear when the system is shut down or rebooted. Capturing a memory image before any other action ensures that this critical evidence is preserved. Disks contain persistent data but are less volatile, while shutting down the system would destroy volatile data. Running an antivirus scan alters the system state and can destroy evidence.

A security analyst is monitoring logs from the cloud access security broker (CASB) and observes that a user account downloaded 500 GB of data from a highly sensitive SharePoint document library within a single hour. The user's historical baseline shows an average daily download of less than 10 MB. Additionally, the log shows the session originated from an IP address in a country where the company has no employees or business operations. Which of the following actions is the most appropriate for the analyst to take?

A

Immediately block the user account and the source IP address at the CASB.

B

Contact the user directly by phone to verify whether they initiated the download.

C

Initiate the organization's incident response process for a potential data exfiltration event.

Correct. The combination of anomalous data volume and unusual geolocation strongly suggests a security incident. The analyst should follow the incident response plan, which typically includes preserving logs, engaging the incident response team, and escalating per policy.

D

Disable the SharePoint document library and remove all user permissions to prevent further data loss.

Why: This scenario describes a classic indicator of data exfiltration: a user account exhibiting behavior wildly outside its baseline (500 GB vs. <10 MB daily) combined with a login from an unexpected geographic location. The most appropriate action is to initiate the organization's incident response process, which will trigger a formal investigation, contain the threat, and preserve evidence. While contacting the user or temporarily blocking the account might seem reasonable, these steps should be performed under the guidance of the incident response plan to avoid alerting a potential attacker or destroying evidence. Disabling the entire SharePoint site is an overreaction that would disrupt all users.

A security analyst in the SOC is investigating a potential DNS tunneling incident. The analyst has identified a workstation that is making thousands of DNS queries to an external domain with base64-encoded subdomains. The analyst suspects that sensitive files from the workstation are being exfiltrated by encoding their contents into the subdomains of the DNS queries. Which of the following log sources will provide the most definitive evidence to confirm that the contents of a specific sensitive file are being transmitted in the DNS queries?

A

The DNS server logs showing the queried domains and subdomains.

B

The workstation's process creation logs showing which process initiated the DNS queries.

C

A full packet capture of the network traffic from the workstation showing the complete DNS messages.

A full packet capture includes the entire DNS query packet, including the complete subdomain portion. The analyst can extract and decode the base64-encoded subdomain data and compare it directly to the contents of a sensitive file on the workstation to definitively confirm data exfiltration.

D

The firewall logs showing outbound connections from the workstation to the external DNS server on port 53.

Why: DNS tunneling exfiltrates data by encoding it into the subdomain portion of DNS queries. To confirm that the data from a specific file is being sent, the analyst needs to inspect the full content of the DNS query packet. A full packet capture of the network traffic includes the entire DNS message, including the complete subdomain string, which can be decoded and compared directly to the contents of the suspected file on the workstation. DNS server logs often truncate long subdomain names or may not log them at all, making them less reliable. Process creation logs show which program made the queries but not the transmitted data. Firewall logs only show connection metadata and cannot reveal the payload of the DNS queries.

Want more Security Operations practice?

Practice this domain
5

Domain 5: Security Program Management and Oversight

All Security Program Management and Oversight questions

A company is evaluating a new cloud-based customer relationship management (CRM) provider. The provider’s documentation includes a SOC 2 Type II report, but the company’s compliance team specifically requires evidence that data in transit is encrypted using TLS 1.2 or higher, and data at rest is encrypted with AES-256. Which of the following actions best demonstrates that the company has performed proper due diligence in vendor risk management?

A

Request the provider to sign a contractual service-level agreement (SLA) that guarantees encryption compliance.

B

Accept the SOC 2 Type II report as sufficient and proceed without further review.

C

Review the detailed control descriptions and auditor test results within the SOC 2 Type II report that address encryption of data in transit and at rest.

A SOC 2 Type II report includes a detailed description of controls, the control objectives, and the results of the auditor’s testing over a period of time. Reviewing these specific sections allows the company to verify that encryption controls are designed and operating effectively, which satisfies due diligence requirements for third-party risk management.

D

Conduct an independent penetration test on the provider’s infrastructure before signing the contract.

Why: Proper due diligence in vendor risk management involves verifying that the vendor’s security controls meet the company’s specific requirements, not just accepting broad attestations. A SOC 2 Type II report contains detailed descriptions of controls, including encryption practices, and an auditor has tested their operating effectiveness over a period of time. Reviewing the relevant control descriptions and test results within the report is the most direct and reliable way to confirm the required encryption standards are in place. The other options are either insufficient, create unnecessary cost, or fail to provide evidence of actual control effectiveness.

A security manager is evaluating the effectiveness of a new security awareness training program that all employees completed last quarter. The company has been conducting monthly phishing simulation campaigns for the past year. Which of the following metrics would provide the strongest evidence that the training is achieving its intended goal of changing employee behavior?

A

95% of employees completed the training within the deadline.

B

The number of employees reporting phishing attempts to the SOC increased by 40%.

C

The percentage of employees who clicked on a simulated phishing email decreased from 18% to 6%.

A significant drop in the click-through rate on simulated phishing emails directly demonstrates that employees are less susceptible to phishing attacks, which is the desired behavioral outcome of the training.

D

The number of helpdesk tickets related to password resets decreased by 10%.

Why: The primary objective of security awareness training is to alter employee behavior so that they are less likely to fall for social engineering attacks. A reduction in the click rate on simulated phishing emails directly measures a behavioral change and indicates that employees are better at recognizing and avoiding phishing attempts. Completion rate (option A) only shows that employees attended, not that they learned or changed behavior. Increased reporting (option B) is positive but does not directly show that fewer employees are being tricked; it could be due to higher vigilance, but the click rate is a more direct measure of susceptibility. Helpdesk tickets for password resets (option D) may decrease for many reasons unrelated to phishing awareness, such as improved password policies or self-service tools, making it a poor indicator of training effectiveness.

After completing a vulnerability scan, a security analyst discovers that a legacy customer-facing application running on an unsupported operating system contains a critical remote code execution vulnerability. The application is essential to daily operations and cannot be patched or upgraded in the near term. Management has approved the purchase of a hardware-based network firewall that will be placed in front of the application to restrict inbound traffic to only authorized source IP addresses and port numbers. Which risk management strategy does this action primarily represent?

A

Risk acceptance

B

Risk mitigation

Correct. By deploying a firewall to restrict access, the organization is reducing the likelihood that the vulnerability can be exploited. This is a risk mitigation strategy using a compensating control.

C

Risk avoidance

D

Risk transference

Why: The organization is reducing the risk of exploitation by implementing a compensating control (firewall) that limits exposure. This is a classic example of risk mitigation, as the control reduces either the likelihood or the impact of the vulnerability being exploited without eliminating the vulnerability itself.

A security manager is preparing a quarterly report for the board of directors on the effectiveness of the organization's security program. The manager has access to detailed technical data, including firewall log statistics, patch compliance percentages, and number of phishing simulation clicks. Which of the following would be the most appropriate way to present this information to the board?

A

Provide a list of all firewall rule changes made during the quarter.

B

Show a trend chart of the number of security incidents categorized by severity, along with average time to resolve.

This option provides a high-level, actionable summary that demonstrates the security program's effectiveness. Incident trends by severity and resolution time are key performance indicators that the board can use to assess risk reduction and operational maturity.

C

Include raw logs of the top 10 most frequent alerts from the SIEM.

D

Describe the technical architecture of the intrusion prevention system.

Why: The board of directors requires high-level, risk-focused metrics that illustrate the overall health and effectiveness of the security program. Detailed technical data (e.g., raw logs, individual rule changes) is not suitable for this audience. Presenting a trend of incidents by severity and average resolution time gives context about risk reduction and operational effectiveness, which aligns with the board's oversight responsibilities.

A security manager is leading a risk assessment for the organization. The team identifies a legacy application that contains a known critical vulnerability. The vendor has discontinued support and no patch is available. The manager calculates that the annualized loss expectancy (ALE) for exploiting this vulnerability is $50,000. Implementing a third-party web application firewall (WAF) as a compensating control would cost $80,000 per year. The organization's leadership decides that accepting the risk is the most cost-effective approach. Which of the following documents should the security manager update to formally record this risk acceptance decision and obtain the necessary sign-off?

A

Business impact analysis (BIA)

B

Risk register

Correct. The risk register is used to track identified risks, their characteristics, and the chosen treatment. Updating it with the acceptance decision, rationale, and approval is essential for risk governance.

C

Security baseline configuration document

D

Incident response plan

Why: The risk register is the authoritative document for recording identified risks, their assessed impact and likelihood, and the chosen risk treatment strategy (avoid, mitigate, transfer, or accept). When leadership decides to accept a risk, the security manager must update the risk register to document the decision, the rationale (e.g., cost of control exceeds potential loss), and the approval from management. This ensures proper governance and auditability. The other documents serve different purposes: the business impact analysis (BIA) identifies critical business functions and recovery priorities; the security baseline document defines secure configuration standards; and the incident response plan outlines procedures for responding to security incidents. None of these are designed to formally record risk acceptance decisions.

A security manager at a financial services company is proposing a new policy that would require annual background checks for all employees with access to sensitive customer payment data. The proposed policy, if implemented, would increase the organization's operational costs by approximately $200,000 per year. The manager needs to obtain formal approval to implement this policy. Which of the following groups is MOST likely to have the authority to approve this policy and allocate the necessary budget?

A

Board of directors

The board of directors has the fiduciary responsibility and ultimate authority to approve significant policy changes that require a substantial budget allocation, such as a $200,000 annual expense for background checks. This is correct because the policy crosses functional areas (security, HR, finance) and requires formal governance approval.

B

Chief Information Security Officer (CISO)

C

IT steering committee

D

Security operations team

Why: In a typical organizational governance structure, significant new policies that require substantial budget allocations and affect multiple departments are approved by a senior leadership body such as the board of directors or an executive steering committee. The security manager needs both policy authority and budget authority. The board of directors holds the ultimate fiduciary responsibility and has the power to approve major expenditures and changes to corporate policies. While a CISO or senior security leader may endorse the proposal, they do not have the final authority to allocate a $200,000 budget increase without approval from the board or an equivalent executive governance body. The IT steering committee might influence technical direction but typically does not approve enterprise-wide human resources policies. The security operations team has no role in approving policy or budget at this level.

Want more Security Program Management and Oversight practice?

Practice this domain

Frequently asked questions

How many questions are on the SY0-701 exam?

The SY0-701 exam has up to 0 questions and must be completed in 90 minutes. The passing score is 750/1000.

What types of questions appear on the SY0-701 exam?

The SY0-701 exam uses multiple-choice, multiple-select, drag-and-drop, and exhibit-based questions. Exhibit questions show CLI output, network diagrams, or routing tables and ask you to interpret them — exactly the format Courseiva uses.

How are SY0-701 questions organised by domain?

The exam covers 5 domains: General Security Concepts, Threats, Vulnerabilities, and Mitigations, Security Architecture, Security Operations, Security Program Management and Oversight. Questions are weighted by domain — higher-weight domains appear more on your actual exam.

Are these the actual SY0-701 exam questions?

No. These are original exam-style practice questions written against the official CompTIA SY0-701 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.

Ready to practice all 0 SY0-701 questions?

Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.