CompTIA Security+ Study Guide
SY0-701
1. The organization that Chris works for has disabled automatic updates. What is the most common reason for
disabling automatic updates for organizational systems?: C. To avoid issues with problematic patches and updates
2. Which of the following is the least volatile according to the forensic order of volatility?: B. Logs
3. Ed wants to trick a user to connecting to his evil twin access point (AP). What type of attack should he
conduct to increase his chances of the user connecting to it?: A. A dissociation attack
4. What term is used to describe wireless site surveys that show the relative power of access points on a diagram
of the building or facility?: D. Heatmaps
5. What hardware device is used to creae the hardware root of trust for modern desktops and laptops?: D. The
TPM
6. Angela wants to prevent users in her organization from changing their passwords repeatedly so that they
cannot reuse their current password. What two password security settings does she need to implement to make
this occur?: A. Set a password history and a minimum password age
7. Chris wants to establish a backup site that is fully ready to take over for full operations for his organization at
any time. What type of site should he set up?: C. A hot site
8. Which of the following is not a common constraint of embedded and spe- cialized systems?: B. Overly
complex firewall settings
9. Gary is reviewing his systems SSH logs and sees logins for the user named "Gary" with passwords like
password1, password2,...,PassworD. What type of attack has Gary discovered?: A. A dictionary attack
10.Kathleen wants to set up a system that allows access into a high-security zone from a low-security zone. What
type of solution should she configure?: D. A jump server
11.Derek's organization is worried about a disgruntled employee publishing sensitive business information.
What type of threat should Derek work to protect against?: C. Insider threats
12.Jeff is concerned about the effects that a ransomware attack might have on his organization and is designing
a backup methodology that would allows the organization to quickly restore after such an attack. What type of
control is Jeff implementing?: A. Corrective
13.Samantha is investigating a cybersecurity incident where an internal user used his computer to participate in
a denial of service attack against a third party. What type of policy was most likely violated?: C. AUP (acceptable
use policy)
, CompTIA Security+ Study Guide
SY0-701
14.Jean recently completed the user acceptance testing process and is get- ting her code ready to deploy. What
environment should house her code before it is release for use?: D. Staging
15.Oren obtained a certificate for his domain covering *. acmewidgets.net. Which one of the following domains
would not be covered by this certificate?
A. www.acmewidgets.net
B. acmewidgets.net
C. test.mail.acmewidgets.net
D. mobile.acmewidgets.net: C. test.mail.acmewidgets.net
16.Richard is sending a message to Grace and would like to apply a digital signature to the message before
sending it. What key should he use to create the digital signature?
A. Richard's private key
B. Richard's public key
C. Grace's Private Key
D. Grace's public key: A. Richard's private key
17.Andrew is workng with his financial team to purchase a cybersecurity insurance policy to cover the
financial impact of a data breach. What type of risk management strategy is he using?: B. Risk transference
18.Shelly is writing a document that describes the steps that incident re- sponse teams will follow upon first
notice of a potential incident. What type of document is she creating?: C. Procedure
19.Rob has created a document that describes how staff in his organization can use organizationally owned
devices, including if and when personal use is allowed. What type of policy has Rob created?: B. An acceptable
use policy
20.Matt is updating the organization's threat assessment process. What cat- egory of control is Matt
implementing?: D. Managerial
21. Jade's organization recently suffered a security breach that affected stored credit card data. Jade's
primary concern is the fact that the organization is subject to sanctions for violating the provisions of the
Payment Card Industry Data Security Standard. What category of risk is concerning Jade?: B. Compli- ance
22.Chris is responding to a security incident that compromised one of his organization's web servers. He believes
that the attackers defaced one or more
, CompTIA Security+ Study Guide
SY0-701
pages on the website. What cybersecurity objective did this attack violate?: C. Integrity
23.Tonya is concerned about the risk an attacker will attempt to gain access to her organization's database
server. She is searching for a control that would discourage the attacker from attempting to gain access. What
type of security control is she seeking to implement?: D. Deterrent
24.Greg is implementing a data loss prevention system. He would like to ensure that it protects against
transmissions of sensitive information by guests on his wireless network. What DLP technology would best
meet this goal?
A. Watermarking
B. Pattern recognition
C. Host-based
D. Network-based: D. Network-based
25.What term describes data that is being sent between two systems over a network connection?: B. Data in
transit
26.Tina is tuning her organization's intrusion prevention system to prevent false positive alerts. What type of
control is Tina implementing?: A. Technical control
27.Which one of the following is not a common goal of a cybersecurity attacker?: D. Allocation
28.Tony is reviewing the status of his organization's defenses against a breach of their file server. He believes
that a compromise of the file server could reveal information that would prevent the company from continuing to
do business. What term best describes the risk that Tony is considering?
A. Strategic
B. Reputational
C. Financial
D. Operational: A. Strategic
29.Which of the following data elements is not commonly associated with identity theft?: C. Frequent flier
number
30.What term best describes an organization's desired security state?: A. Control objectives
31.What technology uses mathematical algorithms to render information un- readable to those lacking the
required key?: D. Data encryption
32. Greg recently conducted an assessment of his organization's security con- trols and discovered a
potential gap: the organization does not use full-disk encryption on laptops. What type of control gap exists in
this case?: D. Pre- ventive
, CompTIA Security+ Study Guide
SY0-701
33.What compliance regulation most directly affects the operations of a health-care provider?: A.
HIPAA
34.Nolan is writing an after action report on a security breach that took place in his organization. The attackers
stole thousands of customer records from the organization's database. What cybersecurity principle was most
impacted in this breach?: C. Confidentiality
35.Which one of the following objectives is not one of the three main ob- jectives that information security
professionals must achieve to protect their organizations against cyber security threats?: B. Nonrepudiation
36.Which of the following data protection techniques is reversible when con- ducted properly?: A. Tokenization
37.Which one of the following statements is not true about compensating controls under PCI DSS?: A.
Controls used to fulfill one PCI DSS requirement may not be used to compensate for the abscense of a control to
meet another requirement
38.Which of the following measures is not commonly used to assess threat intelligence?: B. Detail
39.Which one of the following motivations is most commonly attributed to hacktivists?: C. Political and
philosophical beliefs
40.Kolin is a penetration tester who works for a cybersecurity company. His firm was hired to conduct a
penetration test against a health-care system, and Kolin is working to gain access to the systems belonging to a
hospital in that system. What term best describes Kolin's work?: A. Authorized hacker
41.Which one of the following attackers is most likely to be associated with an APT?: A. Nation-state actor
42.Which organization did the U.S. government help create to share knowl- edge between organizations in
specific verticals?: D. ISACs
43.Which of the following threat actors typically has the greatest access to resources?: A. Nation-state actors
44.Of the threat vectors shown here, which one is most commonly exploited by attackers who are at a distant
location?: A. Email
45.Which of the following is the best example of a hacktivist group?: D. Anonymous
46.What type of assessment is particularly useful for identifying insider threats?: A. Behavioral
47. Cindy is concerned that her organization may be targeted by a supply chain attack and is conducting a
review of all of her vendor and supplier partners. Which one of the following organizations is least likely to be the
conduit for a supply chain attack?: D. Talent provider
SY0-701
1. The organization that Chris works for has disabled automatic updates. What is the most common reason for
disabling automatic updates for organizational systems?: C. To avoid issues with problematic patches and updates
2. Which of the following is the least volatile according to the forensic order of volatility?: B. Logs
3. Ed wants to trick a user to connecting to his evil twin access point (AP). What type of attack should he
conduct to increase his chances of the user connecting to it?: A. A dissociation attack
4. What term is used to describe wireless site surveys that show the relative power of access points on a diagram
of the building or facility?: D. Heatmaps
5. What hardware device is used to creae the hardware root of trust for modern desktops and laptops?: D. The
TPM
6. Angela wants to prevent users in her organization from changing their passwords repeatedly so that they
cannot reuse their current password. What two password security settings does she need to implement to make
this occur?: A. Set a password history and a minimum password age
7. Chris wants to establish a backup site that is fully ready to take over for full operations for his organization at
any time. What type of site should he set up?: C. A hot site
8. Which of the following is not a common constraint of embedded and spe- cialized systems?: B. Overly
complex firewall settings
9. Gary is reviewing his systems SSH logs and sees logins for the user named "Gary" with passwords like
password1, password2,...,PassworD. What type of attack has Gary discovered?: A. A dictionary attack
10.Kathleen wants to set up a system that allows access into a high-security zone from a low-security zone. What
type of solution should she configure?: D. A jump server
11.Derek's organization is worried about a disgruntled employee publishing sensitive business information.
What type of threat should Derek work to protect against?: C. Insider threats
12.Jeff is concerned about the effects that a ransomware attack might have on his organization and is designing
a backup methodology that would allows the organization to quickly restore after such an attack. What type of
control is Jeff implementing?: A. Corrective
13.Samantha is investigating a cybersecurity incident where an internal user used his computer to participate in
a denial of service attack against a third party. What type of policy was most likely violated?: C. AUP (acceptable
use policy)
, CompTIA Security+ Study Guide
SY0-701
14.Jean recently completed the user acceptance testing process and is get- ting her code ready to deploy. What
environment should house her code before it is release for use?: D. Staging
15.Oren obtained a certificate for his domain covering *. acmewidgets.net. Which one of the following domains
would not be covered by this certificate?
A. www.acmewidgets.net
B. acmewidgets.net
C. test.mail.acmewidgets.net
D. mobile.acmewidgets.net: C. test.mail.acmewidgets.net
16.Richard is sending a message to Grace and would like to apply a digital signature to the message before
sending it. What key should he use to create the digital signature?
A. Richard's private key
B. Richard's public key
C. Grace's Private Key
D. Grace's public key: A. Richard's private key
17.Andrew is workng with his financial team to purchase a cybersecurity insurance policy to cover the
financial impact of a data breach. What type of risk management strategy is he using?: B. Risk transference
18.Shelly is writing a document that describes the steps that incident re- sponse teams will follow upon first
notice of a potential incident. What type of document is she creating?: C. Procedure
19.Rob has created a document that describes how staff in his organization can use organizationally owned
devices, including if and when personal use is allowed. What type of policy has Rob created?: B. An acceptable
use policy
20.Matt is updating the organization's threat assessment process. What cat- egory of control is Matt
implementing?: D. Managerial
21. Jade's organization recently suffered a security breach that affected stored credit card data. Jade's
primary concern is the fact that the organization is subject to sanctions for violating the provisions of the
Payment Card Industry Data Security Standard. What category of risk is concerning Jade?: B. Compli- ance
22.Chris is responding to a security incident that compromised one of his organization's web servers. He believes
that the attackers defaced one or more
, CompTIA Security+ Study Guide
SY0-701
pages on the website. What cybersecurity objective did this attack violate?: C. Integrity
23.Tonya is concerned about the risk an attacker will attempt to gain access to her organization's database
server. She is searching for a control that would discourage the attacker from attempting to gain access. What
type of security control is she seeking to implement?: D. Deterrent
24.Greg is implementing a data loss prevention system. He would like to ensure that it protects against
transmissions of sensitive information by guests on his wireless network. What DLP technology would best
meet this goal?
A. Watermarking
B. Pattern recognition
C. Host-based
D. Network-based: D. Network-based
25.What term describes data that is being sent between two systems over a network connection?: B. Data in
transit
26.Tina is tuning her organization's intrusion prevention system to prevent false positive alerts. What type of
control is Tina implementing?: A. Technical control
27.Which one of the following is not a common goal of a cybersecurity attacker?: D. Allocation
28.Tony is reviewing the status of his organization's defenses against a breach of their file server. He believes
that a compromise of the file server could reveal information that would prevent the company from continuing to
do business. What term best describes the risk that Tony is considering?
A. Strategic
B. Reputational
C. Financial
D. Operational: A. Strategic
29.Which of the following data elements is not commonly associated with identity theft?: C. Frequent flier
number
30.What term best describes an organization's desired security state?: A. Control objectives
31.What technology uses mathematical algorithms to render information un- readable to those lacking the
required key?: D. Data encryption
32. Greg recently conducted an assessment of his organization's security con- trols and discovered a
potential gap: the organization does not use full-disk encryption on laptops. What type of control gap exists in
this case?: D. Pre- ventive
, CompTIA Security+ Study Guide
SY0-701
33.What compliance regulation most directly affects the operations of a health-care provider?: A.
HIPAA
34.Nolan is writing an after action report on a security breach that took place in his organization. The attackers
stole thousands of customer records from the organization's database. What cybersecurity principle was most
impacted in this breach?: C. Confidentiality
35.Which one of the following objectives is not one of the three main ob- jectives that information security
professionals must achieve to protect their organizations against cyber security threats?: B. Nonrepudiation
36.Which of the following data protection techniques is reversible when con- ducted properly?: A. Tokenization
37.Which one of the following statements is not true about compensating controls under PCI DSS?: A.
Controls used to fulfill one PCI DSS requirement may not be used to compensate for the abscense of a control to
meet another requirement
38.Which of the following measures is not commonly used to assess threat intelligence?: B. Detail
39.Which one of the following motivations is most commonly attributed to hacktivists?: C. Political and
philosophical beliefs
40.Kolin is a penetration tester who works for a cybersecurity company. His firm was hired to conduct a
penetration test against a health-care system, and Kolin is working to gain access to the systems belonging to a
hospital in that system. What term best describes Kolin's work?: A. Authorized hacker
41.Which one of the following attackers is most likely to be associated with an APT?: A. Nation-state actor
42.Which organization did the U.S. government help create to share knowl- edge between organizations in
specific verticals?: D. ISACs
43.Which of the following threat actors typically has the greatest access to resources?: A. Nation-state actors
44.Of the threat vectors shown here, which one is most commonly exploited by attackers who are at a distant
location?: A. Email
45.Which of the following is the best example of a hacktivist group?: D. Anonymous
46.What type of assessment is particularly useful for identifying insider threats?: A. Behavioral
47. Cindy is concerned that her organization may be targeted by a supply chain attack and is conducting a
review of all of her vendor and supplier partners. Which one of the following organizations is least likely to be the
conduit for a supply chain attack?: D. Talent provider
