• Home
• CompTIA Exams
• SY0-701 - CompTIA Security+

SY0-701 CompTIA Practice Test Questions and Exam Dumps

Question No 1:

In the context of cybersecurity threats, different types of attackers (threat actors) have varying motivations and levels of sophistication.
You are studying how critical systems — such as power grids, communication networks, and government databases — are targeted by external forces.

Which type of threat actor is most likely to be hired or supported by a foreign government with the specific objective of compromising, damaging, or spying on critical infrastructure in other nations?

A. Hacktivist
B. Whistleblower
C. Organized crime
D. Unskilled attacker

Correct Answer: C. Organized crime

Explanation:

Among the listed options, organized crime groups are the threat actors most likely to be hired by foreign governments to attack critical systems in other countries.
Organized cybercrime groups are highly skilled, well-funded, and structured similarly to legitimate businesses, with specialized teams for different tasks (e.g., malware development, infiltration, data exfiltration).
Because of their expertise and resources, they are often contracted by nation-states to perform cyber espionage, sabotage, or attacks that governments want to distance themselves from publicly.

While nation-state actors (government-employed hackers) are the direct answer in many cases, when governments want to maintain plausible deniability, they turn to external, non-governmental groups like organized cybercriminals.

Why the other options are incorrect:

• A (Hacktivist): Hacktivists are driven by political or social causes. They operate independently to promote agendas, not typically under direct government contracts.

• B (Whistleblower): Whistleblowers are insiders exposing wrongdoing, often at personal risk, and are not attackers trying to damage systems.

• D (Unskilled attacker): Sometimes called "script kiddies," unskilled attackers lack the sophistication needed for targeting complex, high-value systems.

Thus, organized crime is the most realistic choice, as they possess the technical expertise, motivation for profit, and willingness to work on behalf of a government for financial or political incentives.
This connection between organized cybercrime and nation-state operations has been documented in many real-world cyberattacks on critical infrastructure around the globe.

Question No 2:

In cybersecurity, one-way data transformation algorithms such as hashing are commonly used to protect sensitive information like passwords. However, to strengthen security against attacks like rainbow table lookups or precomputed hash attacks, an additional step is often implemented to add more complexity before the one-way transformation is performed.

Which of the following techniques is specifically used to introduce extra complexity into the input before applying a one-way data transformation algorithm?

A. Key stretching
B. Data masking
C. Steganography
D. Salting

Correct Answer: D. Salting

Explanation:

Salting is a security technique used to add randomness to data before it undergoes a one-way transformation like hashing.
A salt is a unique, random value added to the input (such as a password) before it is hashed. This ensures that even if two users have the same password, their resulting hashes will be different because the salt value makes the input unique for each case.

The primary purpose of salting is to defend against attacks such as rainbow table attacks and precomputed hash attacks.
Without salting, attackers could use a precompiled list of common password hashes to easily reverse engineer stored passwords. With salting, even if two users choose "Password123," the resulting hash values will differ because each password is combined with a different salt value before hashing.

Why the other options are incorrect:

• A (Key stretching): Key stretching increases the computation time required to hash passwords but doesn’t itself add randomness before hashing. It often works after salting.

• B (Data masking): Data masking hides or obscures sensitive data but is not related to one-way transformations like hashing.

• C (Steganography): Steganography is about hiding data within other non-secret data (like images) and is unrelated to enhancing hash security.

In short, salting is a simple but powerful method that significantly increases the security of hashed data, making it harder for attackers to compromise multiple records at once even if they obtain the hash database.

Question No 3:

An employee received an email appearing to be from a trusted online payment website, requesting them to update their contact information.
The employee clicked on the link provided in the email, entered their login credentials on the web page that opened, but immediately encountered a "page not found" error after submitting the information.
Later investigation revealed that the email and the website were fraudulent.

Which type of social engineering attack best describes this situation?

A. Brand impersonation
B. Pretexting
C. Typosquatting
D. Phishing

Correct Answer: D. Phishing

Explanation:

This scenario is a classic example of phishing.
Phishing attacks involve tricking users into providing sensitive information, such as usernames, passwords, or credit card details, by impersonating a legitimate entity through email, text messages, or fake websites.
The attacker typically crafts a convincing email (in this case, supposedly from a payment website) and provides a link to a fraudulent site that looks almost identical to the real one.
When the employee entered their login credentials, the information was captured by the attacker, even though the site returned a "page not found" error — a common tactic to avoid arousing suspicion immediately.

Why the other options are incorrect:

• A (Brand impersonation): While phishing often involves brand impersonation, brand impersonation alone refers to mimicking a company’s image. The full attack process (tricking the user to enter credentials) matches phishing specifically.

• B (Pretexting): Pretexting involves an attacker creating a fabricated story or scenario to steal information but typically through direct interaction (like a fake phone call), not deceptive websites.

• C (Typosquatting): Typosquatting involves registering domain names similar to popular websites (like goggle.com instead of google.com) to catch typing errors. Here, the attack came through a phishing email, not mistyped URLs.

Thus, the correct classification is phishing, as the employee was deceived into willingly giving up credentials via a fraudulent message and website.

Question No 4:

An organization wants to tightly control outbound DNS traffic from its internal network. Only a single device, with IP address 10.50.10.25, should be permitted to send DNS requests to external servers. All other outbound DNS traffic must be blocked.

Which of the following firewall ACL configurations correctly enforces this requirement?

A.
Access list outbound permit 0.0.0.0/0 0.0.0.0/0 port 53
Access list outbound deny 10.50.10.25/32 0.0.0.0/0 port 53

B.
Access list outbound permit 0.0.0.0/0 10.50.10.25/32 port 53
Access list outbound deny 0.0.0.0/0 0.0.0.0/0 port 53

C.
Access list outbound permit 0.0.0.0/0 0.0.0.0/0 port 53
Access list outbound deny 0.0.0.0/0 10.50.10.25/32 port 53

D.
Access list outbound permit 10.50.10.25/32 0.0.0.0/0 port 53
Access list outbound deny 0.0.0.0/0 0.0.0.0/0 port 53

Correct Answer:

D.

Access list outbound permit 10.50.10.25/32 0.0.0.0/0 port 53
Access list outbound deny 0.0.0.0/0 0.0.0.0/0 port 53

Explanation:

To meet the requirement, the firewall must allow DNS (port 53) traffic only from the specific internal IP address (10.50.10.25) while blocking all other devices from sending DNS requests to the outside world.

Let’s break down the logic:

• Permit Rule:
  The ACL must first permit DNS traffic originating from 10.50.10.25 to any external destination (0.0.0.0/0) on port 53 (which is the standard DNS port). This ensures the intended device can communicate with DNS servers.

• Deny Rule:
  Immediately after, a deny rule must be in place to block all other outbound DNS traffic, regardless of the source IP address. This prevents unauthorized devices on the network from bypassing DNS restrictions.

Now let's review the options:

• Option A incorrectly permits all traffic and denies only traffic from 10.50.10.25, which is the opposite of what we want.

• Option B mistakenly uses 10.50.10.25 as the destination, not the source.

• Option C broadly allows all outbound DNS traffic and only denies traffic destined to 10.50.10.25, which is irrelevant here.

• Option D correctly permits the specific device and then denies all other outbound DNS traffic.
  
  

In firewall ACLs, the order of the rules matters because the firewall evaluates traffic sequentially from top to bottom. Thus, the permit must come first, followed by the deny for maximum effectiveness.

By applying Option D, the organization enforces strict DNS control, ensuring that only the trusted device can perform DNS queries while maintaining a secure network environment.

Question No 5:

A company's data administrator is setting up authentication for a new SaaS (Software as a Service) application. To simplify user access and reduce the number of passwords employees must remember, the company wants users to log in using their existing domain credentials.

Which authentication method would best meet these requirements?

A. SSO
B. LEAP
C. MFA
D. PEAP

Correct Answer: A. SSO (Single Sign-On)

Explanation:

In this scenario, the company's primary goal is to minimize the number of credentials that employees must manage while ensuring they can securely access a new SaaS application using their existing domain credentials (e.g., Active Directory usernames and passwords).

The best solution for this requirement is Single Sign-On (SSO). SSO is an authentication method that allows users to authenticate once and then gain access to multiple systems or applications without needing to log in separately to each one. When SSO is integrated with the company's domain authentication (such as Active Directory or LDAP services), users can access the new SaaS application seamlessly using the same credentials they already use for internal resources.

Now, let's quickly review the other options:

• LEAP (Lightweight Extensible Authentication Protocol): This is a Cisco-proprietary wireless authentication protocol, not typically used for SaaS or web applications.

• MFA (Multi-Factor Authentication): While MFA strengthens authentication by requiring multiple verification steps (e.g., password + phone verification), it does not reduce the number of credentials; it adds another step.

• PEAP (Protected Extensible Authentication Protocol): This is primarily used to secure wireless network authentication, similar to LEAP, and is not directly used for integrating domain credentials with SaaS applications.

Thus, SSO is the only method listed that aligns perfectly with the company's need for simplified user access, reduced password fatigue, and seamless authentication using existing domain credentials.
Implementing SSO not only improves user convenience but also enhances security by centralizing authentication and reducing the chances of password reuse across platforms.

Question No 6:

Business email compromise (BEC) attacks are a major cybersecurity threat, often involving deceptive emails crafted to trick employees into taking harmful actions such as sending money, revealing confidential information, or granting access to systems. These attacks usually rely on impersonating trusted individuals within an organization. 

Which of the following scenarios best exemplifies a potential business email compromise (BEC) attack?

A. An employee receives a gift card request in an email that shows an executive’s name in the display field.
B. Employees who open an email attachment are confronted with ransom messages demanding payment to unlock their files.
C. A service desk employee gets an email from someone posing as the HR director, asking for cloud administrator log-in credentials.
D. An employee is sent an email link that redirects to a fake company email login page resembling the real one.

Answer:
A. An employee receives a gift card request in an email that shows an executive’s name in the display field.

Explanation:

A business email compromise (BEC) attack is a form of social engineering where attackers impersonate trusted figures like executives, managers, or suppliers to trick employees into performing unauthorized actions. One of the most common tactics involves requesting the purchase of gift cards under the pretense of a company need, often framed as urgent or confidential.

In the provided scenario, an employee receives an email that appears to come from an executive, requesting gift cards. Although the email display name matches a legitimate executive, the underlying sender address is usually a spoofed or fraudulent account. Attackers exploit the perceived authority of executives to manipulate employees into fulfilling unusual requests without thorough verification.

Option A fits the BEC profile perfectly because it involves impersonation, urgency, and a financial request—all hallmarks of such attacks.

While options B, C, and D involve other forms of cyber threats (like ransomware or phishing), they are categorized differently. Ransomware (B) locks files for ransom. Phishing (C and D) tricks users into divulging credentials or information but does not strictly fall under the specific tactics typically used in BEC attacks.

BEC attacks are particularly dangerous because they often avoid traditional malware or malicious attachments, making them harder for security software to detect. Instead, they rely entirely on human error and psychological manipulation, leading to significant financial losses for businesses worldwide.

Thus, option A is the clearest example of a business email compromise attack.

Question No 7:

To enhance network security, a company has implemented strict access controls by blocking direct connections from database administrators' personal workstations to the network segment that houses critical database servers. 

Given this security measure, what solution should a database administrator utilize to securely access the database servers while maintaining compliance with the organization's security policies?

A. Jump server
B. RADIUS
C. HSM
D. Load balancer

Answer: A. Jump server

Explanation:

When organizations restrict direct access to sensitive network segments, particularly those containing database servers, they commonly introduce an intermediary system known as a jump server (or jump box). A jump server acts as a tightly controlled and monitored bridge between user workstations and critical systems. Database administrators would first connect securely to the jump server, which then allows controlled access to the database servers within the protected network zone.

This setup significantly improves security by isolating critical assets from direct exposure and enabling detailed auditing of administrative activities. Jump servers often require multi-factor authentication, session recording, and tight permission controls, ensuring that only authorized personnel can proceed to access internal systems.

The other options listed do not fit this situation as precisely. RADIUS is a protocol used for centralized authentication, authorization, and accounting, but it does not directly facilitate workstation-to-server access. HSM (Hardware Security Module) is used for managing digital keys and cryptographic operations, not server access. Load balancers distribute network or application traffic across multiple servers for efficiency and reliability but are unrelated to administrative access paths.

In this scenario, setting up a jump server ensures that database administrators maintain secure, logged, and policy-compliant access to sensitive database systems. It establishes a necessary security buffer zone, making it much harder for potential attackers to penetrate critical parts of the network directly. This approach is considered a cybersecurity best practice for organizations that prioritize data protection and operational integrity.

Thus, option A, the use of a jump server, is the most appropriate solution for the database administrators under the described conditions.

Question No 8:

An organization's public-facing website was recently compromised after an attacker successfully exploited a buffer overflow vulnerability. To better protect against similar types of attacks targeting their web applications in the future, 

Which of the following security solutions should the organization implement?

A. NGFW
B. WAF
C. TLS
D. SD-WAN

Answer: B. WAF

Explanation:

A Web Application Firewall (WAF) is specifically designed to safeguard web applications by filtering, monitoring, and blocking malicious HTTP traffic to and from a web service. In this case, where a buffer overflow attack led to the compromise of an internet-facing website, a WAF would provide the most direct and specialized protection.

Buffer overflow vulnerabilities typically occur when attackers send more data to an application than it can handle, leading to unpredictable behavior, crashes, or even remote code execution. A WAF can detect such malicious patterns by analyzing HTTP requests in real-time and applying rules that identify and block common attack techniques, including buffer overflows, SQL injection, cross-site scripting (XSS), and more.

The other options listed, while valuable, are less focused on the specific threat described. An NGFW (Next-Generation Firewall) provides broad network security functions such as deep packet inspection and intrusion prevention, but it is not primarily tailored to protect against web application vulnerabilities. TLS (Transport Layer Security) encrypts data between users and servers, securing communication but not protecting against vulnerabilities within the application code itself. SD-WAN (Software-Defined Wide Area Network) optimizes and manages network traffic across multiple locations but offers no direct defense against application-layer attacks.

Deploying a WAF strengthens the security posture of an organization by mitigating the risk of application-layer attacks, providing virtual patching for known vulnerabilities, and shielding web applications even before development teams can fully remediate underlying code issues. In environments where critical websites must remain operational and secure, a WAF is considered an essential layer of defense.

Therefore, to best protect against future buffer overflow attacks and similar web-based threats, the organization should implement a Web Application Firewall (WAF).

Question No 9:

An IT administrator observes that multiple employee accounts are being accessed from unusual and suspicious IP addresses. After verifying with the users, the administrator confirms that these login attempts were unauthorized and were not initiated by the employees themselves. As a precautionary measure, the administrator resets the passwords for all affected accounts. Looking ahead, the administrator wants to implement a more effective security measure to protect user accounts against such unauthorized access incidents in the future. 

Which security control should the administrator put in place to best mitigate this type of threat?

A. Multifactor authentication
B. Permissions assignment
C. Access management
D. Password complexity

Correct Answer: A. Multifactor authentication

Explanation:

In this situation, the administrator is dealing with unauthorized login attempts from suspicious IP addresses. While resetting passwords is an important immediate response, it does not fully address the underlying vulnerability that allowed attackers to compromise accounts. The most effective long-term solution is the implementation of Multifactor Authentication (MFA).

Multifactor Authentication significantly enhances security by requiring users to present two or more independent credentials to verify their identity. These factors typically include something the user knows (a password), something the user has (a mobile device or hardware token), and something the user is (biometric data like fingerprints or facial recognition). Even if an attacker manages to obtain a user's password through phishing, brute-force attacks, or data breaches, they would still be unable to access the account without the second authentication factor.

Other options listed—such as permissions assignment and access management—are critical for controlling what users can do once they are logged in, but they do not prevent unauthorized logins. Password complexity can make passwords harder to guess, but it alone cannot stop attacks if a password is stolen or leaked.

By enabling MFA, the administrator introduces an additional barrier that makes unauthorized access dramatically more difficult. It effectively reduces the risk of account compromise, even in cases where user credentials are exposed. This method is widely recommended in cybersecurity best practices for securing sensitive systems, remote access points, and personal data against evolving threat landscapes.

In summary, Multi Factor Authentication provides a vital layer of security that protects accounts beyond just passwords, making it the best defense to prevent this type of attack from succeeding again in the future.

Question No 10:

An employee is contacted via text message, with the sender claiming to be from the company's payroll department. The message urgently requests the employee to verify their login credentials by clicking a provided link. Based on this situation, which two social engineering techniques are being utilized? (Select two.)

A. Typosquatting
B. Phishing
C. Impersonation
D. Vishing
E. Smishing
F. Misinformation

Correct Answer:

B. Phishing
E. Smishing

Explanation:

In this situation, two specific social engineering methods are being deployed: Phishing and Smishing.

Phishing is a common attack technique where a cybercriminal pretends to be a legitimate source, like a company's payroll department, to trick individuals into sharing sensitive information such as usernames, passwords, or financial details. The message in this scenario is an example of phishing because it is attempting to deceive the employee into providing credential information under false pretenses.

Smishing (short for "SMS phishing") is a variant of phishing that specifically uses text messages (SMS) instead of email or websites to target victims. The message in this case is sent via text, making it a textbook example of smishing. Attackers know that people tend to trust text messages more than emails, so they exploit this channel to increase the success rate of their attacks.

Impersonation (choice C) is partly involved since the attacker pretends to be the payroll department, but the primary methods here are phishing (deception for information theft) and smishing (using SMS to deliver the fraudulent message).

Typosquatting, vishing, and misinformation do not apply in this case:

• Typosquatting involves fake websites with URLs similar to real ones.

• Vishing refers to phishing over voice calls.

• Misinformation typically spreads false information but isn't focused on credential theft.

By combining phishing and smishing, attackers increase their chances of successfully capturing sensitive information quickly and discreetly.