Free SY0-701 Practice Test Questions 2026

Explanation:
The scenario states that the user click-through rate has already exceeded the acceptable risk threshold, meaning users are clicking on phishing links despite awareness efforts. The management team wants to reduce the impact when a user clicks, not necessarily prevent the click itself.

Updating EDR (Endpoint Detection and Response) policies to block automatic execution of downloaded programs is a technical control that mitigates the damage after a click. For example, if a user downloads malicious software from a phishing link, EDR can prevent it from running automatically, containing the threat and reducing the impact (e.g., preventing ransomware execution or data exfiltration).

Why the others are incorrect:

A. Place posters around the office:
This is an awareness measure aimed at preventing clicks, not reducing impact after a click has occurred. It does not address the immediate impact of a successful phishing attempt.

B. Implement email security filters:
This is a preventive measure to stop phishing emails from reaching inboxes. While valuable, it is not foolproof (some emails may bypass filters), and the question focuses on reducing impact after a user clicks.

D. Create additional training:
This is another preventive measure to help users recognize phishing attempts. Like option A, it aims to reduce click-through rates but does not directly mitigate the impact if a user still clicks.

Reference:
This aligns with SY0-701 Objective 4.4 ("Given an incident, apply mitigation techniques or controls to secure an environment"). Defense-in-depth strategies include technical controls (like EDR) to contain threats even if human failures occur. EDR policies that restrict execution are a key layer for mitigating post-breach impact, as recommended in frameworks like NIST SP 800-83 ("Guide to Malware Incident Prevention and Handling").

Explanation:
The issue occurred because the new "deny any" policy blocked legitimate traffic, indicating that the policy was not thoroughly vetted. Testing the policy in a non-production environment (e.g., a lab or staging network) first would allow the technician to identify unintended consequences, such as blocking necessary server traffic, without impacting live operations. This is a core best practice in change management to validate configurations and avoid disruptions.

Analysis of Incorrect Options:

A. Documenting the new policy in a change request:
While documentation and change management are important, they do not inherently prevent misconfigurations. The change might still be approved and deployed without testing, leading to the same issue.

C. Disabling intrusion prevention signatures:
This is unrelated to ACL policies. Intrusion prevention systems (IPS) detect threats, while ACLs control traffic flow. Disabling IPS signatures would not prevent the "deny any" policy from blocking legitimate traffic.

D. Including an "allow any" policy above the "deny any" policy:
This would render the "deny any" policy ineffective, as all traffic would be allowed by the prior rule. It defeats the purpose of adding a restrictive policy and creates a security risk.

Reference:
This aligns with Domain 4.0: Security Operations, specifically change management and network configuration best practices. Testing in a non-production environment is emphasized in frameworks like ITIL and NIST SP 800-115 (Guide to Security Testing) to reduce risks associated with changes.

Explanation:
The penetration tester is performing active reconnaissance. Active reconnaissance involves directly interacting with the target system or network to gather information. In this case, port and service scans (e.g., using tools like Nmap) send packets to the target to discover open ports, running services, and other details. This type of reconnaissance is intrusive and can be detected by the target, as it generates traffic and may trigger security alerts.

Analysis of Incorrect Options:

B. Passive:
Passive reconnaissance involves gathering information without directly interacting with the target. Examples include reviewing public DNS records, social media profiles, or website archives. Since the tester is scanning the client environment, this is not passive.

C. Defensive:
Defensive reconnaissance is not a standard term in penetration testing. Defensive actions typically refer to security measures taken to protect systems, such as monitoring or intrusion detection.

D. Offensive:
While penetration testing is an offensive security activity, "offensive" is not a specific type of reconnaissance. Reconnaissance is categorized as either active or passive.

Reference:
This falls under Domain 1.0: General Security Concepts, specifically penetration testing phases. Active reconnaissance is a key step in the initial phase of a penetration test, as outlined in frameworks like NIST SP 800-115 (Guide to Security Testing and Assessment) and the Penetration Testing Execution Standard (PTES). It helps testers understand the attack surface before launching exploits.

Explanation:
The administrator is carrying out a data retention policy. This policy defines how long specific types of data (e.g., customer transactions) must be kept archived to meet legal, regulatory, or business requirements. Ensuring that information is stored for the proper time period directly aligns with retention rules, which often specify minimum and maximum durations for holding data before it can be securely disposed of.

Analysis of Incorrect Options:

A. Compromise:
This refers to a data breach or unauthorized access incident, not the archival of data for compliance.

C. Analysis:
Data analysis involves examining data to extract insights, not ensuring it is archived for a required duration.

D. Transfer:
Data transfer policies govern how data is moved between systems or locations (e.g., encryption during transit), not how long it is retained.

E. Inventory:
Data inventory involves cataloging what data exists, where it is stored, and how it is used, but it does not specify retention periods.

Reference:
This question falls under Domain 5.0: Security Program Management and Oversight, specifically data governance and compliance. Retention policies are critical for adhering to regulations like GDPR, HIPAA, or SOX, which mandate how long certain records must be preserved. NIST SP 800-53 (Control MP-6) and other frameworks emphasize the importance of proper data retention and disposal.

Explanation: Based on the logs, it seems that the host that originated the infection is 192.168.10.22. This host has a suspicious process named svchost.exe running on port 443, which is unusual for a Windows service. It also has a large number of outbound connections to different IP addresses on port 443, indicating that it is part of a botnet. The firewall log shows that this host has been communicating with 10.10.9.18, which is another infected host on the engineering network. This host also has a suspicious process named svchost.exe running on port 443, and a large number of outbound connections to different IP addresses on port 443. The other hosts on the R&D network (192.168.10.37 and 192.168.10.41) are clean, as they do not have any suspicious processes or connections.

Answer: See the Explanation part for all the Solution.

Explanation: To configure the site-to-site VPN between the two branch offices according to the provided requirements, here are the detailed steps and settings that need to be applied to the VPN concentrators:
Requirements:
Most secure algorithms should be selected.
All traffic should be encrypted over the VPN.
A secret password will be used to authenticate the two VPN concentrators.
VPN Concentrator 1 Configuration:
Phase 1:
Peer IP address: 5.5.5.10 (The IP address of VPN Concentrator 2)
Auth method: PSK (Pre-Shared Key)
Negotiation mode: MAIN
Encryption algorithm: AES256
Hash algorithm: SHA256
DH key group: 14
Phase 2:
Mode: Tunnel
Protocol: ESP (Encapsulating Security Payload)
Encryption algorithm: AES256
Hash algorithm: SHA256
Local network/mask: 192.168.1.0/24
Remote network/mask: 192.168.2.0/24
VPN Concentrator 2 Configuration:
Phase 1:
Peer IP address: 5.5.5.5 (The IP address of VPN Concentrator 1)
Auth method: PSK (Pre-Shared Key)
Negotiation mode: MAIN
Encryption algorithm: AES256
Hash algorithm: SHA256
DH key group: 14
Phase 2:
Mode: Tunnel
Protocol: ESP (Encapsulating Security Payload)
Encryption algorithm: AES256
Hash algorithm: SHA256
Local network/mask: 192.168.2.0/24
Remote network/mask: 192.168.1.0/24
Summary:
Peer IP Address: Set to the IP address of the remote VPN concentrator.
Auth Method: PSK for using a pre-shared key.
Negotiation Mode: MAIN for the initial setup.
Encryption Algorithm: AES256, which is a strong and secure algorithm.
Hash Algorithm: SHA256, which provides strong hashing.
DH Key Group: 14 for strong Diffie-Hellman key exchange.
Phase 2 Protocol: ESP for encryption and integrity.
Local and Remote Networks: Properly configure the local and remote network addresses to match each branch office subnet.
By configuring these settings on both VPN concentrators, the site-to-site VPN will meet the requirements for strong security algorithms, encryption of all traffic, and authentication using a pre-shared key.

Explanation:
The scenario specifically describes enhancing security by rapidly updating permissions when employees leave. The most critical action in this situation is to immediately disable the former employee's access to all systems, applications, and data to prevent any potential unauthorized access. Automating this process ensures it happens instantly upon termination, eliminating the delay and potential oversight of manual deprovisioning, which is a significant security risk.

Why the others are incorrect:

A) Provisioning resources:
This refers to the automated granting of access and setup of resources for new employees. It is the opposite of what is needed when an employee leaves.

C) Reviewing change approvals:
This automation would streamline the process for evaluating and approving requests to modify permissions or systems. While important for governance, it does not directly address the urgent need to remove access entirely when an employee departs.

D) Escalating permission requests:
This automation would route requests for additional access to the appropriate approving authority. Like option C, it deals with the granting or modification of access, not the revocation of access required during offboarding.

Reference:
This aligns with SY0-701 Objective 5.1 ("Explain the importance of personnel management policies"). A key element of these policies is the user account review and revocation process part of the offboarding procedure. Automating the disabling of access is a critical security control to enforce the principle of least privilege and immediately mitigate the risk posed by former employees. This is often part of Identity and Access Management (IAM) automation.

Explanation:
The correct answer is C. Lessons learned. This is the final phase of the incident response process, as defined by frameworks like NIST SP 800-61 (Computer Security Incident Handling Guide). The primary activities in this phase involve a thorough review of the entire incident. This includes:

What happened:
The timeline of the incident.

How well the team responded:
What went right and what went wrong during the response.

What can be improved:
Identifying gaps in tools, processes, or training.

Documenting these findings:
This documentation is formalized into reports.

These reports are crucial for several reasons. They are used to update incident response plans, refine security controls, provide evidence for legal or compliance purposes, and train staff to handle future incidents more effectively. The act of "generating reports" is a defining output of the Lessons Learned phase.

Why the other options are incorrect:

A. Recovery:
This phase focuses on actions taken to restore systems to normal operation. This includes restoring data from clean backups, rebuilding compromised systems, removing malware, and re-enabling production services. While documentation occurs here (e.g., what steps were taken to restore a server), the primary goal is restoration, not comprehensive report generation for process improvement.

B. Preparation:
This is the foundational phase where an organization gets ready to handle incidents. Activities include creating the Incident Response Plan (IRP), assembling a team (CSIRT), acquiring tools, and providing training. While reports like the IRP itself are created in this phase, the question refers to generating reports about a specific incident that just occurred, which happens after the fact in the Lessons Learned phase.

D. Containment:
This phase is about stopping the incident from causing further damage. It involves short-term containment (e.g., isolating a network segment) and long-term containment (e.g., applying patches while the system is offline). The focus is on immediate, tactical action. Documentation in this phase is about logging the actions taken, but the formal, after-action reporting is saved for the Lessons Learned phase.

Reference:
This structure aligns with the incident response lifecycle as detailed in the NIST Special Publication 800-61, Revision 2, which is a key reference point for the CompTIA Security+ exam. The four common phases are often listed as:

Preparation

Detection and Analysis

Containment, Eradication, and Recovery

Post-Incident Activity (Lessons Learned)

Explanation:
Secure Access Service Edge (SASE) is a cloud-native architecture that combines comprehensive networking and security services (e.g., VPN, firewall as a service, zero-trust network access, secure web gateway, data loss prevention) into a single, scalable solution. By deploying SASE:

Reduces VPN traffic:
Remote employees can access cloud services and the internet directly through the SASE provider's global network, rather than backhauling all traffic through the organization's VPN concentrator and internet circuit. Only traffic destined for the data center would use an encrypted tunnel.

Provides encrypted tunnel access to the data center:
SASE includes zero-trust principles, ensuring secure, encrypted access to internal resources without requiring traditional VPNs.

Monitors remote employee internet traffic:
Integrated security services (like a secure web gateway) inspect and filter internet traffic for threats, regardless of the employee's location, ensuring compliance and security.

This addresses all the organization's goals:
scaling issues, reduced VPN/internet circuit traffic, secure data center access, and internet traffic monitoring.

Analysis of Incorrect Options:

B. Building a load-balanced VPN solution with redundant internet:
This might improve VPN availability and performance but does not reduce traffic—it adds infrastructure cost and complexity. All remote traffic still flows through the organization's internet circuit, exacerbating the scaling issue.

C. Purchasing a low-cost SD-WAN solution for VPN traffic:
SD-WAN optimizes network connectivity between sites (e.g., branches) but is not designed for remote employees. It does not inherently reduce VPN traffic or provide internet traffic monitoring for individual remote users.

D. Using a cloud provider to create additional VPN concentrators:
This scales VPN capacity but does not reduce traffic on the organization's internet circuit. All remote traffic still routes through the organization's network, and it adds cost without solving the fundamental inefficiency of backhauling internet traffic.

Reference:
This aligns with Domain 3.0: Security Architecture, specifically modern remote work solutions. SASE is endorsed by Gartner and frameworks like NIST SP 800-46 (Guide to Enterprise Telework and Remote Access Security) for its ability to consolidate security and networking while reducing reliance on traditional VPNs. It supports scalability, direct-to-cloud access, and consistent security policies for distributed users.

Explanation:

E. The device's encryption level cannot meet organizational standards:
If a device cannot support the required encryption protocols (e.g., TLS 1.2+, AES-256), it poses a significant security risk. Data transmitted or stored by the device could be vulnerable to interception or theft. Decommissioning is necessary to maintain compliance and protect sensitive information.

F. The device is unable to receive authorized updates:
Devices that no longer receive security patches (e.g., end-of-life hardware/software) are exposed to unmitigated vulnerabilities. This makes them easy targets for attackers and could compromise the entire network. Decommissioning eliminates this risk.

Why the others are incorrect:

A. The device has been moved from a production environment to a test environment:
This does not require decommissioning; repurposing devices for testing is common and acceptable if properly isolated.

B. The device is configured to use cleartext passwords:
This is a security misconfiguration that should be fixed (e.g., by enabling encryption), not a reason to decommission the device outright.

C. The device is moved to an isolated segment on the enterprise network:
Isolation (e.g., network segmentation) is a risk mitigation strategy, not a reason for decommissioning.

D. The device is moved to a different location in the enterprise:
Relocation does not inherently justify decommissioning; devices are often moved for operational reasons.

Reference:
This aligns with SY0-701 Objective 3.4 ("Given a scenario, implement secure network designs") and risk management principles. Devices that cannot meet security standards (e.g., encryption, patch compliance) should be decommissioned to prevent vulnerabilities, as recommended by frameworks like NIST SP 800-53 (Security and Privacy Controls) and industry best practices.

Explanation:
The requirement is to remotely and securely transfer files via the command line. The protocols must provide encryption for security and be suitable for command-line use:

A. SSH (Secure Shell):
This protocol provides encrypted remote command-line access to servers. While it is primarily used for secure remote administration, it can also facilitate secure file transfers when combined with tools like scp (Secure Copy Protocol), which runs over SSH.

F. SFTP (SSH File Transfer Protocol):
This is a secure file transfer protocol that operates over SSH. It is designed specifically for encrypted file transfers and is commonly used in command-line environments (e.g., via sftp commands).

Together, SSH and SFTP enable secure remote access and file transfers from the command line.

Why the others are incorrect:

B. SNMP (Simple Network Management Protocol):
Used for monitoring and managing network devices, not for file transfers.

C. RDP (Remote Desktop Protocol):
Provides graphical remote access to Windows systems, not command-line file transfers.

D. S/MIME (Secure/Multipurpose Internet Mail Extensions):
Used for encrypting email messages, not file transfers between servers.

E. SMTP (Simple Mail Transfer Protocol):
Used for sending email, not for secure file transfers.

Reference:
This aligns with Domain 3.1: Given a scenario, implement secure protocols. SSH and SFTP are standard protocols for secure remote access and file transfers, emphasizing confidentiality and integrity in data exchange.

Explanation:
Time-of-day restrictions are a type of access control that limits when users can access systems or resources based on specific times or schedules. This directly addresses the requirement to ensure employees can only access corporate systems during their shifts. For example, access can be automatically granted at the start of a shift and revoked at the end.

Why the others are incorrect:

A. Role-based access control (RBAC):
This assigns permissions based on a user's role in the organization (e.g., manager, analyst). While RBAC controls what users can access, it does not inherently restrict when they can access it.

C. Least privilege:
This principle ensures users have only the minimum permissions necessary to perform their job functions. It focuses on limiting the scope of access (what resources), not the timing of access.

D. Biometric authentication:
This is a method for verifying identity (e.g., fingerprints, facial recognition) during login. It enhances security but does not control access based on time schedules.

Reference:
This aligns with SY0-701 Objective 3.3 ("Given a scenario, implement secure identity and access management"). Time-based access controls are a specific feature of IAM systems (e.g., in Active Directory or identity solutions) used to enforce temporal restrictions, as recommended for shift-based workers or compliance requirements.