Free SY0-701 Practice Test Questions 2026

Explanation
The scenario describes a Bring Your Own Device (BYOD) policy. The specific requirement is to control which applications can be installed on personal devices when used for work purposes.

MDM (A) - Mobile Device Management:
An MDM solution is a type of software that allows an organization to manage, monitor, and secure employees' mobile devices (laptops, smartphones, tablets) that are used for work. A core function of MDM is application whitelisting and blacklisting. This allows administrators to define policies that prevent the installation of non-approved apps and can even push approved applications to devices. This directly addresses the company's concern.

Why the other options are incorrect:

B. Containerization:
Containerization creates a secure, isolated environment on the device where corporate data and applications are stored. This separates work from personal data. While it protects corporate data from personal apps, it does not inherently prevent the user from installing any application they want on the personal side of the device. Its primary goal is data segregation, not application control.

C. DLP - Data Loss Prevention:
DLP solutions are designed to monitor, detect, and block the unauthorized transmission of sensitive data. They prevent data exfiltration but do not control which applications can be installed on a device.

D. FIM - File Integrity Monitoring:
FIM tools monitor critical system files and applications for changes (e.g., modification, deletion). They are used to detect unauthorized changes on servers and critical assets, often for compliance. They are not used to enforce application installation policies on user endpoints.

Reference
CompTIA Security+ SY0-701 Objective 3.6: Explain the importance of secure staging deployment concepts and secure mobile and small-form-factor devices.

This objective covers mobile device deployment and management. MDM is the standard solution for enforcing security policies—such as application allow lists/block lists—on mobile devices within an organization, especially in BYOD scenarios.

Explanation:
The scenario indicates that the company's online shopping website became unusable, and the security analyst noticed code related to backing up data on the database server. The mention of "code" in this context suggests that unauthorized or malicious code may have been executed, potentially compromising the database server. A common attack vector for such issues is command injection, where an attacker exploits a vulnerability to inject malicious commands into the system, often through improperly sanitized inputs in web applications. Reviewing the Web Application Firewall (WAF) logs is the most appropriate next step because:

WAF logs can reveal command injection attempts:
A WAF is designed to monitor and filter HTTP/HTTPS traffic to the web application. It can log attempts to exploit vulnerabilities like command injection, where malicious input (e.g., SQL queries, OS commands, or scripts) is sent to the server. If the website became unusable, the WAF logs may show evidence of malicious payloads or patterns, such as attempts to execute unauthorized commands.

Directly relevant to the web application:
Since the website is the entry point for the issue (it became unusable), the WAF logs are a logical place to look for evidence of an attack targeting the web application, which could have propagated to the database server.

Prioritizes identifying the attack vector:
Before diving into other possibilities (like malware or ransomware), confirming whether an external attack (e.g., command injection) occurred helps narrow down the root cause and informs subsequent investigation steps.

Why Not the Other Options?

A. Check for recently terminated DBAs:
While insider threats (e.g., a disgruntled former database administrator) are a possibility, there’s no direct evidence in the scenario pointing to insider activity. The focus on "code" and the website becoming unusable suggests an external attack, such as command injection, rather than an insider issue. Checking for terminated DBAs would be a later step if external attack vectors are ruled out.

C. Scan the database server for malware:
Scanning for malware is a reasonable step, but it’s not the next step. Malware could be a secondary effect of an initial compromise (e.g., via command injection). Reviewing WAF logs first helps identify whether an attack exploited the web application to deliver malicious code to the database server.

D. Search the web server for ransomware notes:
While ransomware could cause a website to become unusable, the scenario specifically mentions code related to "backing up data" on the database server, not a ransom note. Command injection is a more likely initial attack vector, and WAF logs would help confirm this before assuming ransomware.

Reference:
CompTIA Security+ (SY0-701) Objective: 3.3 - Given a scenario, analyze indicators of malicious activity. Official CompTIA Guidance: The CompTIA Security+ Study Guide emphasizes analyzing logs (including WAF logs) to identify attack patterns, such as command injection, which is a common web application vulnerability.

OWASP Top Ten: Command injection is a critical web application security risk (A03:2021 - Injection). OWASP recommends reviewing logs and implementing WAFs to detect and prevent injection attacks.

NIST SP 800-53: AU-6 (Audit Review, Analysis, and Reporting) highlights the importance of reviewing logs to detect malicious activity.

Explanation:
When a company wants to wipe sensitive data from hard drives in a repeatable manner while allowing the drives to be reused, sanitization is the most appropriate option. Sanitization refers to the process of securely erasing data from a storage device so that it cannot be recovered, while preserving the drive's functionality for reuse. This is critical for organizations handling sensitive data to prevent unauthorized access while repurposing hardware. Here’s why sanitization is the best choice:

Secure Data Removal:
Sanitization uses methods like overwriting (e.g., with zeros, ones, or random patterns) to ensure data is irretrievable. Tools like DBAN (Darik's Boot and Nuke) or standards like NIST 800-88 provide guidelines for secure sanitization.

Repeatable Process:
Sanitization follows standardized procedures (e.g., multiple overwrite passes) that can be consistently applied across multiple drives, ensuring compliance with data protection regulations.

Drive Reusability:
Unlike destructive methods (e.g., degaussing), sanitization does not damage the drive, allowing it to be reused for other purposes.

Why Not the Other Options?

B. Formatting:
Formatting a hard drive (e.g., quick format or standard format) only removes the file system structure, not the actual data. Sensitive data can still be recovered using forensic tools, making formatting insufficient for secure data removal.

C. Degaussing:
Degaussing uses strong magnetic fields to erase data from magnetic storage devices (e.g., HDDs). While effective, it renders the drive unusable because it disrupts the drive’s magnetic alignment, making it unsuitable for reuse.

D. Defragmentation:
Defragmentation reorganizes data on a drive to optimize performance but does not remove or erase data. It is irrelevant for securely wiping sensitive information.

Additional Context:

Sanitization Methods: According to NIST SP 800-88 (Guidelines for Media Sanitization), sanitization can involve:

Clear: Overwriting data with software tools (e.g., one or more passes of random data).

Purge: Using cryptographic erasure or secure erase commands (e.g., for SSDs).

Destroy: Physical destruction (not applicable here since reuse is required).

Use Case: Sanitization is commonly used in industries like healthcare, finance, or government to comply with regulations like GDPR, HIPAA, or PCI DSS when retiring or repurposing hardware.

Reference:

CompTIA Security+ (SY0-701) Objective: 2.4 - Given a scenario, implement secure systems design (data destruction and media sanitization).

NIST SP 800-88: Guidelines for Media Sanitization provide detailed procedures for securely erasing data while allowing drive reuse.

CompTIA Security+ Study Guide: Emphasizes sanitization as the standard for secure data removal when drives are to be reused, contrasting it with formatting (insecure) and degaussing (destructive).

Explanation:
The scenario describes the marketing department setting up its own project management software without informing the appropriate departments (e.g., IT or security teams). This is a classic example of Shadow IT, which occurs when individuals or departments deploy IT systems, software, or services without the knowledge, approval, or oversight of the organization’s IT or security teams. Here’s why Shadow IT is the best answer:

Unauthorized Deployment:
Shadow IT involves the use of unapproved technology solutions, such as software or cloud services, outside the organization’s formal IT governance processes. In this case, the marketing department’s independent setup of project management software fits this definition.

Lack of Oversight:
By bypassing the IT department, the marketing team likely avoided security assessments, compliance checks, or integration with existing systems, which can introduce risks like vulnerabilities, data breaches, or compatibility issues.

Common in Organizations:
Shadow IT is prevalent when departments seek quick solutions to meet their needs, often due to perceived inefficiencies in formal IT processes. However, it can lead to security gaps and unmanaged risks.

Why Not the Other Options?

B. Insider threat:
An insider threat involves malicious or negligent actions by individuals within the organization that harm its security (e.g., stealing data or sabotaging systems). While Shadow IT can create security risks, the scenario does not indicate malicious intent by the marketing department, only unauthorized use of software.

C. Data exfiltration:
Data exfiltration refers to the unauthorized transfer of data outside the organization, typically by an attacker or malicious insider. The scenario does not mention any data being stolen or transferred, only the setup of software.

D. Service disruption:
Service disruption involves actions that interrupt or degrade system availability (e.g., a DDoS attack or system failure). The scenario does not indicate that the project management software caused any disruption, only that it was set up without approval.

Additional Context:

Risks of Shadow IT:
Shadow IT can lead to unpatched vulnerabilities, lack of monitoring, non-compliance with regulations (e.g., GDPR, HIPAA), and data leakage if the software is not properly secured.

Mitigation:
Organizations can address Shadow IT by improving IT service delivery, educating employees about risks, implementing robust IT governance, and using tools to detect unauthorized software (e.g., network monitoring or CASB solutions)

CompTIA Security+ Focus:
The SY0-701 exam emphasizes understanding organizational security risks, including Shadow IT, as part of governance, risk, and compliance (GRC) practices.

Reference:
CompTIA Security+ (SY0-701) Objective: 5.1 - Explain the importance of policies, plans, and procedures related to organizational security (Shadow IT as a governance issue).

NIST SP 800-53: SA-9 (External Information System Services) highlights the need for organizations to monitor and approve external or unauthorized systems to mitigate risks.

CompTIA Security+ Study Guide: Discusses Shadow IT as a common issue where departments deploy unapproved solutions, leading to potential security and compliance risks.

Explanation:
The scenario describes a data administrator configuring authentication for a SaaS application, aiming to reduce the number of credentials employees need to maintain by using existing domain credentials. Single Sign-On (SSO) is the best method to achieve this functionality. Here’s why SSO is the correct choice:

Definition of SSO:
Single Sign-On (SSO) allows users to authenticate once with a single set of credentials (e.g., domain credentials) and gain access to multiple applications or services without needing to log in separately for each. This reduces the number of credentials employees need to manage.

Integration with Domain Credentials:
SSO can integrate with an organization’s existing identity provider (IdP), such as Active Directory (AD) or LDAP, allowing employees to use their domain credentials to access SaaS applications. Protocols like SAML (Security Assertion Markup Language) or OAuth are commonly used to enable SSO with SaaS platforms.

User Experience and Security:
SSO simplifies the user experience by reducing password fatigue and minimizes the risk of weak or reused passwords, as employees only need to maintain one set of strong domain credentials.

Why Not the Other Options?

B. LEAP (Lightweight Extensible Authentication Protocol):
LEAP is a Cisco-proprietary authentication protocol primarily used for wireless networks (e.g., Wi-Fi authentication). It is not designed for SaaS application authentication or integration with domain credentials for multiple applications.

C. MFA (Multi-Factor Authentication):
MFA enhances security by requiring multiple forms of verification (e.g., password + token). While MFA can be used with SSO, it does not inherently reduce the number of credentials or enable the use of domain credentials across applications. MFA is a security enhancement, not an authentication streamlining method.

D. PEAP (Protected Extensible Authentication Protocol):
PEAP is a protocol used primarily for securing wireless network authentication, often with certificates or credentials. Like LEAP, it is not suitable for SaaS application access or reducing credential management for domain-based authentication.

Additional Context:

SSO Implementation:
Common SSO solutions include Okta, Microsoft Azure AD, or Ping Identity, which integrate with SaaS applications via standards like SAML or OpenID Connect. These solutions allow seamless access to applications like Salesforce, Google Workspace, or Microsoft 365 using domain credentials.

Security Considerations:
While SSO simplifies authentication, it should be paired with strong security practices (e.g., MFA, secure IdP configuration) to protect against credential compromise.

CompTIA Security+ Focus:
The SY0-701 exam emphasizes identity and access management (IAM), including SSO as a key method for streamlining authentication while maintaining security.

Reference:
CompTIA Security+ (SY0-701) Objective: 2.2 - Given a scenario, implement identity and access management (IAM) controls (authentication methods like SSO).

NIST SP 800-63B: Discusses authentication and identity federation, highlighting SSO as a method to streamline access across systems using a single set of credentials.

CompTIA Security+ Study Guide: Emphasizes SSO as a solution for reducing credential management overhead while enabling secure access to multiple applications, particularly in cloud and SaaS environments.

Explanation:
The scenario describes an employee clicking a malicious link in an email, leading to malware infection and the exfiltration of thousands of customer records. This indicates a social engineering attack (likely phishing), where the employee’s action was the initial entry point for the breach. To prevent similar incidents in the future, user awareness training is the most effective solution among the options provided, as it directly addresses the root cause: human error. Here’s why user awareness training is the best choice:

Addresses Human Vulnerability:
Phishing attacks exploit human behavior by tricking users into clicking malicious links or downloading harmful files. User awareness training educates employees on recognizing phishing emails, suspicious links, and other social engineering tactics, reducing the likelihood of falling for such attacks.

Proactive Prevention:
Training empowers employees to identify and report phishing attempts before they cause harm, preventing the initial compromise that leads to malware infection and data exfiltration.

Cost-Effective and Foundational:
User awareness training is a foundational cybersecurity practice that complements technical controls. It equips employees to act as the first line of defense, which is critical since many breaches start with human error.

Why Not the Other Options?

B. Network monitoring:
Network monitoring can detect unusual traffic patterns or data exfiltration after a compromise occurs (e.g., identifying large data transfers). However, it does not prevent the initial infection caused by an employee clicking a malicious link. It is a reactive measure rather than a preventive one for this specific scenario.

C. Endpoint protection:
Endpoint protection solutions (e.g., antivirus, EDR) can detect and block malware on devices, potentially stopping the malicious program from executing. While valuable, they may not catch all sophisticated malware, and they don’t address the root cause of the employee clicking the link in the first place.

D. Data loss prevention (DLP):
DLP solutions are designed to prevent unauthorized data exfiltration by monitoring and controlling data movement. While DLP could mitigate the impact of the breach by blocking the exfiltration of customer records, it does not prevent the initial malware infection caused by the phishing attack. DLP is a secondary control, not a primary prevention method for this scenario.

Reference:

CompTIA Security+ (SY0-701) Objective: 5.3 - Explain the importance of security awareness and training (social engineering prevention).

NIST SP 800-50: Building an Information Technology Security Awareness and Training Program emphasizes user training as a key strategy for reducing risks from phishing and social engineering.

CompTIA Security+ Study Guide: Highlights user awareness training as a primary defense against phishing attacks, stressing the need to educate employees on recognizing and avoiding malicious emails.

Explanation:
A zero-day vulnerability is an unknown or unpatched flaw in software or hardware that attackers can exploit before a fix is available. The scenario involves mission-critical production servers that must remain highly available, meaning downtime or significant changes (e.g., removal from production) are not feasible. The best mitigation in this context is monitoring and implementing compensating controls, as it allows the servers to remain operational while reducing the risk of exploitation until a patch or permanent fix is available. Here’s why monitoring and implementing compensating controls is the best choice:

Addresses Zero-Day Nature:
Since zero-day vulnerabilities lack an immediate patch, compensating controls (e.g., enhanced firewall rules, intrusion detection/prevention systems, or application whitelisting) can mitigate the risk by limiting the attack surface or detecting exploit attempts.

Maintains High Availability:
Mission-critical servers require minimal downtime. Monitoring (e.g., using SIEM or IDS/IPS) ensures real-time detection of suspicious activity, while compensating controls like disabling unnecessary services, restricting network access, or enabling stricter access controls help protect the servers without taking them offline.

Practical and Immediate:
Compensating controls can be implemented quickly (e.g., updating WAF rules or isolating specific ports) compared to complex solutions like virtualization or redeployment, which may introduce downtime or instability.

Why Not the Other Options?

A. Virtualizing and migrating to a containerized instance:
Virtualizing or migrating to containers requires significant time, testing, and potential downtime, which is impractical for mission-critical servers that must remain highly available. Additionally, the zero-day vulnerability may persist in the new environment if it’s in the application or OS, making this a less immediate solution.

B. Removing and sandboxing to an isolated network:
Removing servers from production and sandboxing them isolates the vulnerability but violates the requirement for high availability. Mission-critical systems cannot be taken offline without significant business impact, making this option infeasible.

D. Patching and redeploying to production as quickly as possible:
Patching is the ideal long-term solution for vulnerabilities, but zero-day vulnerabilities, by definition, lack available patches at the time of discovery. Redeploying without a patch does not address the vulnerability and could disrupt availability.

Additional Context:
Examples of Compensating Controls:

Network Segmentation:
Restrict server access to only necessary IPs or subnets.

Enhanced Monitoring:
Deploy intrusion detection systems (IDS) or security information and event management (SIEM) tools to detect exploit attempts.

Firewall/WAF Rules:
Block specific attack vectors or payloads associated with the vulnerability. Access Controls: Limit user or application access to the vulnerable system.

Behavioral Analysis
Use endpoint detection and response (EDR) to identify anomalous behavior.

Zero-Day Response:
The NIST Cybersecurity Framework (CSF) recommends identifying, detecting, and responding to zero-day threats through monitoring and temporary mitigations until a patch is available.

CompTIA Security+ Focus:
The SY0-701 exam emphasizes risk mitigation strategies for vulnerabilities, particularly in scenarios where immediate patching is not possible, highlighting the role of compensating controls and monitoring.

Reference:
CompTIA Security+ (SY0-701) Objective: 3.2 - Given a scenario, implement appropriate risk mitigation strategies (zero-day vulnerability response).

NIST SP 800-53: SI-2 (Flaw Remediation) and CA-7 (Continuous Monitoring) recommend using compensating controls and monitoring to manage risks when patches are unavailable.

CompTIA Security+ Study Guide: Discusses compensating controls as a critical strategy for mitigating risks from zero-day vulnerabilities, especially for systems requiring high availability.

Explanation:
Memory injection is a type of attack where malicious code is inserted into the memory space of a running process, allowing the attacker to execute unauthorized code within the context of that process. This technique is often used to bypass security controls, gain unauthorized access, or escalate privileges without modifying files on disk. The scenario described in option C directly aligns with this definition, as it involves copying malicious code into the allocated memory space of an already running process. Here’s why C is the correct choice:

Definition of Memory Injection:
Memory injection (also known as code injection or process injection) involves techniques like DLL injection, shellcode injection, or reflective DLL injection, where malicious code is inserted into the memory of a legitimate process. The injected code runs with the same privileges as the targeted process, often evading detection.

Scenario Fit:
Option C explicitly describes malicious code being copied into the memory space of a running process, which matches the mechanics of memory injection attacks.

Common Use Cases:
Attackers use memory injection to execute malicious payloads within trusted processes (e.g., explorer.exe or svchost.exe), making it harder for antivirus or endpoint protection to detect the activity.

Why Not the Other Options?

A. Two processes access the same variable, allowing one to cause a privilege escalation:
This describes a race condition or shared memory vulnerability, where multiple processes access a shared resource concurrently, potentially leading to privilege escalation. It does not involve injecting code into a process’s memory space, so it is not memory injection.

B. A process receives an unexpected amount of data, which causes malicious code to be executed:
This describes a buffer overflow attack, where excessive data overwrites a process’s memory, potentially allowing malicious code execution. While related to memory manipulation, it is distinct from memory injection, which involves directly copying code into a process’s allocated memory space.

D. An executable is overwritten on the disk, and malicious code runs the next time it is executed:
This describes a file-based attack, such as modifying an executable on disk (e.g., malware overwriting a legitimate program). This is not memory injection, as it involves altering files on disk rather than injecting code into a running process’s memory.

Reference:

CompTIA Security+ (SY0-701) Objective: 3.3 - Given a scenario, analyze indicators of malicious activity (malware and memory-based attacks).

MITRE ATT&CK Framework: T1055 (Process Injection) describes memory injection techniques used by attackers to execute malicious code within legitimate processes.

CompTIA Security+ Study Guide: Discusses memory injection as a method used by malware to evade detection and execute malicious code within the context of legitimate processes

Explanation:
The scenario describes a company that wants to allow employees to copy files from a virtual desktop during the workday but restrict this action during non-working hours. Time-based access control is the most appropriate security measure, as it enables the organization to enforce access policies based on specific time periods, aligning with the requirement to restrict file copying outside of working hours. Here’s why time-based access control is the best choice:

Time-Specific Restrictions:
Time-based access control (also known as temporal access control) allows organizations to define when users can perform specific actions, such as copying files. For example, the system can be configured to permit file copying only during designated work hours (e.g., 9 AM to 5 PM) and block it outside those hours.

Directly Addresses the Requirement:
The scenario explicitly focuses on restricting access based on time (workday vs. non-working hours), which makes time-based access control the most relevant solution.

Implementation in Virtual Desktops:
Virtual desktop infrastructure (VDI) solutions, such as VMware Horizon or Citrix, often support time-based access policies, allowing administrators to restrict actions like file transfers or clipboard access based on schedules.

Why Not the Other Options?

A. Digital rights management (DRM):
DRM is used to control access to and usage of digital content (e.g., preventing unauthorized copying or distribution of files). While DRM can restrict file copying, it is not inherently time-based and is more focused on protecting intellectual property than enforcing time-specific access rules.

B. Role-based access control (RBAC):
RBAC assigns permissions based on user roles (e.g., granting file access to specific departments). While effective for defining who can perform actions, it does not inherently address when those actions can occur, making it unsuitable for the time-based restriction requirement.

D. Network access control (NAC):
NAC manages access to networks based on device compliance, user identity, or security posture (e.g., ensuring devices have updated antivirus). It is not designed to control specific actions like file copying within a virtual desktop or enforce time-based restrictions.

Additional Context:

Implementation Details:
Time-based access control can be implemented in VDI environments by configuring policies in the virtual desktop platform or identity management system (e.g., Active Directory with time-based group policies). For example, clipboard access or file transfer capabilities can be enabled/disabled based on a schedule.

Security Benefits:
Restricting file copying during non-working hours reduces the risk of data leakage or unauthorized access, especially in scenarios where employees might attempt to exfiltrate data outside monitored hours.

CompTIA Security+ Focus:
The SY0-701 exam emphasizes access control mechanisms, including time-based controls, as part of identity and access management (IAM) to enforce security policies in specific contexts like virtual environments.

Reference:
CompTIA Security+ (SY0-701) Objective: 2.2 - Given a scenario, implement identity and access management (IAM) controls (time-based access control).

NIST SP 800-53: AC-3 (Access Enforcement) includes time-based access restrictions as a method to control user actions based on schedules.

CompTIA Security+ Study Guide: Discusses time-based access control as a method to restrict access to resources or actions during specific time periods, often used in virtual desktop environments to enhance security.

Explanation:
The scenario describes a security analyst finding evidence of successful injection attacks during a log review. Injection attacks, such as SQL injection, command injection, or cross-site scripting (XSS), occur when an attacker sends malicious input to an application, exploiting vulnerabilities in how user input is handled. The best way to address this issue is input validation, as it directly prevents malicious data from being processed by the application. Here’s why input validation is the best choice:

Prevents Injection Attacks:
Input validation ensures that only expected and properly formatted data is accepted by the application. By validating and sanitizing user inputs (e.g., checking for correct data types, lengths, or patterns), the application can block malicious payloads designed to exploit injection vulnerabilities.

Core Defense Against Injection:
Injection attacks succeed when applications trust unvalidated input, allowing attackers to inject malicious code or commands. Input validation stops these attacks at the source by rejecting or sanitizing harmful input before it reaches vulnerable components like databases or command interpreters.

Broad Applicability:
Input validation is effective against multiple types of injection attacks, including SQL injection (e.g., rejecting special characters like ' or ; in database queries), command injection (e.g., sanitizing inputs to shell commands), and XSS (e.g., encoding HTML or JavaScript characters).

Why Not the Other Options?

A. Authentication:
Authentication verifies user identity but does not address injection attacks, which exploit vulnerabilities in how applications process input, not who is accessing the system. An authenticated user can still perform injection attacks if input validation is lacking.

B. Secure cookies:
Secure cookies (e.g., using HttpOnly, Secure, or SameSite attributes) help protect against session hijacking or XSS-related cookie theft but do not prevent injection attacks that manipulate application logic or data (e.g., SQL or command injection).

C. Static code analysis:
Static code analysis involves reviewing source code to identify vulnerabilities during development. While it can help identify potential injection flaws, it is a preventive measure used before deployment, not a direct fix for successful injection attacks already occurring in a production environment. Input validation is a more immediate and effective runtime solution.

Additional Context:
Types of Input Validation:

Client-Side Validation:
Checks input in the browser (e.g., via JavaScript), but it can be bypassed and should not be relied upon alone.

Server-Side Validation:
The primary defense, ensuring all inputs are validated and sanitized on the server before processing (e.g., using whitelists for allowed characters or parameterized queries for SQL).

Sanitization:
Removing or escaping dangerous characters (e.g., converting < to < for XSS prevention).

Complementary Measures:
In addition to input validation, organizations can: Use parameterized queries or prepared statements for SQL to prevent SQL injection. Implement web application firewalls (WAFs) to filter malicious inputs. Regularly test applications for vulnerabilities using dynamic analysis or penetration testing.

CompTIA Security+ Focus:
The SY0-701 exam emphasizes secure coding practices and vulnerability mitigation, with input validation being a critical control for preventing injection attacks, as highlighted in the OWASP Top Ten.

Reference:
CompTIA Security+ (SY0-701) Objective: 2.3 - Given a scenario, implement secure application development, deployment, and automation (secure coding practices like input validation).

OWASP Top Ten: A03:2021 - Injection lists input validation and sanitization as primary mitigations for injection attacks. NIST SP 800-53: SI-10 (Information Input Validation) recommends validating all inputs to prevent malicious data from compromising systems.

CompTIA Security+ Study Guide: Highlights input validation as the primary defense against injection attacks, emphasizing its role in secure application design.

Explanation:
The scenario involves a company discarding a classified storage array (i.e., a storage device containing sensitive or classified data) and hiring an outside vendor to handle the disposal. To ensure the secure and compliant disposal of such sensitive equipment, the company should request a certificate of destruction or similar certification from the vendor. This document verifies that the storage array has been properly destroyed or sanitized in accordance with applicable standards, ensuring that classified data cannot be recovered. Here’s why certification is the best choice:

Proof of Secure Disposal:
A certificate of destruction (or sanitization) confirms that the vendor followed proper procedures to destroy or sanitize the storage array, rendering the data irretrievable. This is critical for classified data to prevent unauthorized access or data breaches.

Compliance with Regulations:
Regulations and standards, such as NIST SP 800-88, DoD 5220.22-M, or industry-specific requirements (e.g., HIPAA, GDPR), often mandate proof of secure disposal for devices containing sensitive data. A certification provides auditable evidence of compliance.

Risk Mitigation:
Requesting a certification reduces the company’s liability by ensuring the vendor adheres to secure disposal practices, protecting against potential data leaks or regulatory penalties.

Why Not the Other Options?

B. Inventory list:
An inventory list details the assets being disposed of but does not confirm that the storage array was securely destroyed or sanitized. It lacks the assurance needed for classified data disposal.

C. Classification:
Classification refers to labeling data or devices based on their sensitivity (e.g., confidential, secret). The company already knows the storage array is classified, so requesting a classification from the vendor is irrelevant to the disposal process.

D. Proof of ownership:
Proof of ownership establishes who owns the storage array, which is not relevant to ensuring secure disposal. The company is focused on verifying that the data is securely destroyed, not confirming ownership.

Reference:
CompTIA Security+ (SY0-701) Objective: 2.4 - Given a scenario, implement secure systems design (data destruction and media sanitization).

NIST SP 800-88: Guidelines for Media Sanitization recommends obtaining a certificate of sanitization or destruction from vendors to verify secure disposal of media containing sensitive data.

CompTIA Security+ Study Guide: Highlights the need for certification from vendors to ensure compliance with secure disposal standards for sensitive or classified storage devices.

Explanation:
The question asks which agreement type defines the time frame in which a vendor needs to respond. A Service-Level Agreement (SLA) is the most appropriate choice, as it specifically outlines performance expectations, including response times, for services provided by a vendor. Here’s why SLA is the best choice:

Definition of SLA:
An SLA is a formal contract between a service provider (vendor) and a customer that defines measurable service levels, such as response times for incidents, support requests, or service restoration. For example, an SLA might specify that a vendor must respond to a critical issue within 4 hours.

Focus on Time Frames:
SLAs explicitly include time-based metrics, such as response times, resolution times, or system uptime (e.g., 99.9% availability). This makes them the primary agreement type for defining how quickly a vendor must respond to issues.

Vendor Accountability:
SLAs ensure vendors are held accountable for meeting agreed-upon response times, often with penalties or remedies if the vendor fails to comply.

Why Not the Other Options?

A. SOW (Statement of Work):
An SOW outlines specific tasks, deliverables, and timelines for a project or service. While it may include general project deadlines, it does not typically focus on ongoing operational metrics like response times, which are specific to SLAs.

C. MOA (Memorandum of Agreement):
An MOA is a formal agreement that outlines mutual responsibilities and commitments between parties. It is generally broader and less focused on specific performance metrics like response times compared to an SLA.

D. MOU (Memorandum of Understanding):
An MOU is a non-binding agreement that expresses mutual intentions or goals for collaboration. It lacks the enforceable, time-specific metrics found in an SLA.

Additional Context:

SLA Metrics:
In addition to response times, SLAs may define:

Resolution Time:
Time to resolve an issue after responding.

Uptime Guarantees:
Minimum system availability (e.g., 99.9%).

Service Availability:
Hours during which support is provided.

Examples:
An SLA for an IT vendor might state, “Critical incidents will receive a response within 2 hours, with resolution within 8 hours.”

CompTIA Security+ Focus:
The SY0-701 exam emphasizes understanding SLAs as part of third-party risk management and ensuring vendors meet security and performance expectations.

Reference:
CompTIA Security+ (SY0-701) Objective: 5.2 - Explain the importance of applicable regulations, standards, or frameworks that impact organizational security posture (vendor agreements like SLAs).

NIST SP 800-53: SA-9 (External Information System Services) highlights the use of SLAs to define performance expectations, including response times, for third-party vendors.

CompTIA Security+ Study Guide: Discusses SLAs as critical for setting measurable performance criteria, such as response times, in vendor contracts to ensure service reliability and security.