Free SY0-701 Practice Test Questions 2026

Explanation: The scenario describes an organization issuing new laptops to employees and wanting to implement web filtering both in and out of the office without requiring additional network access configurations. Agent-based web filtering is the most suitable solution, as it involves installing software (an agent) on each laptop to enforce web filtering policies locally, regardless of the network the device is connected to. Here’s why agent-based is the best choice:

Works In and Out of the Office:
Agent-based web filtering operates at the endpoint level, meaning the filtering policies are enforced directly on the laptop. This ensures consistent web filtering whether the employee is on the corporate network, at home, or on a public Wi-Fi network, without needing additional network access configurations.

No Network Dependency:
Unlike solutions that rely on network infrastructure (e.g., proxies), agent-based filtering does not require the laptop to connect to a specific network or VPN to enforce policies, meeting the requirement of avoiding additional network access configurations.

Granular Control:
Agents can enforce policies like blocking malicious URLs, restricting access to specific categories of websites, or logging web activity, all while functioning independently of the network environment.

Why Not the Other Options?

B. Centralized proxy:
A centralized proxy filters web traffic by routing it through a proxy server, typically on the corporate network. While effective in the office, it requires additional network configurations (e.g., VPN or proxy settings) for off-site filtering, which conflicts with the requirement to avoid such configurations.

C. URL scanning:
URL scanning refers to analyzing URLs for malicious content, often as part of a broader security solution (e.g., antivirus or web gateway). It is a technique, not a complete web filtering solution, and does not address the requirement for consistent filtering in and out of the office without network changes.

D. Content categorization:
Content categorization involves classifying websites into categories (e.g., social media, gaming) for filtering purposes. While this is a component of web filtering, it is not a deployment method and does not specify how filtering is enforced across different locations without network configuration.

Reference:
CompTIA Security+ (SY0-701) Objective: 2.4 - Given a scenario, implement secure systems design (endpoint security and web filtering).

NIST SP 800-53: SC-7 (Boundary Protection) and SC-18 (Mobile Code) support the use of endpoint-based controls like agent-based filtering to secure devices across different network environments.

CompTIA Security+ Study Guide: Discusses agent-based web filtering as an effective solution for enforcing security policies on endpoints, especially for remote or mobile devices, without requiring complex network configurations.

Explanation:
The scenario describes a malicious insider from the marketing team altering records and transferring company funds to a personal account. This indicates an insider threat where an employee abused their access privileges to manipulate sensitive data and perform unauthorized financial transactions. The best way to secure company records in the future is permission restrictions, as this directly addresses the issue by limiting what actions employees can perform based on their roles, preventing unauthorized access or modifications. Here’s why permission restrictions is the best choice:

Limits Insider Access:
Permission restrictions, based on the principle of least privilege, ensure that employees only have access to the resources and actions necessary for their job functions. For example, marketing team members would not have permissions to alter financial records or initiate fund transfers, reducing the risk of insider misuse.

Role-Based Control:
Implementing permission restrictions often involves role-based access control (RBAC), where permissions are assigned based on job roles. This would prevent marketing employees from accessing financial systems or sensitive records outside their scope.

Mitigates Insider Threats:
By restricting permissions, the organization can limit the damage a malicious insider can cause, even if they have legitimate access to the network.

Why Not the Other Options?

B. Hashing:
Hashing is used to ensure data integrity (e.g., verifying that data has not been altered) by generating a fixed-length hash value for data. While hashing can detect unauthorized changes to records, it does not prevent a malicious insider from accessing or modifying records in the first place, as it is not an access control mechanism.

C. Input validation:
Input validation prevents malicious input (e.g., SQL injection) from being processed by applications. While useful for securing applications against external attacks, it does not address insider threats where an authorized user intentionally misuses their access to alter records or transfer funds.

D. Access control list (ACL):
An ACL specifies which users or groups can access specific resources and what actions they can perform (e.g., read, write). While ACLs are a form of access control, they are more granular and resource-specific compared to broad permission restrictions, which encompass role-based policies and least privilege principles across systems. The question’s focus on securing records broadly makes permission restrictions (A) a better fit than the more specific ACL (D).

Reference:

CompTIA Security+ (SY0-701) Objective: 2.2 - Given a scenario, implement identity and access management (IAM) controls (permission restrictions and least privilege).

NIST SP 800-53: AC-6 (Least Privilege) recommends restricting permissions to only those necessary for job functions to mitigate insider threats.

CompTIA Security+ Study Guide: Highlights permission restrictions and RBAC as key defenses against insider threats by limiting unauthorized access to sensitive systems and data.

Explanation:
The scenario involves an employee using the company’s billing system to issue fraudulent checks, indicating an insider threat involving misuse of an application. The administrator is seeking evidence of other occurrences of this activity. Application logs are the most appropriate source to examine, as they record user actions, transactions, and events within the billing system, where the fraudulent activity occurred. Here’s why application logs is the best choice:

Relevance to Billing System:
Application logs for the billing system will contain detailed records of user activities, such as who accessed the system, what actions were performed (e.g., issuing checks), and when these actions occurred. This makes them the primary source for identifying other instances of fraudulent check issuance.

Evidence of Insider Activity:
Since the fraud was committed by an employee using the billing system, application logs will capture specific transactions or modifications (e.g., check creation, approval, or issuance) that can be reviewed for patterns of fraudulent behavior.

Granular Insight:
Application logs provide detailed, application-specific data, such as user IDs, timestamps, and transaction details, which are critical for tracing fraudulent activities back to specific users or actions.

Why Not the Other Options?

B. Vulnerability scanner logs:
Vulnerability scanner logs identify weaknesses in systems or applications (e.g., unpatched software or misconfigurations). They are not relevant to tracking user actions or fraudulent transactions within a billing system, as they focus on system vulnerabilities, not user activity.

C. IDS/IPS logs:
Intrusion Detection/Prevention System (IDS/IPS) logs monitor network traffic for suspicious activity (e.g., malware or unauthorized access attempts). While useful for detecting external attacks or network-based anomalies, they are unlikely to capture internal application-level actions like issuing fraudulent checks.

D. Firewall logs:
Firewall logs track network traffic, such as allowed or blocked connections. They are not designed to record application-specific activities like check issuance in a billing system, making them irrelevant for identifying fraudulent user actions within an application.

Reference:
CompTIA Security+ (SY0-701) Objective: 4.2 - Given a scenario, perform incident response activities (log analysis for insider threats).

NIST SP 800-53: AU-6 (Audit Review, Analysis, and Reporting) recommends analyzing application logs to detect and investigate unauthorized activities, such as insider misuse.

CompTIA Security+ Study Guide: Highlights application logs as a key resource for investigating insider threats and tracking user actions within business-critical systems like billing applications.

Explanation:
The scenario asks for the best tool for logging and monitoring in a cloud environment. A Security Information and Event Management (SIEM) system is the most suitable tool, as it is specifically designed to collect, aggregate, analyze, and correlate logs from various sources in real-time, including cloud-based systems, to provide comprehensive monitoring and incident detection. Here’s why SIEM is the best choice:

Centralized Logging and Monitoring:
SIEM systems aggregate logs from cloud-based infrastructure (e.g., IaaS, PaaS, SaaS), applications, and services, providing a centralized platform to monitor security events, detect anomalies, and generate alerts.

Cloud Environment Compatibility:
SIEM solutions (e.g., Splunk, Microsoft Sentinel, IBM QRadar) integrate with cloud providers like AWS, Azure, and Google Cloud, collecting logs from services such as CloudTrail, Azure Monitor, or VPC Flow Logs to monitor activity across distributed cloud environments.

Real-Time Analysis and Correlation:
SIEMs analyze logs in real-time, correlate events across systems, and identify potential threats (e.g., unauthorized access, data exfiltration) in dynamic cloud environments, making them ideal for monitoring complex, scalable infrastructures.

Compliance and Reporting:
SIEMs support compliance requirements (e.g., GDPR, HIPAA) by generating reports and maintaining audit trails, which are critical for cloud environments subject to regulatory oversight.

Why Not the Other Options?

A. IPS (Intrusion Prevention System):
An IPS monitors network traffic to detect and block malicious activity (e.g., exploits or attacks). While useful for security, it focuses on network-level threat prevention, not comprehensive logging and monitoring across cloud systems and applications.

B. FIM (File Integrity Monitoring):
FIM monitors changes to critical files and configurations to detect unauthorized modifications. While it contributes to security monitoring, it is too narrow in scope for comprehensive logging and monitoring across an entire cloud environment.

C. NAC (Network Access Control):
NAC enforces policies to control device and user access to networks based on compliance or identity. It is not designed for logging and monitoring security events, especially in the context of cloud environments where network boundaries are less defined.

Reference:
CompTIA Security+ (SY0-701) Objective: 4.1 - Given a scenario, use appropriate tools and techniques to support security monitoring (SIEM for cloud environments).

NIST SP 800-53: AU-6 (Audit Review, Analysis, and Reporting) and SI-4 (System Monitoring) recommend SIEM systems for centralized logging and monitoring to detect and respond to security incidents.

CompTIA Security+ Study Guide: Highlights SIEM as the primary tool for aggregating and analyzing logs in cloud and on-premises environments to ensure comprehensive security monitoring.

Explanation:
The image shows a table with MD5 password hashes for the "admin" account across multiple systems (e.g., ACCT-PC-1, HR-PC-1, FILE-SRV-1, DB-SRV-1). Notably, the MD5 hashes are identical for all entries (e.g., d70ab825f6e7c131bc57a6e28184 for ACCT-PC-1 and HR-PC-1). Pass-the-hash attacks exploit this vulnerability by using stolen password hashes (e.g., from memory or a compromised system) to authenticate to other systems without needing to crack the password itself, especially when the same hash is reused across multiple systems. The security administrator likely reset the passwords and ensured unique hashes to mitigate this risk, as reusing the same password (and thus the same hash) across systems is a common target for such attacks.

Why not the other options?

A. Account sharing:
This involves multiple users using the same account, which isn’t indicated by the data. The issue here is the reuse of identical hashes, not multiple users.

B. Weak password complexity:
The problem isn’t the complexity of the passwords (which isn’t visible), but the reuse of the same hash, suggesting identical passwords were set. Weak complexity would imply poor password policies, but the scenario focuses on hash reuse.

D. Password compromise:
While password compromise could lead to this situation, the specific action of resetting passwords to generate unique hashes points to preventing pass-the-hash attacks rather than just addressing a past compromise.

Reference:
This aligns with CompTIA Security+ SY0-701 objectives related to understanding authentication and attack types, particularly pass-the-hash techniques (refer to CompTIA Security+ Study Guide, which covers credential attacks under domain 2.0: Architecture and Design).

Explanation:
A rogue access point (AP) is an unauthorized wireless access point that has been installed on a network without explicit permission, often by employees or attackers. In this scenario, the security administrator discovered another device providing internet access, which allowed a coworker to access a blocked site despite content filtering being enabled on the business's Wi-Fi. This suggests the rogue AP bypasses the organization's security controls, such as content filtering, enabling users to connect to unrestricted internet sources. The investigation into the reported incident supports the likelihood of a rogue AP, as it explains how the coworker circumvented the official network's restrictions.

Why not the other options?

A. The host-based security agent is not running on all computers:
This would imply a software issue on individual machines (e.g., antivirus or endpoint protection not functioning), but the discovery of another device providing internet access points more directly to a network-level issue like a rogue AP rather than a host-based agent failure.

C. Employees who have certain credentials are using a hidden SSID:
A hidden SSID (where the network name is not broadcast) might limit visibility but doesn’t inherently bypass content filtering unless paired with a rogue AP. The scenario doesn’t mention credentials or hidden SSIDs, making this less likely.

D. A valid access point is being jammed to limit availability:
Jamming would disrupt connectivity rather than enable access to blocked sites, which contradicts the coworker’s ability to browse restricted content.

Reference:
This aligns with CompTIA Security+ SY0-701 objectives under domain 1.0: Attacks, Threats, and Vulnerabilities, which covers rogue access points as a common security risk (refer to CompTIA Security+ Study Guide for details on wireless security threats).

Explanation:
In a cloud computing environment, where multiple virtual machines (VMs) often run on shared infrastructure, a VM escape vulnerability is a critical concern. VM escape occurs when an attacker breaks out of a virtual machine's isolated environment to access the host system or other VMs, potentially compromising the entire cloud infrastructure. For a systems administrator architecting a cloud environment, prioritizing protection against VM escape is essential to ensure the security and isolation of instances, which is a unique risk in virtualized and cloud setups.

Why not the other options?

A. SQL injection:
While SQL injection is a significant web application vulnerability, it is more relevant to application-layer security and less specific to the architectural concerns of cloud computing instances themselves.

B. TOC/TOU (Time-of-Check to Time-of-Use):
This is a race condition vulnerability that can occur in software, but it is not a primary architectural consideration for cloud instances compared to VM escape.

D. Tokenization:
Tokenization is a data protection technique (e.g., replacing sensitive data with tokens), which is important for compliance but not a top architectural priority for mitigating cloud instance vulnerabilities.

E. Password spraying:
This is an authentication attack method, typically targeting user credentials, and is not directly related to the architectural design of cloud instances.

Reference:
This aligns with CompTIA Security+ SY0-701 objectives under domain 2.0: Architecture and Design, which includes securing virtualized environments and understanding risks like VM escape (refer to CompTIA Security+ Study Guide for cloud security principles).

Explanation:
Endpoint Detection and Response (EDR) is a tool designed to rapidly analyze host and network data from potentially compromised systems. EDR solutions continuously monitor endpoints (e.g., workstations, servers) for suspicious activities, collect detailed data, and provide advanced analytics to detect threats. They also forward this data for further review or investigation, aligning with the CISO's goal of enhancing the incident response team's capabilities. EDR is particularly effective for identifying and responding to advanced threats in real-time.

Why not the other options?

A. NAC (Network Access Control):
NAC focuses on enforcing security policies for devices accessing the network, such as authentication and access restrictions, rather than analyzing data from compromised systems for incident response.

B. IPS (Intrusion Prevention System):

An IPS monitors network traffic to detect and block malicious activity, but it is not designed to analyze host data or forward it for detailed review, making it less suitable for this purpose

C. SIEM (Security Information and Event Management):
SIEM aggregates and analyzes log data from various sources for correlation and alerting, but it is more of a centralized monitoring tool rather than a rapid, endpoint-focused analysis tool like EDR.

Reference:
This aligns with CompTIA Security+ SY0-701 objectives under domain 3.0: Implementation, which covers incident response tools, including EDR (refer to CompTIA Security+ Study Guide for details on security tools and incident handling).

Explanation:
Business email compromise (BEC) is a type of attack where attackers impersonate a trusted entity, such as a company executive, vendor, or, in this case, the company's bank, to trick employees into performing unauthorized actions like wire transfers. The scenario describes an urgent payment message from the company's bank domain, requesting an immediate funds transfer, which is a common tactic in BEC attacks. These attacks often exploit the trust associated with legitimate business processes and urgency to bypass scrutiny.

Why not the other options?

B. Vishing:
Vishing (voice phishing) involves attackers using phone calls to deceive victims, not email messages, so this doesn’t fit the described scenario.

C. Spear phishing:
While spear phishing is a targeted form of phishing, it is a broader category that may not specifically involve business financial transactions. BEC is a specialized subset of spear phishing focused on financial fraud, making it more precise here.

D. Impersonation:
Impersonation is a general tactic used in various attacks (including BEC), but it is not a specific attack type. BEC better describes the financial and business context of this incident.

Reference:
This aligns with CompTIA Security+ SY0-701 objectives under domain 1.0: Attacks, Threats, and Vulnerabilities, which covers social engineering attacks like BEC (refer to CompTIA Security+ Study Guide for details on phishing variants).

Explanation:
IPSec (Internet Protocol Security) is a widely used protocol suite for securing IP communications by establishing encrypted tunnels, making it a common choice for remote access VPNs. In this scenario, the security engineer configured a remote access VPN that uses an agent installed on the endpoint to create an encrypted tunnel, allowing end users to connect securely to the network. IPSec provides authentication, integrity, and confidentiality, typically through protocols like IKE (Internet Key Exchange) and can operate in tunnel mode, which aligns with the described setup.

Why not the other options?

A. GRE (Generic Routing Encapsulation):
GRE is a tunneling protocol that can encapsulate various network layer protocols but does not inherently provide encryption or security, making it unsuitable as a standalone VPN solution.

C. SD-WAN (Software-Defined Wide Area Network):
SD-WAN is an architecture for managing wide-area networks and can use VPNs, but it is not a specific protocol for establishing an encrypted tunnel in a remote access context.

D. EAP (Extensible Authentication Protocol):
EAP is an authentication framework often used within VPNs or wireless networks (e.g., with RADIUS), but it is not a protocol for creating encrypted tunnels itself.

Reference:
This aligns with CompTIA Security+ SY0-701 objectives under domain 2.0: Architecture and Design, which covers VPN technologies and protocols like IPSec (refer to CompTIA Security+ Study Guide for details on secure network protocols).

Explanation:
A Group Policy Object (GPO) in an Active Directory environment allows administrators to enforce specific security settings, including time-of-day log-in restrictions, across a group of users, such as contract employees. By creating a GPO tailored for contract employees and configuring it to restrict logins to Monday through Friday from 9 a.m. to 5 p.m., the company can effectively enforce the desired access control. This method is precise, centralized, and directly addresses the temporal limitations specified.

Why not the other options?

B. Creating a discretionary access policy and setting rule-based access for contract employees:
Discretionary access control (DAC) allows resource owners to set permissions, but it is not designed to enforce time-based restrictions across a group. Rule-based access could theoretically include time limits, but DAC is less suited for centralized, system-wide enforcement compared to GPOs.

C. Implementing an OAuth server and then setting least privilege for contract employees:
OAuth is an authorization framework for third-party applications, not a tool for enforcing time-based log-in restrictions. Least privilege ensures minimal access rights but doesn’t address the time constraint.

D. Implementing SAML with federation to the contract employees' authentication server:
Security Assertion Markup Language (SAML) with federation enables single sign-on across domains, but it is not inherently designed to enforce time-of-day restrictions, which would require additional configuration beyond standard SAML functionality.

Reference:
This aligns with CompTIA Security+ SY0-701 objectives under domain 2.0: Architecture and Design, which covers access control methods, including the use of GPOs for policy enforcement (refer to CompTIA Security+ Study Guide for details on access control mechanisms).

Explanation:
Shadow IT refers to the use of unapproved or unauthorized software, hardware, or services by employees within an organization, often without the knowledge or consent of the IT or security teams. In this scenario, an accounting employee using software not approved by the company represents a shadow IT risk. This can introduce vulnerabilities, such as unpatched security flaws, lack of monitoring, or compatibility issues, potentially compromising data security or operational integrity.

Why not the other options?

A. Unskilled attacker:
This refers to an individual with limited technical expertise attempting a cyberattack, which doesn’t apply to an employee using unauthorized software.

B. Hacktivist:
A hacktivist is someone who uses hacking to promote a social or political cause, and this scenario does not indicate any such motive.

D. Supply chain:
This involves risks from third-party vendors or partners in the supply chain, not an employee’s use of unauthorized software.

Reference:
This aligns with CompTIA Security+ SY0-701 objectives under domain 1.0: Attacks, Threats, and Vulnerabilities, which covers shadow IT as a common organizational risk (refer to CompTIA Security+ Study Guide for details on internal threats).