CompTIA Security+ SY0-701 (CyberVista Practice Test) — Questions and Answers

Question 1: An organization has identified a risk to its data center from a potential long-term power outage. The organization decides to purchase a contract with a third-party provider for a fully equipped disaster recovery site. Which risk treatment strategy is being employed?

Risk Mitigation
Risk Transference (Correct answer)
Risk Acceptance
Risk Avoidance

Correct answer: Risk Transference

Risk transference (or transfer) involves shifting the impact of a risk to a third party. By contracting with a disaster recovery site provider, the organization is transferring the responsibility and financial burden of maintaining a secondary site, thereby sharing the risk of a data center outage.

Question 2: What is risk acceptance?

Removing all users.
Ignoring the risk.
Choosing to tolerate a known risk without mitigation (Correct answer)
Eliminating all risk.

Correct answer: Choosing to tolerate a known risk without mitigation

Risk acceptance is a deliberate decision by an organization to acknowledge a known risk and choose not to take any action to mitigate or transfer it. This decision is typically made when the cost of mitigation outweighs the potential impact of the risk, or when the risk is deemed to be within acceptable tolerance levels. It is a conscious choice, not simply ignoring the risk.

Question 3: An organization is using the OSI model to guide its layered security strategy. At which layer would a security architect primarily focus on implementing IPsec to secure network communications?

Layer 7 (Application Layer)
Layer 4 (Transport Layer)
Layer 2 (Data Link Layer)
Layer 3 (Network Layer) (Correct answer)

Correct answer: Layer 3 (Network Layer)

IPsec (Internet Protocol Security) operates at the Network Layer (Layer 3) of the OSI model. It is used to secure IP communications by authenticating and encrypting each IP packet of a communication session.

Question 4: Which of the following BEST describes the primary purpose of a Business Impact Analysis (BIA) within a GRC framework?

To select and implement specific security controls to mitigate threats.
To identify critical business functions and determine the potential effects of a disruption to those functions. (Correct answer)
To assign roles and responsibilities for the incident response team.
To identify and catalog all organizational assets and their monetary value.

Correct answer: To identify critical business functions and determine the potential effects of a disruption to those functions.

A Business Impact Analysis (BIA) is a systematic process to identify critical business functions and evaluate the potential effects of a disruption on them. The BIA helps determine recovery priorities, recovery time objectives (RTOs), and the resources required to maintain operational resilience, forming the foundation for business continuity planning.

Question 5: A developer is building a web page that displays user-provided comments. To prevent stored Cross-Site Scripting (XSS) attacks, what is the MOST critical security control to implement before rendering the comments in the user's browser?

Implementing strong server-side input validation
Performing context-aware output encoding (Correct answer)
Encrypting the comments in the database
Using a Web Application Firewall (WAF)

Correct answer: Performing context-aware output encoding

While input validation is an important part of a defense-in-depth strategy, the primary and most effective defense against XSS is performing context-aware output encoding. This process ensures that any user-provided data is treated as displayable text by the browser, rather than as executable code, regardless of the characters it contains.

Question 6: What is the fundamental difference between a digital signature and a digital certificate?

A digital certificate is used to prove ownership of a public key, while a digital signature is used to verify the integrity and authenticity of data. (Correct answer)
A digital certificate is created by the user, while a digital signature is issued by a Certificate Authority.
A digital signature encrypts data, while a digital certificate hashes it.
A digital signature uses symmetric keys, while a digital certificate uses asymmetric keys.

Correct answer: A digital certificate is used to prove ownership of a public key, while a digital signature is used to verify the integrity and authenticity of data.

A digital certificate is an electronic document issued by a CA that binds an identity to a public key, proving who owns it. A digital signature is a cryptographic mechanism used to verify the authenticity (proof of sender) and integrity (proof the data wasn't altered) of a message or document.

Question 7: What is a key function of antivirus software?

Detect and eliminate malware threats (Correct answer)
Manage email accounts.
Increase internet speed.
Backup data to the cloud.

Correct answer: Detect and eliminate malware threats

Antivirus software is specifically developed to protect computers and networks from malicious software, commonly known as malware. Its key function involves scanning files, programs, and web activity to identify, quarantine, and remove viruses, worms, Trojans, ransomware, and other harmful threats. This proactive and reactive defense mechanism is crucial for maintaining system integrity and data security.

Question 8: Which of the following is a form of social engineering where an attacker sends a fraudulent email that appears to be from a legitimate and reputable source to trick the recipient into revealing sensitive information, such as login credentials or credit card numbers?

Spoofing
Ransomware
Phishing (Correct answer)
Trojan Horse

Correct answer: Phishing

Phishing is a type of social engineering attack often used to steal user data, including login credentials and credit card numbers. It occurs when an attacker, masquerading as a trusted entity, dupes a victim into opening an email, instant message, or text message. Ransomware holds a system hostage for a fee, a Trojan horse is malware disguised as legitimate software, and Spoofing is a broader term for disguising communication from an unknown source as being from a known, trusted source.

Question 9: What is the role of a network scanner?

To block user access.
To scan printers only.
To detect devices and assess network security (Correct answer)
To reset routers.

Correct answer: To detect devices and assess network security

A network scanner is a tool used to discover devices connected to a network and gather information about them, such as open ports, services running, and operating systems. Its role is crucial for network administrators to map out their network topology, identify unauthorized devices, and assess potential security vulnerabilities. By understanding what is present and how it's configured, organizations can better secure their network perimeter and internal systems.

Question 10: Which of the following is a key security concern unique to containerized environments such as Docker or Kubernetes?

Container escape leading to host compromise (Correct answer)
ARP spoofing
Cross-site scripting
SQL injection

Correct answer: Container escape leading to host compromise

Container escape vulnerabilities allow a malicious process inside a container to break out and gain access to the underlying host OS.

Question 11: Which of the following best defines a Recovery Time Objective (RTO)?

The maximum acceptable time to restore a system or process after a disruption (Correct answer)
The minimum number of backup copies required
The time interval between scheduled backups
The maximum tolerable amount of data loss measured in time

Correct answer: The maximum acceptable time to restore a system or process after a disruption

RTO defines how quickly a system must be restored after an incident to avoid unacceptable business impact.

Question 12: What is a zero-day vulnerability?

A blocked firewall port.
A routine update.
A password reset.
An unknown and unpatched software flaw (Correct answer)

Correct answer: An unknown and unpatched software flaw

A zero-day vulnerability refers to a software flaw that is unknown to the vendor and for which no patch or fix has been released. Attackers can exploit these vulnerabilities 'on day zero' of their discovery, before developers have a chance to address them. This makes them particularly dangerous as there is no immediate defense available.

Question 13: A security administrator is configuring access for a new database administrator (DBA). Following the principle of least privilege, which approach should the administrator take?

Assign the DBA to a standard user group and have them request elevated privileges for each specific task.
Grant the DBA full administrative rights to all servers on the network to ensure they can perform any necessary task.
Provide the DBA with administrative access only to the specific database servers they are responsible for managing. (Correct answer)
Clone the permissions of the previous DBA who had broad access to multiple systems.

Correct answer: Provide the DBA with administrative access only to the specific database servers they are responsible for managing.

The principle of least privilege dictates that users should only be granted the minimum level of access and permissions necessary to perform their job functions. Providing administrative access only to the specific database servers the DBA manages directly aligns with this principle, minimizing the potential attack surface if the account were to be compromised.

Question 14: What physical security control uses a small enclosed space with two sets of interlocking doors to prevent tailgating?

Badge reader
CCTV array
Mantrap (airlock) (Correct answer)
Faraday cage

Correct answer: Mantrap (airlock)

A mantrap requires an individual to authenticate before the second door opens, preventing unauthorized persons from following authorized users.

Question 15: What is the use of a vulnerability scanner?

To encrypt databases.
To manage passwords.
To install software updates.
To detect potential vulnerabilities in systems (Correct answer)

Correct answer: To detect potential vulnerabilities in systems

A vulnerability scanner is a software tool designed to identify security weaknesses and misconfigurations in computer systems, networks, and applications. Its use involves systematically scanning targets for known vulnerabilities, such as outdated software, missing patches, or insecure configurations. By detecting these potential entry points for attackers, organizations can proactively address and remediate them, significantly improving their security posture.

Question 16: Which attack exploits misconfigured cloud storage buckets to access sensitive data without authentication?

Insecure direct object reference
Cloud storage enumeration (Correct answer)
SQL injection
Container escape

Correct answer: Cloud storage enumeration

Cloud storage enumeration attacks target publicly accessible or misconfigured buckets (e.g., S3) to read or exfiltrate sensitive data.

Question 17: What is a honeypot in cybersecurity?

A decoy system to detect and study attacks (Correct answer)
An email filter.
A type of backup server.
An antivirus update.

Correct answer: A decoy system to detect and study attacks

A honeypot is a cybersecurity mechanism that acts as a decoy system, intentionally designed to attract and trap cyber attackers. Its purpose is to detect unauthorized access attempts, gather intelligence on attack methods, and study attacker behavior without risking actual production systems. This allows organizations to learn about new threats and improve their defenses proactively.

Question 18: What is the first step in a risk assessment?

Patching systems.
Installing antivirus.
Identifying assets and their value (Correct answer)
Blocking network traffic.

Correct answer: Identifying assets and their value

The first step in any effective risk assessment is to identify and understand the assets that need protection, along with their value to the organization. This involves cataloging hardware, software, data, intellectual property, and critical business processes. By knowing what assets exist and their importance, organizations can then prioritize which ones require the most robust security measures against potential threats.

Question 19: A software development team is building a critical system where every request for a resource must be validated at the time of the request, regardless of whether previous requests from the same user were approved. This practice is a direct implementation of which secure design principle?

Open Design
Complete Mediation (Correct answer)
Economy of Mechanism
Separation of Privilege

Correct answer: Complete Mediation

The principle of Complete Mediation requires that every access to every object must be checked for authority. This means that permissions are validated every single time a request is made, preventing situations where access rights are cached and might become outdated.

Question 20: A company wants to allow its employees to use their corporate credentials to log in to a third-party SaaS application for expense reporting. This is an example of which IAM concept?

Identity Federation (Correct answer)
Privileged Access Management (PAM)
Role-Based Access Control (RBAC)
Identity Governance and Administration (IGA)

Correct answer: Identity Federation

Identity Federation allows users from one domain (the company's corporate network, or Identity Provider) to securely access resources in another domain (the third-party SaaS app, or Service Provider) without needing a separate set of credentials. This establishes a trust relationship between the two entities, enabling single sign-on capabilities.

Question 21: A security analyst needs to implement an encryption method that is fast, efficient for large amounts of data, and uses a single key for both encryption and decryption. Which type of cryptography best meets these requirements?

Hashing
Symmetric encryption (Correct answer)
Asymmetric encryption
Quantum cryptography

Correct answer: Symmetric encryption

Symmetric encryption uses a single shared key to both encrypt and decrypt data. It is known for its speed and efficiency, making it ideal for encrypting large volumes of data, such as in database or file encryption.

Question 22: How is risk calculated in cybersecurity?

Budget / Cost.
Value - Vulnerability.
Compliance + Security.
Likelihood x Impact (Correct answer)

Correct answer: Likelihood x Impact

In cybersecurity, risk is commonly calculated as the product of the likelihood of a threat exploiting a vulnerability and the potential impact of that exploitation. This formula, Likelihood x Impact, provides a quantitative measure to prioritize risks. It helps organizations understand both how probable an event is and how severe its consequences would be.

Question 23: Which of the following hashing algorithms is now considered insecure and vulnerable to collision attacks, making it unsuitable for modern security applications like password storage?

SHA-3
MD5 (Correct answer)
SHA-256
Bcrypt

Correct answer: MD5

MD5 is an older hashing algorithm that has been found to have significant vulnerabilities, most notably its susceptibility to collision attacks, where two different inputs can produce the same hash value. Due to this weakness, it is considered insecure for modern cryptographic purposes.

Question 24: A company is setting up an internal network and needs to issue certificates for its internal servers and devices. The company wants full control over the certificate issuance process and does not require public trust. Which PKI component should they implement?

A Private Certificate Authority (Correct answer)
A Public Certificate Authority
A Validation Authority
A Registration Authority

Correct answer: A Private Certificate Authority

A Private Certificate Authority (or internal CA) is set up and managed by an organization for its own internal use. This allows the organization to issue and manage certificates for internal servers, devices, and users without needing validation from a public CA, providing complete control over the trust hierarchy.

Question 25: Which of the following BEST describes the primary function of Security Assertion Markup Language (SAML) in an Identity and Access Management framework?

To directly query user attributes and credentials stored in a directory service like LDAP or Active Directory.
To provide a framework for creating and managing digital identities and their lifecycles within an organization.
To exchange authentication and authorization data between an identity provider (IdP) and a service provider (SP) to enable single sign-on (SSO). (Correct answer)
To enforce multi-factor authentication (MFA) by providing a standardized method for transmitting one-time passwords.

Correct answer: To exchange authentication and authorization data between an identity provider (IdP) and a service provider (SP) to enable single sign-on (SSO).

SAML is an open standard specifically designed for exchanging authentication and authorization information between parties, most commonly an Identity Provider (IdP) and a Service Provider (SP). Its primary use case is to facilitate web-based, cross-domain single sign-on (SSO), allowing a user to log in once and gain access to multiple separate systems without re-entering credentials.

Question 26: An organization is conducting a risk assessment and uses descriptive ratings such as 'High,' 'Medium,' and 'Low' to evaluate the likelihood and impact of identified risks based on expert judgment and experience. What type of risk assessment is being performed?

Ad-hoc
Quantitative
Qualitative (Correct answer)
Hybrid

Correct answer: Qualitative

A qualitative risk assessment uses descriptive or categorical ratings (e.g., high, medium, low) to evaluate risks based on subjective judgment, experience, and context. This method is less precise than a quantitative assessment but is often quicker and easier to perform when numerical data is not available.

Question 27: What is the primary difference between a virus and a worm?

A virus is designed to steal data, while a worm is designed to cause network disruption.
A worm can self-replicate and spread independently across networks, while a virus requires a host file or program to spread. (Correct answer)
A worm requires human interaction to spread, while a virus does not.
A virus can self-replicate, while a worm cannot.

Correct answer: A worm can self-replicate and spread independently across networks, while a virus requires a host file or program to spread.

The primary distinction is that a worm is a standalone piece of malware that can replicate and spread on its own through a network. A virus, on the other hand, needs to attach itself to a legitimate program or file. Human action, like opening an infected file, is typically required to trigger the virus and allow it to spread.

Question 28: What is a common risk mitigation strategy?

Increasing exposure.
Ignoring the issue.
Implementing security controls (Correct answer)
Decreasing system performance.

Correct answer: Implementing security controls

Risk mitigation involves taking proactive steps to reduce the likelihood or impact of a risk. Implementing security controls, such as firewalls, access controls, encryption, and intrusion detection systems, directly addresses vulnerabilities and threats. These controls are designed to prevent, detect, or respond to security incidents, thereby reducing overall risk exposure.

Question 29: Which of the following BEST describes the primary security function of Domain Name System Security Extensions (DNSSEC)?

To provide a faster and more efficient DNS lookup process.
To encrypt DNS queries and responses to ensure confidentiality.
To authenticate the origin of DNS data and verify its integrity. (Correct answer)
To block access to known malicious domains at the DNS level.

Correct answer: To authenticate the origin of DNS data and verify its integrity.

The primary function of DNSSEC is to add a layer of trust to DNS by providing authentication and data integrity. It uses digital signatures to ensure that the DNS data a user receives is from the correct authoritative source and has not been tampered with in transit, thus protecting against attacks like DNS cache poisoning and spoofing.

Question 30: What does data sovereignty mean in the context of cloud security?

Maintaining a single copy of data for audit purposes
Encrypting data before it leaves the organization
Allowing only the data owner to decrypt sensitive information
Ensuring data is subject to the laws of the country where it is stored or processed (Correct answer)

Correct answer: Ensuring data is subject to the laws of the country where it is stored or processed

Data sovereignty means that data stored in a particular country is governed by that nation's laws, which can affect privacy and compliance requirements.

CompTIA Security+ SY0-701 (CyberVista Practice Test)

CyberVista's (N2K) practice test for CompTIA Security+ SY0-701, assessing cybersecurity knowledge across five domains including threats, security architecture, operations, and governance. Validates skills for entry-level security practitioner roles.

Questions

90 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds