Get Started SY0-701 Exam [2026] Dumps CompTIA PDF Questions [Q271-Q289]

Rate this post

Get Started: SY0-701 Exam [2026] Dumps CompTIA PDF Questions

SY0-701 Premium Exam Engine pdf Download

CompTIA SY0-701 Exam Syllabus Topics:

Topic	Details
Topic 1	Security Architecture: Here, you’ll learn about security implications across different architecture models, applying security principles to secure enterprise infrastructure in scenarios, and comparing data protection concepts and strategies. The topic also delves into the importance of resilience and recovery in security architecture.
Topic 2	Security Program Management and Oversight: Finally, this topic discusses elements of effective security governance, the risk management process, third-party risk assessment, and management processes. Additionally, the topic focuses on security compliance requirements, types and purposes of audits and assessments, and implementing security awareness practices in various scenarios.
Topic 3	General Security Concepts: This topic covers various types of security controls, fundamental security concepts, the importance of change management processes in security, and the significance of using suitable cryptographic solutions.
Topic 4	Threats, Vulnerabilities, and Mitigations: In this topic, you’ll find discussions comparing threat actors and motivations, explaining common threat vectors and attack surfaces, and outlining different types of vulnerabilities. Moreover, the topic focuses on analyzing indicators of malicious activity in scenarios and exploring mitigation techniques used to secure enterprises against threats.
Topic 5	Security Operations: This topic delves into applying common security techniques to computing resources, addressing security implications of proper hardware, software, and data asset management, managing vulnerabilities effectively, and explaining security alerting and monitoring concepts. It also discusses enhancing enterprise capabilities for security, implementing identity and access management, and utilizing automation and orchestration for secure operations.

Q271. A security analyst reviews domain activity logs and notices the following:

Which of the following is thebestexplanation for what the security analyst has discovered?

The user jsmith’s account has been locked out.

A keylogger is installed on [smith’s workstation

An attacker is attempting to brute force ismith’s account.

Ransomware has been deployed in the domain.

Q272. A security analyst learns that an attack vector, which was used as a part of a recent incident, was a well- known IoT device exploit. The analyst needs to review logs to identify the time of initial exploit. Which of the following logs should the analyst review first?

Wireless access point

Switch

Firewall

NAC

Q273. Which of the following actions would reduce the number of false positives for an analyst to manually review?

Create playbooks as part of a SOAR platform

Redefine the patch management process

Replace an EDR tool with an XDR solution

Disable AV heuristics scanning

Q274. Which of the following is best used to detect fraud by assigning employees to different roles?

Least privilege

Mandatory vacation

Separation of duties

Job rotation

Q275. Which of the following teams combines both offensive and defensive testing techniques to protect an organization’s critical systems?

Red

Blue

Purple

Yellow

Q276. An employee fell for a phishing scam, which allowed an attacker to gain access to a company PC. The attacker scraped the PC’s memory to find other credentials. Without cracking these credentials, the attacker used them to move laterally through the corporate network. Which of the following describes this type of attack?

Privilege escalation

Buffer overflow

SQL injection

Pass-the-hash

Q277. Which of the following is best used to detect fraud by assigning employees to different roles?

Least privilege

Mandatory vacation

Separation of duties

Job rotation

Q278. An employee receives a text message that appears to have been sent by the payroll department and is asking for credential verification. Which of the following social engineering techniques are being attempted? (Choose two.)

Typosquatting

Phishing

Impersonation

Vishing

Smishing

Misinformation

Misinformation is a type of social engineering technique that involves spreading false or misleading information to influence the beliefs, opinions, or actions of the target. Misinformation can be used to manipulate public perception, create confusion, damage reputation, or promote an agenda . Misinformation is not related to text messages or credential verification.

Reference = 1: What is Smishing? | Definition and Examples | Kaspersky 2: Smishing – Wikipedia 3: Impersonation Attacks: What Are They and How Do You Protect Against Them? 4: Impersonation – Wikipedia 5: What is Typosquatting? | Definition and Examples | Kaspersky 6: Typosquatting – Wikipedia 7: What is Phishing? | Definition and Examples | Kaspersky 8: Phishing – Wikipedia 9: What is Vishing? | Definition and Examples | Kaspersky : Vishing – Wikipedia : What is Misinformation? | Definition and Examples | Britannica : Misinformation – Wikipedia Explanation:
Smishing is a type of social engineering technique that uses text messages (SMS) to trick victims into revealing sensitive information, clicking malicious links, or downloading malware. Smishing messages often appear to come from legitimate sources, such as banks, government agencies, or service providers, and use urgent or threatening language to persuade the recipients to take action12. In this scenario, the text message that claims to be from the payroll department is an example of smishing.
Impersonation is a type of social engineering technique that involves pretending to be someone else, such as an authority figure, a trusted person, or a colleague, to gain the trust or cooperation of the target. Impersonation can be done through various channels, such as phone calls, emails, text messages, or in-person visits, and can be used to obtain information, access, or money from the victim34. In this scenario, the text message that pretends to be from the payroll department is an example of impersonation.
A) Typosquatting is a type of cyberattack that involves registering domain names that are similar to popular or well-known websites, but with intentional spelling errors or different extensions. Typosquatting aims to exploit the common mistakes that users make when typing web addresses, and redirect them to malicious or fraudulent sites that may steal their information, install malware, or display ads56. Typosquatting is not related to text messages or credential verification.
B) Phishing is a type of social engineering technique that uses fraudulent emails to trick recipients into revealing sensitive information, clicking malicious links, or downloading malware. Phishing emails often mimic the appearance and tone of legitimate organizations, such as banks, retailers, or service providers, and use deceptive or urgent language to persuade the recipients to take action78. Phishing is not related to text messages or credential verification.
D) Vishing is a type of social engineering technique that uses voice calls to trick victims into revealing sensitive information, such as passwords, credit card numbers, or bank account details. Vishing calls often appear to come from legitimate sources, such as law enforcement, government agencies, or technical support, and use scare tactics or false promises to persuade the recipients to comply9 . Vishing is not related to text messages or credential verification.

Q279. Which of the following vulnerabilities is associated with installing software outside of a manufacturer’s approved software repository?

Jailbreaking

Memory injection

Resource reuse

Side loading

Q280. Which of the following is the best way to provide secure remote access for employees while minimizing the exposure of a company’s internal network?

VPN

LDAP

FTP

RADIUS

Q281. An IT manager is increasing the security capabilities of an organization after a data classification initiative determined that sensitive data could be exfiltrated from the environment. Which of the following solutions would mitigate the risk?

XDR

SPF

DLP

DMARC

Q282. After a security awareness training session, a user called the IT help desk and reported a suspicious call. The suspicious caller stated that the Chief Financial Officer wanted credit card information in order to close an invoice. Which of the following topics did the user recognize from the training?

Insider threat

Email phishing

Social engineering

Executive whaling

Q283. A security analyst receives an alert that there was an attempt to download known malware. Which of the following actions would allow the best chance to analyze the malware?

Review the IPS logs and determine which command-and-control IPs were blocked.

Analyze application logs to see how the malware attempted to maintain persistence.

Run vulnerability scans to check for systems and applications that are vulnerable to the malware.

Obtain and execute the malware in a sandbox environment and perform packet captures.

Q284. A newly appointed board member with cybersecurity knowledge wants the board of directors to receive a quarterly report detailing the number of incidents that impacted the organization. The systems administrator is creating a way to present the data to the board of directors. Which of the following should the systems administrator use?

Packet captures

Vulnerability scans

Metadata

Dashboard

Q285. After a company was compromised, customers initiated a lawsuit. The company’s attorneys have requested that the security team initiate a legal hold in response to the lawsuit. Which of the following describes the action the security team will most likely be required to take?

Retain the emails between the security team and affected customers for 30 days.

Retain any communications related to the security breach until further notice.

Retain any communications between security members during the breach response.

Retain all emails from the company to affected customers for an indefinite period of time.

Q286. A cyber operations team informs a security analyst about a new tactic malicious actors are using to compromise networks.
SIEM alerts have not yet been configured. Which of the followingbestdescribes what the security analyst should do to identify this behavior?

[Digital forensics

E-discovery

Incident response

Threat hunting

Q287. Which of the following would best prepare a security team for a specific incident response scenario?

Situational awareness

Risk assessment

Root cause analysis

Tabletop exercise

Q288. During a recent company safety stand-down, the cyber-awareness team gave a presentation on the importance of cyber hygiene. One topic the team covered was best practices for printing centers. Which of the following describes an attack method that relates to printing centers?

Whaling

Dumpster diving

Prepending

Credential harvesting

Q289. Which of the following is used to improve security and overall functionality without losing critical application data?

Reformatting

Decommissioning

Patching

Encryption