Simulado SY0-701: CompTIA CompTIA Security+ Certification Exam

Explanation: Correct answer: A. Swipe card; D. Biometric scanner Detailed Swipe cards and biometric scanners are commonly used to control on-premises access due to their reliability and ability to restrict unauthorized entry. Swipe cards provide physical access control, while biometric scanners ensure identity verification. Reference: CompTIA Security+ SY0-701 Study Guide, Domain 1: General Security Concepts, Section: 'Physical Security Controls'.

Explanation: Correct answer: A. UBA User and Entity Behavior Analytics (UEBA) is the enterprise capability most likely to detect unauthorized access to sensitive information because: Behavioral Analysis:UEBA systems establish baselines of normal user behavior and detect deviations when G users access unusual resources Access Pattern Detection:The system identifies when users access sensitive data or projects unrelated to G their job duties Anomaly Detection:Machine learning identifies suspicious patterns such as accessing sensitive projects G without legitimate business reasons Real-Time Monitoring:UEBA provides continuous monitoring of user activities across systems and G applications Insider Threat Focus:UEBA is specifically designed to detect insider threats and inappropriate data access G by employees UEBA is the modern approach to detecting when employees access information beyond their authorized scope.

Explanation: Correct answer: B. SSH tunneling When a legacy FTP server cannot be upgraded to SFTP, the most appropriate compensating control is to use a VPN or IPsec tunnel. These technologies encrypt the data in transit, protecting it from eavesdropping and interception. By wrapping the insecure FTP connection in an encrypted tunnel, the sensitive financial data is protected even though the underlying FTP protocol remains unencrypted. This is a common compensating control for legacy systems that cannot be immediately upgraded.

Explanation: Correct answer: A. Espionage The act described is espionage, where classified information is stolen and provided to adversaries or unauthorized parties, usually for political, military, or strategic advantage. Data exfiltration (B) is the technical act of stealing data but doesn't specify motivation. Financial gain (C) or blackmail (D) could be motivations but are not clearly indicated here. Espionage is a classic threat actor motivation outlined in the Threats domain6:Chapter 2CompTIA Security+ Study Guide.

Explanation: Correct answer: C. FIM File Integrity Monitoring (FIM) is the best tool for detecting unauthorized file deletions, modifications, or improper permission changes within network shares. FIM works by creating cryptographic hashes and baselines for protected files or directories and then continuously monitoring for deviations. Any unauthorized deletion, modification, or permission change triggers alerts. Security+ SY0-701 identifies FIM as a foundational integrity control used in compliance frameworks (PCI-DSS, HIPAA) and operational security monitoring. Because the organization is experiencing unpredictable changes to shared files and permissions, FIM provides visibility and accountability for who changed what and when. DLP (A) prevents data leakage but does not detect permission changes. EDR (B) focuses on endpoint threat behavior, not file integrity on network shares. ACLs (D) define permissions but do not track changes or detect unauthorized modifications. Therefore, C: FIM is the correct choice.

Explanation: Correct answer: C. Hacktivists often target organizations without prior access or internal affiliation. The best answer is C. Hacktivists often target organizations without prior access or internal affiliation. The clearest distinction between hacktivists and insider threats is that insider threats typically have authorized access or internal affiliation with the organization, while hacktivists usually act from the outside. Hacktivists are often motivated by political, ideological, or social causes, but the strongest differentiator in this comparison is that they generally do not begin with legitimate internal access. Why the other options are less correct: A. Hacktivists often act based on ideological or political beliefs rather than organizational access.This is true about motivation, but it does not distinguish them as directly as the lack of internal access does. B. Hacktivists are generally employed by the target organization at the time of attack.This describes insiders, not hacktivists. D. Hacktivists are primarily motivated by personal conflicts or employment-related dissatisfaction.This is more typical of some insider threats, not hacktivists. From the SY0-701 perspective, the strongest distinction is external targeting without prior authorized access, so C is the best answer.

Explanation: Correct answer: A. Jump server A jump server is a device or virtual machine that acts as an intermediary between a user's workstation and a remote network segment. A jump server can be used to securely access servers or devices that are not directly reachable from the user's workstation, such as database servers. A jump server can also provide audit logs and access control for the remote connections.A jump server is also known as a jump box or a jump host12. RADIUS is a protocol for authentication, authorization, and accounting of network access.RADIUS is not a device or a method to access remote servers, but rather a way to verify the identity and permissions of users or devices that request network access34. HSM is an acronym for Hardware Security Module, which is a physical device that provides secure storage and generation of cryptographic keys. HSMs are used to protect sensitive data and applications, such as digital signatures, encryption, and authentication.HSMs are not used to access remote servers, but rather to enhance the security of the data and applications that reside on them5. A load balancer is a device or software that distributes network traffic across multiple servers or devices, based on criteria such as availability, performance, or capacity. A load balancer can improve the scalability, reliability, and efficiency of network services, such as web servers, application servers, or database servers. A load balancer is not used to access remote servers, but rather to optimize the delivery of the services that run on them.Reference= How to access a remote server using a jump host Jump server RADIUS Remote Authentication Dial-In User Service (RADIUS) Hardware Security Module (HSM) [What is an HSM?] [Load balancing (computing)] [What is Load Balancing?]

Explanation: Correct answer: B. SLA A service level agreement (SLA) is a type of agreement that defines the expectations and responsibilities between a service provider and a customer. It usually includes the quality, availability, and performance metrics of the service, as well as the time frame in which the provider needs to respond to service requests, incidents, or complaints. An SLA can help ensure that the customer receives the desired level of service and that the provider is accountable for meeting the agreed-upon standards. Security+ (Plus) Certification | CompTIA IT Certifications, under ''About the exam'', bullet point 3: ''Operate with an awareness of applicable regulations and policies, including principles of governance, risk, and compliance.'' CompTIA Security+ Certification Kit: Exam SY0-701, 7th Edition, Chapter 1, page 14: ''Service Level Agreements (SLAs) are contracts between a service provider and a customer that specify the level of service expected from the service provider.''

Explanation: Correct answer: D. Dumpster diving Dumpster diving is an attack method where attackers search through physical waste, such as discarded documents and printouts, to find sensitive information that has not been properly disposed of. In the context of printing centers, this could involve attackers retrieving printed documents containing confidential data that were improperly discarded without shredding or other secure disposal methods. This emphasizes the importance of proper disposal and physical security measures in cyber hygiene practices. Reference = CompTIA Security+ SY0-701 Course Content: Domain 04 Security Operations. CompTIA Security+ SY0-601 Study Guide: Chapter on Physical Security and Cyber Hygiene.