Simulado SY0-701: CompTIA CompTIA Security+ Certification Exam

Explanation: Correct answer: B. Risk-based vulnerability management, which contextualizes technical severity with exploitability, exposure, and business impact. Risk-based vulnerability management goes beyond raw technical severity scores by incorporating environmental context such as exploitability, system exposure, and business criticality. A high-CVSS vulnerability on an internal, non-critical system might receive lower priority than a lower-CVSS vulnerability on an internet-facing critical system with known exploits. This approach allocates remediation resources more efficiently. Option A incorrectly suggests CVSS alone is sufficient (it is not - context matters). Option C describes a checkbox compliance approach that ignores risk prioritization. Option D is not a systematic approach at all.

Explanation: Correct answer: D. FIM FIM stands for File Integrity Monitoring, which is a method to secure data by detecting any changes or modifications to files, directories, or registry keys. FIM can help a security administrator track any unauthorized or malicious changes to the data, as well as verify the integrity and compliance of the data. FIM can also alert the administrator of any potential breaches or incidents involving the data. Some of the benefits of FIM are: It can prevent data tampering and corruption by verifying the checksums or hashes of the files. It can identify the source and time of the changes by logging the user and system actions. It can enforce security policies and standards by comparing the current state of the data with the baseline or expected state. It can support forensic analysis and incident response by providing evidence and audit trails of the changes. CompTIA Security+ SY0-701 Certification Study Guide, Chapter 5: Technologies and Tools, Section 5.3: Security Tools, p. 209-210 CompTIA Security+ SY0-701 Certification Exam Objectives, Domain 2: Technologies and Tools, Objective 2.4: Given a scenario, analyze and interpret output from security technologies, Sub-objective: File integrity monitor, p. 12

Explanation: Correct answer: B. CVSS The Common Vulnerability Scoring System (CVSS) is a standardized framework for assessing the severity of security vulnerabilities. It helps organizations prioritize vulnerability patching by providing a numerical score that reflects the potential impact and exploitability of a vulnerability. CVSS scores are used to gauge the urgency of patching vulnerabilities within a company's IT environment. Reference = CompTIA Security+ SY0-701 Course Content: Domain 05 Security Program Management and Oversight. CompTIA Security+ SY0-601 Study Guide: Chapter on Vulnerability Management.

Explanation: Correct answer: C. Privacy Detailed Privacy data includes information such as Personally Identifiable Information (PII), which relates to employees' or customers' personal data. Organizations often maintain policies and standards specifically addressing how such sensitive information should be handled. Reference: CompTIA Security+ SY0-701 Study Guide, Domain 5: Security Program Management, Section: 'Data Types and Classifications'.

Explanation: Correct answer: B. Cold site A warm site is the best option for minimum cost disaster recovery without additional internet connections because: Cost Balance:Warm sites provide a middle ground between expensive hot sites and cheap but slow cold G sites Partially Configured:Systems are partially configured and synchronized with live data, reducing recovery G time compared to cold sites No Additional Internet Needed:Unlike redundant live systems, a warm site doesn't require continuous G dual internet connections, reducing bandwidth costs Reasonable Recovery Time:Recovery typically takes hours rather than days (cold site) or minutes (hot G site) Lower Maintenance:Less expensive than maintaining a fully operational hot site while still providing faster G recovery than a cold site When budget is constrained and no funding exists for additional internet connections, a warm site provides the best balance of cost and recovery capability.

Explanation: Correct answer: C. Attestation of compliance The vendor provided a signed letterstating that their services meet specific compliance objectives. This signed, formal statement is known as an attestation. An attestation is a vendor's formal declaration or certification that they meet certain requirements or standards. It differs from a full audit (which would be conducted by an independent third party) or a SOC report (which is a detailed compliance report), though the documentation provided supports the attestation claim.

Explanation: Correct answer: A. Evil twin An evil twin attack involves setting up a fraudulent Wi-Fi access point that mimics a legitimate one to intercept network traffic or steal credentials. This attack exploits insecure wireless networks and is focused on network infrastructure. Impersonation, watering hole, and pretexting are social engineering or web-based attacks, not primarily network attacks. The evil twin attack is a well-known wireless threat discussed under Threats and Vulnerabilities in SY0- 7016:Chapter 2CompTIA Security+ Study Guide.

Explanation: Correct answer: C. Host isolation Host isolation ensures that a device cannot communicate with other systems on the network. Isolation is typically applied through EDR/XDR tools, quarantine mechanisms, or endpoint firewalls. Security+ SY0-701 identifies host isolation as a containment technique used when: A device is suspected of compromise Lateral movement must be prevented Sensitive systems must be protected A system must be completely cut off except for administrative access Isolation enforces an immediate block on all inbound and outbound communications, effectively making the device inaccessible to any network- based resource. Disablement of unused services (A) reduces attack surface but does not isolate the device. A WAF (B) protects web applications, not device access. A network IDS (D) only monitors traffic and does not block access. Thus, C: Host isolation is the correct answer.

Explanation: Correct answer: C. Execute the file in a sandbox. The best answer is C. Execute the file in a sandbox. Antivirus alone may miss new, obfuscated, or modified malware, including ransomware. A sandbox provides an isolated environment where the file can be safely executed and observed for malicious behavior such as: file encryption activity process spawning registry changes network callbacks persistence attempts

Explanation: Correct answer: B. Gap analysis An internal auditbest assesses the compliance level of in-place IT processes and assets against a certification the company is pursuing. An internal audit: - Reviews existing processes, controls, and assets against specific compliance framework requirements - Identifies gaps between current state and certification requirements - Can be conducted by internal audit teams or consultants - Provides a detailed assessment of compliance status and recommendations for remediation - Helps the organization understand what needs to be fixed before pursuing formal certification This differs from an external audit (conducted by a third party for formal certification) or a vulnerability scan (which focuses on technical vulnerabilities rather than compliance framework requirements).