Simulado SY0-701: CompTIA CompTIA Security+ Certification Exam

Explanation: Correct answer: B. Requiring username and password alongside a hardware security key or mobile app-based authenticator. Multi-factor authentication requires at least two distinct factors from different categories: something you know (password/PIN), something you have (security key, smart card, or authenticator app), something you are (biometric), or somewhere you are (location). The scenario specifies combining 'something you know' and 'something you have,' which is precisely what option B provides - a password plus a hardware security key or mobile authenticator. Option A relies solely on passwords, undermining the objective. Option C uses single sign-on but doesn't necessarily add a second factor. Option D offers a choice between factors rather than requiring multiple factors together, which is weaker security than true MFA.

Explanation: Correct answer: A. Preparation Preparation is the phase in the incident response process when a security analyst reviews roles and responsibilities, as well as the policies and procedures for handling incidents. Preparation also involves gathering and maintaining the necessary tools, resources, and contacts for responding to incidents. Preparation can help a security analyst to be ready and proactive when an incident occurs, as well as to reduce the impact and duration of the incident. Some of the activities that a security analyst performs during the preparation phase are: Defining the roles and responsibilities of the incident response team members, such as the incident manager, the incident coordinator, the technical lead, the communications lead, and the legal advisor. Establishing the incident response plan, which outlines the objectives, scope, authority, and procedures for responding to incidents, as well as the escalation and reporting mechanisms. Developing the incident response policy, which defines the types and categories of incidents, the severity levels, the notification and reporting requirements, and the roles and responsibilities of the stakeholders. Creating the incident response playbook, which provides the step-by-step guidance and checklists for handling specific types of incidents, such as denial-of-service, ransomware, phishing, or data breach. Acquiring and testing the incident response tools, such as network and host-based scanners, malware analysis tools, forensic tools, backup and recovery tools, and communication and collaboration tools. Identifying and securing the incident response resources, such as the incident response team, the incident response location, the evidence storage, and the external support. Building and maintaining the incident response contacts, such as the internal and external stakeholders, the law enforcement agencies, the regulatory bodies, and the media. CompTIA Security+ SY0-701 Certification Study Guide, Chapter 6: Architecture and Design, Section 6.4: Secure Systems Design, p. 279-280 CompTIA Security+ SY0-701 Certification Exam Objectives, Domain 3: Architecture and Design, Objective 3.5: Given a scenario, implement secure network architecture concepts, Sub-objective: Incident response, p. 16

Explanation: Correct answer: A. Air gap Air-gapping is the most effective way to protect an application server running unsupported software from network threats. By physically isolating the server from any network connection (no wired or wireless communication), it is protected from external cyber threats. While other options like port security or a screened subnet can provide some level of protection, an air gap offers the highest level of security by preventing any network-based attacks entirely. Reference = CompTIA Security+ SY0-701 Course Content: Domain 03 Security Architecture. CompTIA Security+ SY0-601 Study Guide: Chapter on Secure System Design.

Explanation: Correct answer: A. Behavioral analytics Detailed Behavioral analytics tools monitor user actions and detect anomalies that may indicate insider threats, such as unauthorized access or unusual data exfiltration activities. These tools establish baselines for normal behavior and flag deviations. Reference: CompTIA Security+ SY0-701 Study Guide, Domain 4: Security Operations, Section: 'Behavioral Analytics and Monitoring'.

Explanation: Correct answer: B. $10,000 The Annual Loss Expectancy (ALE) is calculated using the formula: ALE = Single Loss Expectancy (SLE) x Annual Rate of Occurrence (ARO) Single Loss Expectancy:$15,000 (the financial impact

Explanation: Correct answer: C. IP geolocation To mitigate attacks from high-risk regions, organizations can implement geofencingor IP-based blocking. Geofencing restricts access based on geographic location, preventing users or traffic from high-risk regions from accessing resources. IP blocking specifically blocks traffic from IP address ranges associated with high-risk countries or regions. These controls provide a layer of defense by denying access attempts originating from dangerous geographic areas identified through threat intelligence.

Explanation: Correct answer: C. Shadow IT Shadow IT refers to employees using software or services without official approval, often introducing security risks due to lack of control, monitoring, or compliance. This can lead to vulnerabilities, data leakage, or policy violations. Unskilled attacker (A) and hacktivist (B) are threat actor types; supply chain (D) refers to risks from external partners or vendors, not internal unauthorized software usage. Shadow IT is highlighted in Security Program Management and Threats domains for its risk implications6:Chapter 16CompTIA Security+ Study Guide.

Explanation: Correct answer: A. Multicloud architectures Multicloud architectures use two or more IaaS providers (e.g., AWS + Azure + GCP) to distribute workloads, increase redundancy, and reduce single points of failure. Security+ SY0-701 emphasizes multicloud strategies for enhancing: Resilience Availability Fault tolerance

Explanation: Correct answer: A. Migrating to FIDO2 passkeys, utilizing built-in device biometrics for user authentication The best answer is A. Migrating to FIDO2 passkeys, utilizing built-in device biometrics for user authentication. The company wants a single, integrated authentication solution that is both more secure and easier for employees to use. FIDO2 passkeys best match this requirement because they allow passwordless authentication using cryptographic credentials stored on the user's device, often unlocked with biometrics or a local PIN. This improves security and usability because: users no longer need to manage a password plus a separate authenticator app phishing resistance is stronger than traditional passwords and OTPs authentication is integrated into the device experience biometric unlock makes login smoother for users

Explanation: Correct answer: D. The user's credentials are compromised and are being used by an attacker. This activity most likely indicates compromised credentials. Access from multiple countries within a 30-minute period is an impossible-travel indicator because a legitimate user cannot physically authenticate from geographically distant locations in such a short time. Since the user confirms they were at the office, the most likely explanation is that an attacker has obtained and is using the user's credentials. A scheduled automation tool would normally authenticate from predictable systems or service accounts, not multiple countries. VPN endpoint cycling is possible, but it is weaker because the activity involves access to internal servers and the user denies the behavior. Shared credentials would still be a security violation, but the best operational conclusion is credential compromise requiring containment, password reset, session revocation, and MFA review.