SY0-701 — Frequently Asked Questions

Hacktivists act on personal ideology rather than for pay, so a state cannot contract them; they select targets they object to instead of accepting money to hit critical infrastructure.

Nation-states are government-sponsored by definition, so when a state outsources an attack abroad it typically uses proxies such as organized crime groups, which provide skill and plausible deniability.

Smishing is already a phishing subtype, so pairing B with E would give two overlapping delivery answers and ignore the payroll masquerade. CompTIA reserves phishing for the traditional email vector; the identity deception here is impersonation.

Vishing is voice phishing conducted over a phone call, while smishing uses SMS or text messaging. The stem specifies a text message, so the channel is smishing (E), and vishing (D) is the wrong vector.

Compensating controls apply when a real, confirmed vulnerability is offset by another control; here the analyst's Nmap test shows the reported cleartext condition does not match the host, so the report itself is wrong.

No. The Nmap script only proves the server offers encryption, not that clients must negotiate it, so most exam and real-world guidance still prefers replacing Telnet with SSH.

The firewall may isolate traffic, but the scenario's intent is to compensate for the legacy system's unpatched weaknesses with alternative controls, not to create network segments (B).

On a legacy system that cannot be patched or upgraded, disabling services is an alternative safeguard that reduces attack surface where the primary control—vendor-supported hardening—is not feasible.

Whaling targets the executive themselves, usually via a tailored email. Here the CFO's name was only a pretext used against a regular employee, so the broader social engineering label fits.

It is vishing, a voice-based social engineering attack. Since vishing is not offered as an option, the correct umbrella choice is social engineering (C), not email phishing (B).

DLP can only block what it can identify. Without classification labels or matching patterns, an email attachment rule blocks legitimate traffic and still misses sensitive data sent over other channels.

It covers only one exfiltration channel, ignores email, USB, and encrypted uploads, and does not tell the DLP engine what data is sensitive in the first place.

The sender's number was not spoofed and nothing in the scenario says the CEO's device was compromised, so imaging the phone investigates a threat that was never indicated.

Cancelling legitimate recognition gift cards does nothing to stop the scam, while a company-wide warning helps staff recognize the fraudulent texts already in circulation.

Fencing is a deterrent and delay control that blocks or slows intrusion, but it does not verify identity. Anyone who climbs over or breaches the fence can enter, so it cannot ensure only authorized personnel gain access.

An access control vestibule (mantrap) uses interlocking doors to allow only one person at a time into a small space, often requiring badge authentication before the next door opens. This physical design stops unauthorized individuals from following an authorized person through.

Isolation means a fully standalone or air-gapped network with no connectivity, but the scenario keeps the data on a separate part of the same network, so segmentation is correct.

No. Encryption protects data confidentiality but does not block network access; users on the main corporate network could still reach the storage unless network segmentation enforces access control.

Isolating a device on a separate segment is a containment control that limits exposure while the device is still in use; decommissioning permanently removes the asset, so only unresolvable security failures justify it.

A related build of this question listed a choice about a device unable to receive authorized updates; that option is not offered here, so the security-driven picks among A-E are B and E.

Legacy IoT devices usually no longer receive vendor OS updates, and constrained hardware can make patch deployment impractical, so patching is not a quick mitigation.

Replacement fixes the root cause permanently but requires procurement, compatibility testing, and operational downtime, so it is slower than isolating the devices with segmentation.

A right to audit clause is a contract provision permitting an organization to inspect a vendor's controls and records. It does not set the scope, timing, or authorized actions of the penetration test.

Scope and target systems or IP ranges, testing window, permitted and prohibited techniques, escalation and emergency contacts, and explicit legal authorization to test.

Hashing is a one-way function used for integrity checks and password verification, so the original value can never be recovered. Encryption hides the data while still allowing authorized decryption.

No. Tokenization swaps the real value for a surrogate token, but the original sensitive data still resides in a token vault that must be separately protected, so the stored data itself is not enciphered.

Because end of life means the vendor no longer sells the product, but it may still provide security patches; the scenario's lack of updates and patches defines end of support (C).

EOS is when vendor support, updates, and patches stop; EOL is when the product is no longer sold, though limited support may continue.

CompTIA's official study guide advises isolating unsupported systems as much as possible; segmentation still leaves the server reachable on the network. Isolation reduces the attack surface more completely.

Hardening helps but cannot fix an unsupported OS that no longer receives security updates. CompTIA recommends isolation plus compensating controls like monitoring and strict firewall rules.

RPO is only a metric for the maximum tolerable data loss, used to set backup and replication frequency. It informs the DRP but does not contain the procedures that restore systems and data.

An IRP is correct when the scenario is about detecting, containing, and eradicating a security incident. The DRP takes over when critical systems and data must be restored after disruption.

It removes shared accounts, but the appliance's built-in local admin account still exists with its factory password. Only changing that password or disabling the account stops a known-credential login.

It limits what the session can do afterwards, but it does not stop the authentication itself — and a local admin account usually has full control of the appliance anyway.

Key stretching iterates the hash to slow brute-force attacks, but the scenario explicitly adds a 36-character random string to the password, which is the definition of salting.

No, the salt is stored alongside the hash and is not part of the user's password; it makes each stored hash unique and defeats precomputed hash attacks.

A site survey addresses physical placement and coverage, but the security-focused action is to segment the IoT camera on a dedicated VLAN to prevent lateral movement.

Disabling unused ports is a valid hardening step, but VLAN segmentation is the primary deployment control for isolating an IoT device like a camera on the network.

DHCP logs only map IP addresses to MAC addresses; they do not show the C2 communication, so you first need network or firewall logs to find the suspicious IP.

Application logs record events within applications, not network traffic to external C2 servers, so they won't reveal which host is communicating with the attacker.

Asymmetric encryption requires a key pair, not one shared key — the sender encrypts with a public key and the receiver decrypts with the matching private key, which the question never describes.

Hashing is a one-way integrity function and salting just adds random data before hashing, so neither produces a reversible ciphertext that the peer could decrypt back into the original message.

A WAF inspects HTTP(S) traffic to protect web applications and has no ability to block a device from connecting to a physical switch port.

No, port security is a Layer 2 switch feature that limits MAC addresses per port; 802.1X/NAC adds identity-based authentication and can be layered with it.

Retention is a policy for keeping data over time, not a device-handling action; the question asks for activities on the laptop being reissued, so sanitization plus certification is the right pair.

Certification verifies that sanitization was performed correctly, and destruction would make the laptop unusable for the next employee, which contradicts reissuing.

Segmentation contains lateral movement and shrinks blast radius, but it does not make stolen credential records unreadable. Only one-way hashing removes the value of the data after a breach.

Tokenization suits data that must stay retrievable, like card numbers, using a stored vault mapping. Authentication requires comparing a verifier, which hashing provides and tokenization does not.

Secured zones sit in the control plane of CompTIA's Zero Trust model. The data plane contains the subject/system plus the policy engine, policy administrator, and policy enforcement point.

Subject/system, policy engine, policy administrator, and policy enforcement point. The analyst evaluates the subject's role because that is what the policy is enforced against.

DMARC authenticates the sending domain but does not inspect message content or block sensitive data; DLP enforces data-content policies to stop exfiltration.

Classification identifies which data is sensitive and where it resides, so DLP policies can monitor, alert on, or block unauthorized transfers of that specific data across endpoints, network, and cloud.

Confidential focuses on harm from unauthorized disclosure, but the question asks about impact of loss, and data essential to core operations (critical) causes the greatest disruption when unavailable.

Yes. CompTIA's privacy and data classification material lists public, private, sensitive, confidential, and critical, with critical carrying the highest impact if lost.

Business email is an attack surface, and business email compromise requires the attacker to control a legitimate mailbox. The scenario shows spoofed HR links, not a hijacked corporate account.

Hover to read the true destination, then verify the message through a known HR contact or the corporate portal instead of clicking the link or replying.

An MOU documents non-binding intent, but the question also requires specific deliverables and an accepted delivery time, which are SLA characteristics.

A BPA governs business partner relationships such as profit sharing and decision-making, not the service deliverables and timelines between a provider and a client.

It does block access, but CompTIA treats it as compensating because the legacy server cannot be patched or upgraded, so segmentation substitutes for the primary controls that are not feasible.

When it is the planned, primary defense for a supported system — for example, normal network zoning — rather than a workaround for an un-patchable legacy host.

Proxies manage web traffic and caching for internet access. They do not provide the dedicated, hardened isolation required for secure administrative access to internal infrastructure.

A bastion host is another term for a jump server. It is a specialized computer designed to withstand attacks and serve as a secure gateway to a private network.

It is crucial, but it is an operational procedure. You must first know if you are the controller (who fulfills the request) or processor (who assists) to implement the process correctly.

Yes, it affects jurisdiction (e.g., GDPR applies to EU residents), but the role (controller/processor) defines the actual duties regardless of where the company is headquartered.

Encryption protects data content, but virtualization ensures that the data resides in a secure, separate environment. Without isolation, an attacker could potentially bypass encryption by compromising the host.

No. Network segmentation divides traffic within a network, but virtualization creates the individual network and compute boundaries in the first place. You need both, but isolation is the foundational step.

No. Scanning implies using automated tools or software to analyze content. Hovering is a manual, human-based verification technique taught through training.

Policy review is an administrative activity to ensure compliance with rules. It does not describe the active identification of a specific malicious link by a user.

Decommissioning removes the asset, but if it is 'critical' for operations, immediate shutdown causes business disruption. Containment is the required interim step.

HIDS detects activity but does not prevent exploitation of known unpatched vulnerabilities. It is a detective control, not a sufficient preventive one for EOL systems.

External examinations are typically mandated by regulators or performed by independent third parties. An internal audit is used by the organization to self-assess and prepare for such events.

Yes. Attestation is a formal statement or certification of compliance, whereas an audit is the process of reviewing and evaluating the controls to determine if those statements are true.

Data exfiltration requires evidence of data being moved out of the organization. Not using a VPN is a policy violation (Shadow IT) but doesn't prove theft occurred.

Yes, Shadow IT creates security gaps that can be exploited for espionage, but the scenario only describes the unauthorized usage, not the malicious outcome.

Salting adds random data to the input to ensure unique hashes. Key stretching iterates the hash process to increase the time required to crack it.

Steganography hides data within other files. It does not add complexity to the input of a one-way hash function like SHA-256.

Tokenization replaces the card number with a random token. You cannot view the original last four digits from the token itself; a lookup is required.

Yes, masking is explicitly recommended by PCI DSS to protect cardholder data when full PAN visibility is not required.

While significant, reputational damage is often harder to quantify immediately than direct regulatory fines, making it less effective for urgent budget justification.

Fines are monetary penalties levied by regulators for legal non-compliance, whereas sanctions usually refer to broader restrictive measures often in geopolitical or employment contexts.

Memory injection modifies the running process in RAM without changing files on disk. Side loading involves executing unauthorized binaries or libraries that exist as files on the storage system.

SQL injection targets databases via web inputs. It does not typically cause a local batch job process to suddenly generate random high-port outbound network traffic.

While CCTV does detect activity by recording it, 'Detective' is not provided as an option. The question forces a choice between the remaining valid classifications: Deterrent (discouragement) and Directive (policy communication).

Deterrent controls aim to discourage malicious acts through fear of consequence (e.g., cameras, guards). Directive controls aim to influence behavior through instructions or warnings (e.g., 'No Entry' signs, privacy notices).

Whaling targets high-profile individuals. Since the victim here is an employee, not the executive, it is impersonation, not whaling.

Impersonating involves actively pretending to be a specific person to manipulate a victim. Disinformation is the general spread of false information without necessarily assuming a specific identity.

Yes, they are often used interchangeably. Both refer to a hardened system used as a gateway to access internal resources securely.

A WAF protects web applications from HTTP-based attacks. It does not secure non-web administrative protocols like SSH or RDP used for general system administration.

Side loading installs apps from unofficial sources, while jailbreaking modifies the OS to remove restrictions and enable new features.

Not always; some devices allow limited sideloading without full jailbreak, but jailbreaking is needed for deep system modifications.

Virtualization reduces physical servers but still requires a full guest OS for each VM. Containerization shares the host OS, resulting in fewer total OS instances.

No. Microservices is a design pattern. You can deploy microservices using containers or VMs. It doesn't inherently dictate the OS footprint.

Application logs track software usage and errors but lack low-level forensic data like process hashes, parent-child relationships, and file paths found in endpoint logs.

No, network logs capture traffic metadata (IPs, ports, protocols) but cannot see inside encrypted payloads or identify specific processes running on the host.

The Blue team identifies vulnerabilities through scanning and monitoring but focuses on defense. Active exploitation to prove exploitability is the Red team's offensive mandate.

The Red team performs the attack/exploitation. The Purple team coordinates the exercise between Red and Blue teams to ensure findings are communicated effectively.

FDE protects data at rest, but once the user logs in with valid credentials, the data is decrypted and accessible to any application running on the device.

Remote Wipe is a reactive incident response action. The question asks for a solution to 'increase security,' which implies a proactive control like containerization.

No. Mitigation involves implementing controls to reduce risk likelihood or impact. Insurance only transfers the financial consequence after the event occurs.

Transfer keeps the activity running but pays a third party for losses. Avoid means stopping the activity entirely so the risk no longer exists.

While TLS is common, many IoT devices lack the resources to run full TLS stacks. If the hardware cannot support the computation, the version compatibility is moot.

Not necessarily, but standard block ciphers may be too heavy. Lightweight alternatives or stream ciphers are often chosen specifically to mitigate resource constraints.

DRP focuses on restoring IT systems. BCP focuses on keeping essential services running, which may involve non-IT processes or manual workarounds if IT is down.

Yes, DRP is typically a subset of BCP. BCP covers the entire organization's ability to function, while DRP covers the IT infrastructure recovery.

A DNS sinkhole only resolves known bad domains. Since the domain is already dead, it provides no active protection. The real risk is the shortener pointing to new malicious sites later.

It could, but in a targeted attack scenario, preventing potential malware/phishing takes priority. Legitimate use can be whitelisted if necessary, whereas the current campaign is an active threat.

Insecure protocols are a vulnerability, but they can sometimes be mitigated via network controls. Lack of vendor support means you cannot patch the system itself, making the risk permanent.

Yes, typically. It implies the vendor has ended lifecycle support, so no new security updates or hotfixes will be released for identified threats.

While some frameworks call AUPs 'directive,' SY0-701 often groups them under preventive when 'directive' isn't an option, as they aim to stop violations by setting rules.

No. A compensating control replaces a failed primary control. An AUP is a primary administrative control that directly governs user behavior.

Self-signed certs are not trusted by clients/browsers by default, causing security warnings. They require manual trust installation on every device, which is unscalable for large enterprises.

If multiple distinct root domains are needed, a Single Wildcard won't work. You would need either multiple wildcard certificates or a Subject Alternative Name (SAN) certificate.

FIMs check for changes to file contents or permissions but don't typically try to read the raw content of highly restricted files like /etc/shadow in a way that triggers immediate permission denied errors during setup.

No, if run as root it succeeds. The error indicates the specific tool instance lacked privileges, which is common in unprivileged audit or attack scenarios.

Patching the CA is part of the Eradication phase, as it removes the vulnerability source. Cleanup focuses on handling the immediate consequences, such as revoking compromised certificates via the CRL.

No, updating the CRL only revokes trust in the compromised certificates. The underlying vulnerability in the CA must still be fixed through patching (Eradication) to prevent new malicious certificates from being issued.

Stewards manage data quality and ensure policies are followed, but the Owner defines those policies and authorizes access.

Owners define security requirements and access rules; Custodians implement technical controls and maintain the data daily.

SAST reviews source code for potential flaws but doesn't test the running application's reaction to actual malformed inputs, which is what fuzzing does.

Fuzzing proactively finds vulnerabilities by crashing the system with bad data during testing, allowing developers to patch those weaknesses before attackers exploit them.

Design Review is typically a pre-release validation step. Once the design is released, any fix becomes a change request governed by Change Control.

No. While risk is assessed during change control, the primary procedural requirement for altering a released asset is the Change Control Process itself.

CVE catalogs specific vulnerabilities (the 'what'), whereas OWASP categorizes and explains the exploitation methods and risks (the 'how') relevant to application development.

STIX is a format for sharing threat intelligence reports, while OWASP is a non-profit foundation providing guidelines and lists of security risks for software applications.

NIDS is a detection tool, not a mitigation/prevention tool. It alerts on malicious activity but does not block or stop the attack from succeeding.

A WAF is essential for Layer 7 protection, but adding HIPS ensures the underlying server is also monitored and protected if the WAF is bypassed.

Brand Impersonation is a technique used within the attack. The question asks for the 'type of attack,' and Phishing is the broader, standard classification for email-based credential harvesting.

No. The error likely means the malicious site failed to load properly after submission, but the initial lure and intent (stealing credentials via email) remain Phishing.

SCAP (Security Content Automation Protocol) is for automating security vulnerability and compliance checks on IT systems, not for mapping supply chain relationships or assessing logistical risks.

It provides end-to-end visibility, mapping dependencies, identifying bottlenecks, and assessing risks across the entire supply chain spectrum, including non-technical factors.

Penetration testing is part of the Testing phase, but branch protection is a continuous control embedded throughout the development workflow, making it more representative of daily SDLC operations.

No, the policy governs the SDLC but is not a step or control executed within the lifecycle itself; it is the framework rather than the execution.

No, it is required, but it is not the technical control that prevents the specific outage described. Testing validates the configuration.

It defeats the security purpose of the firewall by permitting all traffic, leaving the enterprise exposed to external threats.

$30,000 is the total expected loss across the whole three-year period ($15,000 × 2 events). ALE is an annualized figure, so that total must be divided by three years to give about $10,000.

ARO is the expected number of occurrences per year: 2 ÷ 3 ≈ 0.67. Multiply that by the $15,000 SLE and you get roughly $10,000, which is option B.

Counting records or observes activity as it occurs, which is the role of a detective control such as badge logs or cameras. Preventive controls block or deny access before it happens.

No. The immediate requirement is to determine the daily count; that data may inform preventive controls, but the counting mechanism itself is detective.

Unauthorized patching risks an unplanned production outage with no rollback plan and creates a change management and audit violation, even when the vulnerability is urgent.

No. Emergency change procedures may shorten the timeline or allow verbal authorization, but the change must still be documented, approved, and reviewed afterward.

The only attacker-influenced content the user touched was the resume received in a message; the company website visit and OS update were routine actions with no sign the site was compromised.

Typosquatting requires the user to mistype a URL and land on a look-alike domain, but no browsing mistake is described — the malicious content arrived unsolicited in a message.

IoCs are collected during detection and analysis to characterize the attack; RCA instead looks past the indicators to find why the control failed so the incident cannot recur.

Eradication removes the malware currently present, while RCA identifies the entry path and weakness that let it in, preventing the same intrusion from returning later.

Wiping uses low-cost or free software to overwrite data, while shredding requires specialized equipment, labor, and destroys the drive's resale value.

Yes—simple deletion removes only file references, so recovery tools can restore client data; wiping overwrites the actual data to prevent recovery.

Vulnerability scan records are smaller and structured, and they support remediation tracking and compliance, while full packet capture consumes far more storage for the same period.

Yes, endpoint and OS security logs are far less voluminous and provide critical host and authentication evidence for investigations, so they usually justify longer retention.

Disabling the script is a containment action. CompTIA incident response requires identifying whether the attack succeeded first, so you don't destroy evidence or miss unauthorized accounts.

An INSERT INTO users statement embedded in a web request to query.php indicates an attempt to add unauthorized accounts to the database.

RPO measures the maximum acceptable data loss in time, which drives how often backups run. It does not state how long systems may stay down, so it cannot answer how quickly services must return.

No. Risk tolerance is the acceptable deviation from the organization's risk appetite, a governance concept rather than a downtime target. The restoration-speed target is set by the recovery time objective (RTO).

Replication copies data to another server for redundancy or read scaling, but it does not automatically redistribute incoming traffic when a server is added or replaced.

Most load balancers automatically detect new healthy nodes and include them in the pool, so adding or replacing a server usually needs minimal reconfiguration.

Brute-force generates its own password guesses against the authentication service; it never positions the attacker between user and server to capture a credential that already works.

ARP poisoning, DNS spoofing, evil twin Wi-Fi, session hijacking and SSL stripping all put the attacker in the traffic path or downgrade TLS so logins can be read.

Redundancy duplicates resources or personnel, but it does not calculate how many staff are required to sustain essential functions during a disruption. Capacity planning is the sizing step.

Capacity planning calculates resource and staffing needs for disruption, while a tabletop exercise tests the plan through discussion. That makes tabletop exercise incorrect here.

Impersonation is only the mechanism; SY0-701 wants the named attack that matches the finance-fraud outcome, and BEC is the specific label for bank or executive spoofing that drives wire transfers.

Spear phishing is the delivery method aimed at specific users, while BEC is the goal-oriented fraud — convincing accounting to send funds to an attacker-controlled account.

A zero-day is exploited before a vendor fix or detection signature exists, so there is nothing for the engineer to deploy on day zero.

EOL is a vendor lifecycle milestone; updates reduce known vulnerabilities but do not obligate the vendor to keep supporting the hardware or software.

Encryption protects data if intercepted or stolen, but a user in a high-risk country with valid credentials and keys can still open the document; you need an access control that enforces location.

Yes, a VPN or proxy can hide the user's true origin IP, so geolocation should be combined with MFA, device compliance, and risk-based signals.

Country of origin is a supply-chain and vendor due-diligence factor that applies to any product, not a technical exposure created by installing and running a cheap IoT device in your infrastructure.

Many ship with weak defaults and no encryption for data at rest, and they often forward telemetry to vendor cloud services, exposing sensitive readings to unauthorized access or misuse.

An allow list filters by trusted source or service but does not inspect packet content, so malicious payloads from permitted hosts or protocols can still reach internal systems.

A host-based firewall protects only the host it runs on and does not provide inline, network-wide packet inspection at the perimeter, so it is less comprehensive than an IPS.

Buffer overflow is a software coding weakness in how an application handles memory, so it can affect many hardware platforms and is not tied to a specific firmware or device version.

Attackers can target known flaws in the firmware that controls a device's basic operations, and remediation usually requires applying a vendor firmware update.

Fingerprinting identifies the device type, OS, or browser, but it does not verify that patches, antivirus, or firewall settings meet corporate policy. Compliance attestation performs that policy check before access is granted.

Yes. A quarantine subnet is a pre-access holding area, so the security team should attest that each guest device satisfies minimum security requirements before allowing it to reach corporate resources.

Red team doctrine in SY0-701 is purely offensive adversary emulation. The question requires defensive work performed with developers during application building, which describes the yellow team instead.

Green team focuses on improving security through automation, scripting and orchestration. Yellow team instead works hands-on with developers to embed security into the build of key applications and software.

Federation allows users to use one set of credentials to access multiple systems (SSO). It does not automate the backend process of assigning or updating specific permissions within those systems.

No. Security Groups are containers that hold users. While you can assign permissions to a group, the group itself does not trigger or automate the change of those permissions based on events or roles.

MFA adds security steps but doesn't reduce the number of credentials. The question asks to 'reduce the number of credentials,' which SSO achieves by centralizing authentication.

No. PEAP is an authentication protocol primarily used for securing Wi-Fi connections (802.1X). It does not aggregate identities across different web-based SaaS platforms.

Least privilege is a security principle or goal, not a specific technical object or list. You use an ACL to ENFORCE least privilege, but you don't 'tune' the principle itself on a file.

Patching fixes software vulnerabilities by updating code. ACLs manage access rights (permissions) for users and processes to read or write files. They serve completely different functions.

Logging in completes Authentication. The question asks about granting access rights after this step, which is the function of Authorization.

Identification is claiming an identity (username), while Authentication is proving it (password/biometrics). Authorization comes next.

Degaussing is a form of sanitization. It destroys the magnetic field, making data unrecoverable, but does not physically destroy the platter.

Physical destruction involves breaking the hardware (shredding/burning). Wiping leaves the hardware intact, allowing it to be recycled or reused.

While OSINT can support threat hunting, 'collecting evidence' is a broad term often involving internal forensics. Social engineering testing is explicitly defined by its reliance on public data gathering.

Common sources include LinkedIn for professional connections, company websites for org charts, and public social media posts for personal interests.

'Critical' typically refers to data whose unavailability causes immediate business failure. Patient data is primarily about confidentiality (privacy), making it 'Sensitive'.

In most enterprise frameworks (like NIST or CIS), 'Private' is not a standard tier. Standard tiers are usually Public, Internal, Confidential, and Restricted/Top Secret.