CompTIA Security+ Certification Exam SY0-701 Practice Test 24

Question 1

A detailed agreement between a client and a vendor that describes the work to be performed on a project is called:

A) MSA
B) SLA
C) WO
D) SOW

Answer 1

D) SOW

Question 2

A legal contract between the holder of confidential information and another person to whom that information is disclosed restricting that other person from disclosing the confidential information to any other party is referred to as:

A) ISA
B) NDA
C) BPA
D) SLA

Answer 2

B) NDA

Question 3

Which of the terms listed below refers to a formal contract between business partners outlining the rights, responsibilities, and obligations of each partner regarding the management, operation, and decision-making processes within the business?

A) MSA
B) SLA
C) BPA
D) MOA

Answer 3

C) BPA

Question 4

Which of the following terms describes an investigation or assessment done upfront to ensure all facts and risks are known before proceeding?

A) Fiduciary duty
B) Due care
C) Standard of care
D) Due diligence

Answer 4

D) Due diligence

Question 5

Which of the terms listed below is used to describe actions taken to address and mitigate already identified risks?

A) Due diligence
B) Standard of care
C) Due care
D) Fiduciary duty

Answer 5

C) Due care

Question 6

Under data privacy regulations, the individual whose personal data undergoes collection and processing is known as

A) Data holder
B) Data owner
C) Data user
D) Data subject

Answer 6

D) Data subject

Question 7

Which of the following answers refers to an entity (such as an organization or individual) that determines the purpose and means of processing personal data?

A) Data processor
B) Data owner
C) Data controller
D) Data subject

Answer 7

C) Data controller

Question 8

An entity that acts under the instructions of a controller by processing personal data on behalf of the controller is called:

A) Data steward
B) Data processor
C) Data subject
D) Data custodian

Answer 8

B) Data processor

Question 9

hich of the terms listed below refers to a legal principle that allows individuals to request the removal of personal information from Internet searches and other public sources?

A) De-identification
B) Right to be forgotten
C) Anonymization
D) Consent management

Answer 9

B) Right to be forgotten

Question 10

A formal declaration by an auditor that they have performed their work in accordance with all relevant standards and regulations is referred to as:

A) Assertion
B) Certification
C) Validation
D) Attestation

Answer 10

D) Attestation

Question 11

In the context of audits, an attestation is typically provided by:

A) Regulatory body
B) External auditor
C) Audit committee
D) Internal audit team

Answer 11

B) External auditor

Question 12

In cybersecurity exercises, red team takes on the role of:

A) An attacker

B) A defender

C) Both an attacker and a defender

D) An exercise overseer

Answer 12

A) An attacker

Question 13

In cybersecurity exercises, the defending team is known as:

A) Red team
B) Blue team
C) White team
D) Purple team

Answer 13

B) Blue team

Question 14

In cybersecurity exercises, the role of an event overseer (i.e., the referee) is delegated to:

A) Red team
B) Blue team
C) White team
D) Purple team

Answer 14

C) White team

Question 15

In cybersecurity exercises, a purple team assumes the integrated role of all other teams (i.e., red, blue, and white).

A) True
B) False

Answer 15

B) False

Question 16

A penetration test performed by an authorized professional with the full prior knowledge on how the system that is to be tested works is called:

A) Black-hat hacking
B) White-box testing
C) Black-box testing
D) White-hat hacking

Answer 16

B) White-box testing

Question 17

Which of the following terms is used to describe a penetration test in which the person conducting the test has limited access to information on the internal workings of the targeted system?

A) Black-box testing
B) Fuzz testing
C) Gray-box testing
D) White-box testing

Answer 17

C) Gray-box testing

Question 18

A penetration test of a computer system performed without prior knowledge of how the system that is to be tested works is referred to as black-box testing.

A) True
B) False

Answer 18

A) True

Question 19

In penetration testing, active reconnaissance involves gathering any type of publicly available information that can be used later for exploiting vulnerabilities found in the targeted system.

A) True
B) False

Answer 19

B) False

Question 20

In penetration testing, passive reconnaissance relies on gathering information on the targeted system with the use of various non-invasive software tools and techniques, such as pinging, port scanning, or OS fingerprinting.

A) True
B) False

Answer 20

B) False

Question 21

In email communication, what signs can be of help in recognizing a phishing attempt?

A) The message contains poor spelling and grammar

B) The message asks for personal information

C) The message includes a call to action with a sense of urgency

D) The message includes suspicious links or attachments

E) Any of the above

Answer 21

E) Any of the above

Question 22

What would be an appropriate user response to an email phishing attempt? (Select all that apply)

A) Not replying to the message or providing any personal information

B) Reporting the message to the IT or security department, if applicable

C) Deleting the message from the inbox

D) Not clicking on any links or downloading any attachments in the message

E) Forwarding the message to the sender to verify its legitimacy

F) Opening the attachment in a sandbox environment to check its safety

Answer 22

A) Not replying to the message or providing any personal information

B) Reporting the message to the IT or security department, if applicable

C) Deleting the message from the inbox

D) Not clicking on any links or downloading any attachments in the message

Question 23

Which term best describes a disgruntled employee abusing legitimate access to a company’s internal resources?

A) APT
B) Insider threat
C) Gray hat
D) Threat actor

Answer 23

B) Insider threat

Question 24

Due to added functionality in its plug, a malicious USB cable can be used for:

A) GPS tracking

B) Capturing keystrokes

C) Sending and receiving commands

D) Delivering and executing malware

E) Any of the above

Answer 24

E) Any of the above

Question 25

What is the best countermeasure against social engineering attacks?

A) Situational awareness
B) Implicit deny policy
C) User education
D) Strong security controls

Answer 25

C) User education