Free CompTIA Security Plus SY0-701 Actual Exam Questions

B imo, insurance shifts the financial burden to another party rather than reducing the risk itself. That’s a classic transfer move, not avoid or accept.

B imo, since insurance hands over the financial hit to the insurer, it’s clearly transferring the risk rather than reducing or avoiding it. No point picking mitigate here.

A imo. Enabling threat prevention on the firewall directly reduces risk at the network level without outright blocking access, which fits the idea of a compensating control. B is more about detection than prevention, so it’s less proactive. C sounds risky since allowing traffic from any port is too broad and could introduce more vulnerabilities. D just blocks access, which isn’t really compensating if users still need to reach the site for business reasons. So A makes the most sense here.

Maybe B since monitoring all traffic helps detect issues without blocking access.

Option B seems right because it separates the web servers from the internal network with a DMZ, which adds an extra layer of protection for customer data. That’s usually best practice for this kind of setup.

I’d say option B fits best since it shows the web servers in a DMZ, which is typical for customer-facing apps to add a security layer before reaching the internal network.

B/C? Sanctions (B) are definitely a big deal, but external compliance reporting (C) can also lead to penalties if done wrong, so both directly tie to consequences of non-compliance.

It’s B

Host 3 clearly shows unusual outbound connections and malware alerts in the logs, so it’s the source of the infection. Hosts 1 and 2 mostly show inbound traffic from Host 3 but no signs of spreading the infection themselves, so I’d mark them as clean and deny any incoming traffic from Host 3 to limit spread. The firewall rules should block Host 3 completely, while allowing normal operations for Hosts 1 and 2. This way, we isolate the infected machine without disrupting the whole network unnecessarily.

Host 3 looks infected; I’d block that and keep others clean.

Option A makes sense since it’s about exploiting a typing error, not full impersonation.

It’s A. The main clue is the slight misspelling with the extra “w,” which is exactly what typosquatting is about. Brand impersonation would be more about fake branding, not just a typo.

B imo, since private keys are just part of the process, they don’t actually encrypt data by themselves. Full disk encryption directly secures everything stored on the device.

Digital signatures (A) don’t protect stored data, so definitely not that.

Thinking about it differently, cross-site scripting (A) usually targets web applications, so that seems unlikely for an RTOS unless it has a web interface, which isn’t typical. Replay attacks (C) rely on capturing and reusing valid data transmissions, so unless the RTOS is networked and uses unsecured protocols, that might not be straightforward either. Ransomware (D) seems more like a high-level threat for systems running full OSes rather than real-time ones focused on specific tasks. So, memory injection (B) still feels the most plausible because it targets the core memory where the RTOS ope

B vs C here, memory injection feels more direct for RTOS compromise than replay attacks.

C imo, hashing is the only one that actually detects changes in the file.

Masking and obfuscation mainly hide data but don’t verify integrity. Encryption keeps data secret but won’t tell you if a file was altered. So, does that make C the only real choice here?

D imo, because incorrect inventory data isn’t fixed by deleting info, unlike A.

C, because proper data sanitization also helps prevent accidental leaks from misclassified info.

Option A makes sense too since policies set the framework for the whole risk management approach. Without checking them first, you might miss how risks are supposed to be identified and handled.

B/C? I get why folks pick A first, but checking asset management (B) could be just as important initially since managing assets directly ties into risk exposure. If assets aren’t identified or controlled well, policies won’t be effective. So, verifying what assets are in scope might come before detailed vulnerability assessments (C) or business impact analysis (D). Policies alone don’t guarantee risks are well understood or managed without knowing what you’re protecting.

Option B and F seem most fitting for sensitive government project info.

B, F. Since it’s a government project, the info won’t be public (C is out). Restricted (F) fits for sensitive access, and Confidential (B) covers the sensitive but necessary sharing part.

A/C? C seems off since env vars rarely set crypto standards directly, but A highlights how env vars can change how bad a vulnerability gets, which feels more on point here.

I’m thinking B might be plausible too—if attackers can overwrite env vars in memory, that could be a direct vector for malicious code. Is that less likely than the impact scope idea in A?

This one’s kinda tricky, but I’m thinking it’s B. Retaining any communications related to the breach until further notice makes sense since you don’t want to lose anything that could be important for the lawsuit. The other options seem too narrow or specific to just certain emails. Anyone else find it confusing?

Option B, since WAFs are designed to block attacks targeting web apps directly.

B vs A—Does the question imply they need protection specifically at the web app layer?