CompTIA SY0-701 Practice Exam Questions & Answers

Abug bounty programencourages ethical hackers tofind and report vulnerabilities, helping organizations discover security flaws before they are exploited by malicious actors. Unlikevulnerability scans, bug bounty programs usereal-world testing techniques.

To mitigate the risk of confidential documents being left unattended in Multi-Function Printers (MFPs), implementing an authentication factor that requires in-person action before printing (such as PIN codes or badge scanning) is the most effective measure. This ensures that documents are only printed when the authorized user is present to collect them, reducing the risk of sensitive information being exposed.

Reference = CompTIA Security+ SY0-701 study materials, particularly in the domain of physical security and access control.

The best answer is C. Configure a NAC solution to enforce 802.1X authentication with device certificates and implement endpoint security checks.

NAC (Network Access Control) is used to verify devices before granting them access to the network. A strong NAC deployment should validate both identity and security posture. Enforcing 802.1X authentication ensures that devices must authenticate before connecting, and using device certificates strengthens trust in the device itself. Endpoint security checks add posture assessment, such as confirming antivirus, patch level, or compliance state.

This is the most secure and effective approach because it prevents unauthorized or noncompliant devices from joining the network in the first place.

Why the other options are incorrect:

A . Deploy a NAC solution to block wireless connections until devices can be verified against the baseline configuration.This only addresses wireless access and is too limited. Unauthorized devices could still attempt access in other ways.

B . Set the NAC solution to only accept handshakes initiated from a static set of IP addresses.IP addresses are not a reliable basis for device trust and can be spoofed or reassigned.

D . Implement a NAC solution that redirects all devices to the guest Wi-Fi for holding until a security analyst can validate the security compliance.Redirecting all devices is not practical or efficient, and guest Wi-Fi is not the best control for secure admission.

From a Security+ perspective, the strongest NAC implementation uses 802.1X, certificates, and posture assessment, making C correct.

A Virtual Private Network (VPN) is the best solution to allow remote employees secure access to company resources without interception concerns. A VPN establishes an encrypted tunnel over the internet, ensuring that data transferred between remote employees and the company is secure from eavesdropping.

Proxy server helps with web content filtering and anonymization but does not provide encrypted access.

NGFW (Next-Generation Firewall) enhances security but is not the primary tool for enabling remote access.

Security zone is a network segmentation technique but does not provide remote access capabilities.

Impossible travel (A)refers to logins fromgeographically distant locations within a time period that makes travel between them physically impossible. In this case, a user logging in fromChicago and Rome within a short timeframetriggers this anomaly.

This is a strong indicator of acompromised accountorstolen credentialsbeing used elsewhere.

The remote access VPN implementation described - where an agent installed on the endpoint establishes an encrypted tunnel - most likely uses:

• IPsec (Internet Protocol Security) - A widely-used protocol suite for VPN that creates encrypted tunnels at the network layer, commonly used with client agents
• OpenVPN - An open-source VPN protocol that uses SSL/TLS encryption and can operate with a client agent on the endpoint

Key characteristics mentioned in the question:

• Agent-based - Software installed on the client endpoint to initiate the connection
• Encrypted tunnel - End-to-end encryption of all traffic through the tunnel

Other VPN types:

• SSL/TLS VPN - Uses browser-based access, typically doesn't require a persistent agent
• PPTP - Older protocol, generally deprecated due to security weaknesses
• L2TP/IPsec - Another agent-based option combining Layer 2 tunneling with IPsec encryption

The description most closely matches IPsec or OpenVPN deployments commonly used in enterprise remote access scenarios.

The correct answer is B. Port mirroring.

Port mirroring, also known as SPAN, copies network traffic from one or more switch ports or VLANs to another port where a monitoring tool, packet analyzer, IDS, or SIEM-related sensor can inspect the traffic. This is the most appropriate method when the goal is to collect network traffic directly from a switch to gain visibility into network activity.

Why the other options are incorrect:

A . Syslog

Syslog collects log messages from systems, applications, and network devices. It is useful for SIEM log ingestion, but it does not capture full network traffic from a switch.

C . Port forwarding

Port forwarding redirects traffic from one port or IP address to another, commonly used for NAT or remote access. It is not used to monitor switch traffic.

D . Load balancer logs

Load balancer logs provide information about traffic passing through a load balancer, but they do not provide broad switch-level network visibility.

Therefore, the best answer is port mirroring.