Free CompTIA Security+ SY0-701 practice questions

Sample question 1. Two weeks after a phishing-led account compromise was fully contained and all systems were restored, the incident response lead gathers the responders, the help desk, and the affected business owner to review what happened, what worked, and what should change. Which phase of the incident response process is this?

1. Lessons learned, improving plans and controls from the incident.
2. Recovery, returning affected systems to normal service.
3. Analysis, determining the scope and cause of the incident.
4. Preparation, since the meeting will change the response plan.

Sample question 2. EDR telemetry shows an unsigned loader opening a handle to a running, signed browser process, allocating memory inside it, writing code into that memory, and starting a remote thread there. The malicious code then runs under the browser’s identity. Which technique does this describe?

1. Memory injection of code into a legitimate process.
2. A buffer overflow in the browser’s parsing code.
3. A race condition between two of the browser’s threads during start-up.
4. SQL injection against the browser’s local storage database.

Sample question 3. Before any controls, the risk of payment fraud on a new checkout was rated high. After adding 3-D Secure, velocity checks, and manual review of large orders, it is rated medium, while the company’s appetite for fraud risk is low. What is the medium rating, and what should happen next?

1. Inherent risk; no further action is needed now.
2. Residual risk; since it exceeds appetite, treat or formally accept it.
3. Control risk; replace the controls that were just added.
4. Accepted risk, since the controls are already in place and working.