What is the primary objective of a penetration test?

To verify compliance with regulatory standards

To patch all identified vulnerabilities immediately

To inventory all hardware and software assets

To identify and exploit vulnerabilities to assess the effectiveness of security defenses

An internal audit team is planning to assess the security of a new cloud-based customer relationship management (CRM) system. The team has limited experience with cloud environments. What is the most effective approach for the audit?

Review the cloud provider's attestation reports and conduct a focused audit on the organization's configuration and usage of the CRM

Rely solely on the cloud provider's internal audit reports

Perform a vulnerability scan of the CRM from the internet

Conduct a full penetration test of the cloud provider's infrastructure

A security manager wants to evaluate the effectiveness of the organization's access control procedures from within the company. Which activity is most appropriate for this purpose?

Review the business impact analysis

CompTIASecurity+

Domain 5Objective 5

Audits and Assessments SY0-701 Practice Questions (Page 3)

Part of the Security program management and oversight domain, which accounts for 20% of the SY0-701 exam. CompTIA does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

4concepts

20%of the exam

Questions 11–15

11foundation · easy
What is the primary objective of a penetration test?
Select an answer first
12expert · hard
An internal audit team is planning to assess the security of a new cloud-based customer relationship management (CRM) system. The team has limited experience with cloud environments. What is the most effective approach for the audit?
Select an answer first
13application · medium
A security team is authorized to conduct a penetration test on the company's internal network. They have been given full knowledge of the network architecture and credentials. What type of penetration test is this?
Select an answer first
14foundation · easy
A security manager wants to evaluate the effectiveness of the organization's access control procedures from within the company. Which activity is most appropriate for this purpose?
Select an answer first
15application · easy
A company's internal audit team is evaluating the effectiveness of its access control policy. They review user access rights, compare them to job roles, and verify that terminated employees' accounts are disabled. What type of audit is this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SY0-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “SY0-701” is a trademark of its owner, used for identification only.

Audits and Assessments SY0-701 Practice Questions (Page 3)

Questions 11–15

What is the primary objective of a penetration test?

An internal audit team is planning to assess the security of a new cloud-based customer relationship management (CRM) system. The team has limited experience with cloud environments. What is the most effective approach for the audit?

A security team is authorized to conduct a penetration test on the company's internal network. They have been given full knowledge of the network architecture and credentials. What type of penetration test is this?

A security manager wants to evaluate the effectiveness of the organization's access control procedures from within the company. Which activity is most appropriate for this purpose?

A company's internal audit team is evaluating the effectiveness of its access control policy. They review user access rights, compare them to job roles, and verify that terminated employees' accounts are disabled. What type of audit is this?

Keep studying — Security program management and oversight