A system administrator notices that a server is sending out a large volume of data to an external IP address during off-hours. The administrator checks the server's logs and sees that a service account is running a process that was not scheduled. What should the administrator do first?

Ignore it because the server may be performing a legitimate backup

Reboot the server to clear the process

Disconnect the server from the network and then investigate

Kill the process and change the service account password

A security analyst notices that a user who typically works 9-to-5 has been logging in at 2:00 AM from an IP address in a foreign country. The user's account has also been downloading large amounts of data from a file server. Which action should the analyst take first?

Investigate the activity using monitoring tools and correlate with other indicators

Ignore the activity because it could be a legitimate remote access

Disable the user's account immediately

Contact the user to verify if they were working remotely

A security analyst is reviewing logs and notices that a user's account has been locked out multiple times in the past hour. The user is currently on vacation. What should the analyst do?

Investigate the source of the lockouts and consider if the account is compromised

Reset the user's password and unlock the account

Ignore the lockouts because they are a normal security feature

Contact the user to ask if they are trying to log in

A security team wants to detect if an employee's account is being used by an attacker. Which monitoring technique would be most effective?

Monitor for logins from unusual locations or devices

Monitor for changes to user permissions

Monitor for multiple failed login attempts

Monitor for large file downloads

Which practice is a recommended best practice for users to protect sensitive information?

Using a password manager to generate and store unique passwords

Sharing passwords with colleagues to ensure work continuity

Using the same password for multiple accounts to simplify login

Writing passwords on a sticky note under the keyboard

CompTIASecurity+

Domain 5Objective 6

Security Awareness SY0-701 Practice Questions (Page 5)

Part of the Security program management and oversight domain, which accounts for 20% of the SY0-701 exam. CompTIA does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

5concepts

20%of the exam

Questions 21–25

21application · medium
A system administrator notices that a server is sending out a large volume of data to an external IP address during off-hours. The administrator checks the server's logs and sees that a service account is running a process that was not scheduled. What should the administrator do first?
Select an answer first
22application · medium
A security analyst notices that a user who typically works 9-to-5 has been logging in at 2:00 AM from an IP address in a foreign country. The user's account has also been downloading large amounts of data from a file server. Which action should the analyst take first?
Select an answer first
23application · medium
A security analyst is reviewing logs and notices that a user's account has been locked out multiple times in the past hour. The user is currently on vacation. What should the analyst do?
Select an answer first
24application · medium
A security team wants to detect if an employee's account is being used by an attacker. Which monitoring technique would be most effective?
Select an answer first
25foundation · easy
Which practice is a recommended best practice for users to protect sensitive information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SY0-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “SY0-701” is a trademark of its owner, used for identification only.