Selected SY0-701 CompTIA Security+ Questions Answers

Using different cloud service providers supports platform diversity and reduces dependency on a single provider. For a critical financial application, this improves resilience because a provider outage, regional disruption, account issue, or provider-specific service failure is less likely to make all resources unavailable at once. This is a multi-cloud availability and continuity strategy. Option A focuses on load balancing application overhead, which may be possible but is not the strongest Security+ reason for using different CSPs. Option C incorrectly frames the benefit as parallel processing for security updates. Option D describes a hot site, which is a disaster recovery location, not necessarily the reason for using multiple CSPs. The core architectural benefit is reducing single-provider dependency through platform diversity.

================

The correct answer is D. NetFlow.

NetFlow records network traffic metadata, such as source IP address, destination IP address, source port, destination port, protocol, timestamps, and traffic volume. This makes it especially useful for detecting port scan activity, because port scans often show a pattern of one system attempting connections to many ports or many hosts in a short period of time.

This aligns with CompTIA Security+ SY0-701 security operations topics related to log analysis, network monitoring, and detection of suspicious traffic patterns.

Why the other options are incorrect:

A. Firewall

Firewall logs can detect some port scan activity, especially if the firewall blocks and logs connection attempts. However, NetFlow is generally better for identifying scan patterns across network traffic because it provides broader flow visibility.

B. Proxy

Proxy logs are mainly useful for web traffic analysis, URL filtering, and HTTP/HTTPS activity. They are not the best source for detecting port scans across many ports.

C. Endpoint

Endpoint logs may show local connection attempts or suspicious activity on a host, but they do not provide the same network-wide visibility as NetFlow.

Therefore, the best log source for detecting port scan activity is NetFlow.

Infrastructure as code (IaC) is a method of using code and automation to manage and provision cloud resources, such as servers, networks, storage, and applications. IaC allows for easy deployment, scalability, consistency, and repeatability of cloud environments. IaC is also a key component of DevSecOps, which integrates security into the development and operations processes. References: CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, Chapter 6: Cloud and Virtualization Concepts, page 294.

The best answer is B. Directory traversal.

The URLs show attempts to manipulate the filename parameter in order to access sensitive files and directories on the server, especially:

/etc/

/../etc/passwd

/etc/passwd

This is a classic directory traversal attack, also known as path traversal. The attacker is trying to move outside the intended directory structure and access protected operating system files. The reference to /etc/passwd is a common indicator of an attempt to read sensitive files on Unix/Linux systems.

Why the other options are incorrect:

A. Credential replayCredential replay involves reusing captured authentication credentials, which is not what these requests show.

C. Brute-force attackA brute-force attack involves repeated guessing, usually of passwords, keys, or codes. That is not the behavior shown here.

D. Resource exhaustionResource exhaustion involves overwhelming a system with requests or usage to reduce availability. These examples instead show attempts to access files through manipulated paths.

From a Security+ standpoint, attacks using ../ to escape directories are a well-known example of directory traversal, so B is the correct answer.