SY0-701 · Objective 4.1 · Security Operations
4.1 Securing computing resources explained
The official objective: “Given a scenario, apply common security techniques to computing resources.” Here is what it means, what candidates mix up, and 3 practice questions that test it.
What objective 4.1 covers
Objective 4.1 is hands-on hardening. Given a device or application, which settings and techniques make it safer? The exam groups the answers into baselines, hardening targets, wireless, mobile and application security.
A secure baseline is the approved set of security settings for a type of system. You establish it (often from a published benchmark), deploy it to every new system, and maintain it by checking for and correcting drift. Group Policy on Windows and configuration management tools elsewhere are how baselines are pushed at scale.
Hardening targets include mobile devices, workstations, switches, routers, cloud infrastructure, servers, ICS and SCADA, embedded systems, real-time operating systems and IoT devices. The steps are similar everywhere: remove what isn't needed, change defaults, patch, restrict access and turn on logging.
Wireless needs planning before installation. A site survey and a heat map show signal coverage and interference so access points go in the right places. For encryption, WPA3 is the current standard; its personal mode uses SAE, which resists offline guessing of the passphrase far better than WPA2's pre-shared key. Enterprise mode authenticates each user individually against a RADIUS server, using 802.1X and an EAP method.
Mobile solutions include mobile device management and the deployment models: bring your own device (BYOD, the employee owns it), corporate-owned personally enabled (COPE, the company owns it but allows personal use) and choose your own device (CYOD, the employee picks from an approved list the company buys). Connection methods such as cellular, Wi-Fi and Bluetooth each need settings. MDM can enforce screen locks, separate work data into a container and wipe it remotely.
Application security is the last group. Input validation checks data on the server, because client-side checks are trivially bypassed. Secure cookies use the Secure attribute (sent only over HTTPS) and HttpOnly (not readable by scripts). Static code analysis looks for flaws without running the code. Code signing proves who published the code and that it hasn't changed. Sandboxing runs untrusted code where it can't harm the system, and monitoring watches the result.
Questions often describe one device and one problem. Pick the technique that addresses exactly that problem on that kind of device.
What candidates mix up
- WPA3-Personal versus WPA3-Enterprise: personal uses a shared passphrase with SAE; enterprise authenticates each user through RADIUS.
- BYOD versus COPE: in BYOD the employee owns the device; in COPE the company does.
- Client-side versus server-side validation: only server-side validation is a security control.
- Secure versus HttpOnly cookie flags: Secure stops the cookie going over HTTP; HttpOnly stops scripts reading it.
Practice questions for 4.1
From the CertRidge SY0-701 question bank. Try each one before opening the answer.
Question 1
Every new Windows Server an organization deploys must start with the same set of hardened, security-related settings. The operations team also needs a way to tell later when a server's settings no longer match that approved standard. Which approach best meets both needs?
- AApply a Microsoft security baseline through Group Policy and check servers for compliance with it
- BInstall an EDR agent on each server and rely on its default prevention policy
- CRun an annual penetration test against each server after it enters production
- DHave each administrator record their own build steps in a shared team wiki
Show answer and explanation
Answer: A) Apply a Microsoft security baseline through Group Policy and check servers for compliance with it
A security baseline defines the approved hardened configuration. Deploying it centrally (for example, with Group Policy) and checking compliance against it keeps servers consistent and shows when they drift.
- AA security baseline is a vetted, documented set of recommended settings. Microsoft says baselines can be applied with Group Policy, Configuration Manager or Intune and used to confirm that devices still comply, which covers both setting up new servers and spotting drift later.
- BEDR detects and responds to threats on endpoints. It doesn't apply or verify OS hardening settings such as Group Policy security options.
- CPenetration tests find exploitable weaknesses at one point in time. They don't set up a standard configuration on new servers or continuously show where settings have drifted.
- DBuild notes written by each administrator lead to inconsistent configurations, and nothing in this approach enforces or measures compliance with one approved standard.
Question 2
An attacker captures the authentication exchange between a client and a WPA2-Personal access point, then tries to crack the passphrase offline. Why would the same attack be far less effective against a WPA3-Personal network?
- ASAE key establishment prevents offline guessing of the passphrase from captured frames
- BEach client authenticates to a RADIUS server through 802.1X instead of using a shared passphrase
- CMandatory Protected Management Frames encrypt the handshake so it cannot be captured
- DThe access point stops broadcasting its SSID, so attackers cannot observe the handshake
Show answer and explanation
Answer: A) SAE key establishment prevents offline guessing of the passphrase from captured frames
WPA3-Personal uses SAE (Simultaneous Authentication of Equals) instead of the WPA2 pre-shared key exchange. This stops attackers from guessing the passphrase offline from a captured exchange.
- ACorrect. WPA3-Personal replaces the WPA2 PSK exchange with Simultaneous Authentication of Equals (SAE), a secure key-establishment protocol. SAE gives stronger protection against password guessing, so a captured exchange can't be used for offline dictionary attacks.
- BIncorrect. 802.1X with a RADIUS server is used by WPA2/WPA3-Enterprise. WPA3-Personal still uses a shared passphrase, which SAE protects.
- CIncorrect. Protected Management Frames protect management frames such as deauthentication messages from forgery. They don't stop offline passphrase cracking; SAE does.
- DIncorrect. WPA3 doesn't require hiding the SSID, and a hidden SSID is easy to discover. The authentication exchange can still be captured; SAE makes the captured frames useless for offline guessing.
Question 3
A web application sets a session cookie. Which two cookie attributes reduce the risk of the session being stolen? (Choose two.)
Select 2 answers.
- ASecure
- BHttpOnly
- CMax-Age
- DPath
Show answer and explanation
Answer: A) Secure; B) HttpOnly
- AThe Secure attribute makes the browser send the cookie only over HTTPS, so it isn't exposed in plaintext.
- BHttpOnly blocks client-side scripts from reading the cookie, reducing theft through cross-site scripting.
- CMax-Age only sets how long the cookie lives; it doesn't protect it in transit or from scripts.
- DPath limits which URLs the cookie is sent to on the site, but doesn't stop interception or script access.
Other Security Operations objectives
Also: the Security Operations domain page (28% of the exam), all SY0-701 objectives and the SY0-701 cheat sheet.
Ready for a full SY0-701 practice exam?
Timed practice exams match the real exam's length and domain weights, every result shows your score per domain, and Review Mode re-drills the questions you missed.
Objective numbers and statements from CompTIA's published SY0-701 exam objectives. The explanations and questions are our own. Not affiliated with CompTIA.