SY0-701 Exam Dumps - CompTIA Security+ Exam 2026

General curiosity is the most likely motivation in this scenario. A company administrator may have legitimate technical access to databases, but viewing an employee’s personal information without a business need is an insider misuse issue. In Security+ terms, insider threats are not always financially motivated or malicious in the traditional sense; they can also involve inappropriate access driven by curiosity, snooping, or poor judgment. Ideological differences usually relate to activism, sabotage, or politically motivated behavior. Gaining influence would imply using the personal information for leverage or coercion, which is not stated. Intellectual property refers to proprietary business assets such as designs, code, or trade secrets, not employee personal data. The scenario best fits unauthorized access caused by curiosity.

================

Systems that control physical industrial processes—such as pumping gas, water control, electrical grids, or manufacturing lines—fall under SCADA (Supervisory Control and Data Acquisition) environments. SCADA systems are part of larger OT (Operational Technology) infrastructures and manage sensors, actuators, valves, flow controls, and telemetry.

CompTIA Security+ SY0-701 explains that SCADA environments typically:

Use legacy protocols (e.g., Modbus, DNP3)

Require high availability

Often run outdated operating systems

Have control systems that cannot easily be patched

Require specialized segmentation and monitoring

This exactly matches the scenario describing a “specialized legacy platform controlling gas flow inside pipes.”

IaaS (A) is cloud infrastructure and unrelated to industrial control. SDN (C) relates to software-defined networking, not physical industrial controls. IoT (D) includes smart devices but is not typically used for large-scale industrial gas control.

Thus, securing SCADA is the correct answer.

The $10,000 is the estimated cost per incident (per single occurrence). In quantitative risk analysis, that value is the Single Loss Expectancy (SLE)—the financial impact expected each time a risk event occurs. The Study Guide defines these terms and calculations clearly: “The single loss expectancy (SLE) is the amount of financial damage expected each time a risk materializes.” It also explains how annual impact is derived: “The annualized loss expectancy (ALE) is the amount of damage expected from a risk each year. It is calculated by multiplying the SLE and the ARO.”

Here, the event occurs twice per year, so the Annualized Rate of Occurrence (ARO) is 2.0, and the annual expected loss (ALE) would be SLE × ARO = $10,000 × 2 = $20,000, which matches the recommended budget. That confirms $10,000 is not ARO (a frequency), not ALE (annual total), and not RPO (a disaster recovery metric about acceptable data loss window).

Non-compliance with internal policies, such as corporate security policies, falls under internal non-compliance. These are rules created and enforced within the organization to maintain security standards.

External non-compliance (A) refers to violations of outside regulations or laws. Standards (B) are generally established best practices or industry guidelines, and regulation (C) refers to legal or governmental requirements.

Internal compliance management is a key focus area in the Security Program Management domain of SY0-701【6:Chapter 16†CompTIA Security+ Study Guide】.

Abug bounty programencourages ethical hackers tofind and report vulnerabilities, helping organizations discover security flaws before they are exploited by malicious actors. Unlikevulnerability scans, bug bounty programs usereal-world testing techniques.

A load balancer best supports the availability requirement because it distributes client traffic across available backend resources and can route traffic away from failed or overloaded systems. When properly implemented with multiple servers or redundant service instances, load balancing improves uptime, resilience, and service continuity. A proxy server forwards requests and may provide filtering or caching, but it does not inherently guarantee application availability. A jump server provides controlled administrative access to internal systems, not client-facing service continuity. Geographic restrictions limit access based on location and may actually reduce availability for some users. Security+ places load balancing under resilient architecture because it helps maintain access when individual systems fail or become saturated.

The best answer is C. Execute the file in a sandbox.

A sandbox is an isolated environment used to safely run suspicious files and observe their behavior without risking production systems. In this case, the analyst only used antivirus scanning, which may miss new, obfuscated, or previously unknown ransomware. By executing the file in a sandbox, the analyst could have observed malicious behaviors such as:

file encryption attempts

process spawning

registry changes

network beaconing

suspicious system modifications

This makes sandboxing a much better method for analyzing potentially malicious files than relying only on signature-based antivirus.

Why the other options are incorrect:

A. Review the file in a code editor.This might help in limited cases, but many malicious files are compiled, packed, or obfuscated. It is not a reliable primary analysis method.

B. Monitor the file connections with netstat.Netstat only shows network connections and would not fully reveal ransomware behavior, especially if the malware acts locally before making network connections.

D. Retrieve the file hash and check with OSINT.Hash reputation checks can help identify known malware, but they do not detect new or modified ransomware samples that do not yet appear in threat intelligence sources.

From the SY0-701 perspective, suspicious files should be analyzed using dynamic analysis in a sandbox to identify behavior that static tools may miss. That is why C is the best answer.