The second half of Security+ SY0-701’s architecture domain is about protecting data and keeping the business running. You need to know how to protect data in each state, which technique hides or replaces sensitive values, how data location creates legal obligations, and how sites, backups, power, and testing make an organization resilient.
This is the sixth set in our Security+ SY0-701 series (Questions 51-60). It follows SY0-701 Questions 41-50 on security architecture and infrastructure. Every question is an original practice scenario mapped to the official exam objectives, not a copy of a real exam item.
Several answers here sound alike, such as masking and tokenization or warm and cold sites. Focus on the exact requirement in each scenario before you answer.
Question 51: Card Numbers the Database Never Holds
An online store wants its order database to stop storing real credit card numbers. Order records should hold a substitute value with no mathematical relationship to the card number, and only a separate, highly protected system should be able to map it back to the real number for payments. Which technique fits?
A) Tokenization
B) Hashing with SHA-256
C) Data masking in the user interface
D) Compressing the database
👁 Reveal Answer
Correct Answer: A
Explanation: Tokenization replaces sensitive data with a token that has no exploitable relationship to the original value. The real values are kept in a separate, secured token vault, and only authorized systems can detokenize them. If the order database is breached, the tokens are useless to attackers. B is one-way, so the store could never recover the card number for legitimate payments, and hashes of card numbers can be guessed. C only hides digits on screen while the real number is still stored. D is not a security control.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.3 (methods to secure data: tokenization)
Question 52: Showing Only the Last Four Digits
Call center agents need to confirm a customer’s identity by asking about the last four digits of the card on file. They should never see the full number on their screens. Which technique is most appropriate?
A) Full-disk encryption on the agents’ computers
B) Steganography
C) Data masking that displays only the last four digits
D) A digital signature on each record
👁 Reveal Answer
Correct Answer: C
Explanation: Data masking hides part of a value, for example showing “**** **** **** 4821”, so users see only what they need. It limits exposure to the people and screens that do not need the full value. A protects data on a lost device but shows everything to the logged-in user. B hides data inside other files and is not used for display control. D proves integrity and origin but does not hide anything.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.3 (methods to secure data: masking)
Question 53: Protecting Data While It Is Being Processed
A company already encrypts its customer data in the database and over the network. It is now concerned about data being read from a server’s memory while an application is actively processing it. Which data state is it trying to protect?
A) Data at rest
B) Data in use
C) Data in transit
D) Data sovereignty
👁 Reveal Answer
Correct Answer: B
Explanation: Data has three states: at rest (stored), in transit (moving across a network), and in use (being processed in memory or by the CPU). Encryption at rest and in transit does not protect data that has been decrypted for processing; technologies such as secure enclaves and memory protections address data in use. A and C are already covered in this scenario. D is a legal concept about where data is stored, not a data state.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.3 (data states)
Question 54: Where the Data Lives Matters
A European company is choosing a cloud Region for a new customer database. Its legal team warns that data stored in a country becomes subject to that country’s laws, and EU customer data has strict transfer rules. Which concept is the legal team describing?
A) Data minimization
B) Data masking
C) Data classification
D) Data sovereignty
👁 Reveal Answer
Correct Answer: D
Explanation: Data sovereignty means data is subject to the laws of the country where it is collected or stored. Combined with geolocation choices, such as picking a cloud Region inside the EU, it determines which legal obligations apply. A means collecting and keeping only the data you need. B hides parts of values. C labels data by sensitivity, such as public, confidential, or restricted.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.3 (data sovereignty, geolocation)
Question 55: Recovery Within a Day at Moderate Cost
A regional insurer needs to resume operations at an alternate site within about a day after a disaster. A fully equipped, always-running duplicate site is too expensive, but starting from an empty building would take weeks. Which type of recovery site fits?
A) Hot site
B) Warm site
C) Cold site
D) No alternate site, relying on insurance only
👁 Reveal Answer
Correct Answer: B
Explanation: A warm site has power, networking, and some equipment ready, but systems and current data must be brought in or restored, so recovery takes hours to days at moderate cost. A, a hot site, is fully equipped and kept current for near-immediate failover, which is the expensive option ruled out here. C, a cold site, provides space and power but little or no equipment, which takes the longest to bring up. D does not restore operations at all.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.4 (site considerations: hot, cold, warm)
Question 56: Two Data Centers, One Flood Plain
A company’s primary and backup data centers are 10 kilometers apart, both near the same river. A regional flood could take both offline at once. What resilience principle is being violated?
A) Geographic dispersion
B) Platform diversity
C) Least privilege
D) Separation of duties
👁 Reveal Answer
Correct Answer: A
Explanation: Geographic dispersion places sites far enough apart that a single regional event, such as a flood, earthquake, or power grid failure, cannot affect them all. Two sites near the same river share the same risk. B means using different technologies or vendors so one flaw does not affect everything, which is useful but not the issue here. C and D are access control principles.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.4 (geographic dispersion, platform diversity)
Question 57: Backups That Might Not Work
A company backs up its servers every night to encrypted storage at an offsite location. It has never tried restoring them. During an audit, what is the most important missing step?
A) Buying a second backup product
B) Backing up more often
C) Regularly testing restores to confirm the backups are complete and usable within the required time
D) Removing encryption so restores are faster
👁 Reveal Answer
Correct Answer: C
Explanation: A backup that has never been restored is an untested assumption. Regular restore testing confirms the data is complete, the encryption keys are available, and recovery meets the required time. Backup considerations in the objectives include onsite and offsite storage, frequency, encryption, snapshots, recovery, replication, and journaling. A adds cost without proving anything. B may improve the recovery point but still does not prove backups work. D weakens protection of offsite data.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.4 (backups: recovery)
Question 58: Riding Out a Power Cut
A hospital’s server room has a diesel generator that takes about 30 seconds to start and stabilize after a power failure. During that gap, servers shut down abruptly. What should be added?
A) A second generator of the same type
B) A surge protector on each rack
C) More cooling capacity
D) An uninterruptible power supply (UPS) that carries the load until the generator takes over
👁 Reveal Answer
Correct Answer: D
Explanation: A UPS provides battery power immediately when utility power fails, covering short outages and the gap until a generator is running. Generators provide long-term power but need time to start. Together they keep systems running through an outage. A has the same startup delay. B protects against voltage spikes but does not supply power. C addresses heat, not power loss.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.4 (power: UPS, generators)
Question 59: Testing Recovery Without Risking Production
A bank wants to verify that its recovery systems produce the same results as production. It plans to run the recovery systems at the same time as production, processing the same transactions, and compare outputs, without switching any customers over. Which type of test is this?
A) Parallel processing
B) Tabletop exercise
C) Failover test
D) Simulation of a phishing campaign
👁 Reveal Answer
Correct Answer: A
Explanation: In parallel processing, the backup or recovery systems run the same workload as production at the same time, so the team can confirm they work correctly without affecting live service. B is a discussion-based walk-through of a scenario. C actually moves operations to the backup systems, which carries more risk. D tests user awareness, not recovery systems.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.4 (testing: tabletop exercises, failover, simulation, parallel processing)
Question 60: Keeping Essential Services Running
A city government wants a plan that keeps essential services such as emergency dispatch and water billing running during a long disruption, including alternate procedures, key personnel, and how to operate if primary facilities are unavailable. What is this plan called?
A) An acceptable use policy
B) A continuity of operations plan (COOP)
C) A software development life cycle policy
D) A non-disclosure agreement
👁 Reveal Answer
Correct Answer: B
Explanation: Continuity of operations planning (COOP) focuses on sustaining an organization’s essential functions during and after a disruption, including alternate facilities, key personnel, and alternate procedures. It works together with disaster recovery, which focuses on restoring IT systems. A defines acceptable use of company resources. C governs how software is built. D is a confidentiality agreement.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.4 (continuity of operations, capacity planning)
Study Tips for Data Protection and Resilience
- Know the data techniques. Tokenization replaces values, masking hides parts of them, hashing is one-way, and encryption is reversible with a key.
- Three data states. At rest, in transit, and in use each need their own protection.
- Location is a legal issue. Data sovereignty and geolocation decide which laws apply.
- Sites trade cost for speed. Hot is fastest and most expensive, warm is in the middle, and cold is cheapest and slowest.
- Prove recovery works. Test restores, run parallel processing or failover tests, and pair a UPS with generators.
Keep Practicing for Security+
Go back to SY0-701 Questions 41-50 for infrastructure, then continue to Questions 61-70 on governance and risk management.