CompTIA Security+ (SY0-701) — Practice Questions and Mock Exam

The confusion here is real, and it comes from the switch wearing two hats. In the 802.1X vocabulary there are three roles: the workstation is the supplicant, the access switch is the authenticator, and the central server is the authentication server. In the RADIUS vocabulary there are only two, and the network access server, which here is the switch, operates as a client of RADIUS. It passes user information to the designated servers and then acts on the response returned, which in practice means opening the port, assigning a VLAN, or leaving the port unauthorized.

So the same box is a server from the workstation's point of view and a client from the point of view of the authentication infrastructure, and the question asks specifically for the RADIUS terminology.

The distractors map onto the other roles. The authentication server is the one that validates credentials and returns configuration attributes, which the switch never does. The supplicant is the workstation presenting credentials. The certificate authority signs and vouches for certificates ahead of time and is not a participant in the live exchange at all, even when certificate-based authentication is in use.

Exam tip: when a question names a vocabulary explicitly, translate the device into that vocabulary before answering. The same box has different names in 802.1X and in RADIUS, and the exam tests exactly that seam.

Penetration tests are defined by how much the testers know before they start. In an unknown environment, often called black box, testers begin with little or nothing, which simulates an external attacker and tests detection and exposure, but it spends much of the budget on discovery. A partially known environment, or gray box, gives some internal knowledge, such as an account, and balances realism against efficiency. A known environment, or white box, gives explicit and substantial knowledge of the system's internal structure and implementation, such as source code, design documents and accounts, which supports the deepest coverage in the least time. The right choice follows the objective and the constraints. When the goal is to find as many flaws as possible in specific logic before release, knowledge is an accelerator, not a compromise. Exam tip: match the environment to the goal, choosing known for coverage under time pressure and unknown for realism and detection testing.

The payload ' OR 1=1 --' is one of the most recognizable SQL injection strings. Breaking it down: the single quote (') terminates the string literal in the SQL query, OR 1=1 adds a condition that is always true (meaning the WHERE clause always matches), and -- is the SQL comment indicator that ignores everything after it. For example, a login query like SELECT * FROM users WHERE username='admin' AND password='[input]' becomes SELECT * FROM users WHERE username='admin' AND password='' OR 1=1 --' which returns all users, bypassing authentication. WAFs detect SQL injection using pattern matching (looking for SQL keywords and operators in input), anomaly detection (comparing requests against learned application behavior), and signature databases of known attack patterns. While WAFs provide valuable defense-in-depth, they should not be the only protection — parameterized queries in the application code are the primary fix. Exam tip: OR 1=1 and similar SQL syntax in form fields = SQL injection. The WAF provides defense-in-depth, not a replacement for secure coding.

Encryption can be applied at the application, database, filesystem or hardware layer, and each layer draws its protection boundary in a different place. The lower the layer, the more transparent it is and the fewer threats it actually addresses: a self-encrypting drive protects the platters, not the process reading them. Once the machine is booted and the key is loaded, everything above that layer sees plaintext, so an attacker with remote code execution or valid credentials is unaffected. Higher layers narrow the exposure. Database-level encryption keeps data opaque to someone with only filesystem access, and application-level encryption keeps it opaque even to a compromised database, at the cost of key management complexity and lost query capability. Choosing a layer is therefore a threat-model exercise, not a checkbox, and layers are often combined. The common mistake is treating any encryption at rest as protection against every attacker.