CompTIA Security+ SY0-701 Practice Exam

What the CompTIA Security+ SY0-701 exam covers

• General Security Concepts122 questions
• Threats, Vulnerabilities, and Mitigations211 questions
• Security Architecture172 questions
• Security Operations279 questions
• Security Program Management and Oversight184 questions

Free CompTIA Security+ SY0-701 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 968.

1. Question 1General Security Concepts

   Which of the following BEST describes the concept of confidentiality in the CIA triad?

   • AEnsuring that users cannot deny having performed an action
   • BEnsuring that data is only accessible to those with proper authorizationCorrect
   • CEnsuring that data has not been altered in an unauthorized manner
   • DEnsuring that data is accessible when needed by authorized users
   ✓ Correct answer: B

   Confidentiality is the CIA triad principle that keeps information secret from anyone lacking authorization, typically enforced through access controls and encryption. It answers the question of who may see the data, not whether the data is accurate or reachable. Preventing unauthorized disclosure is the defining goal of confidentiality.

   Why the other options are wrong

   • APreventing users from denying an action they performed is non-repudiation, not confidentiality.
   • CProtecting data from unauthorized alteration describes integrity, a separate element of the CIA triad.
   • DEnsuring data is reachable when authorized users need it describes availability, not confidentiality.
2. Question 2Threats, Vulnerabilities, and Mitigations

   Which type of malware disguises itself as legitimate software to trick users into installing it?

   • ALogic bomb
   • BRootkit
   • CTrojanCorrect
   • DWorm
   ✓ Correct answer: C

   A Trojan horse relies on social engineering: it looks like a useful or trusted program so the user willingly runs it, then executes hidden malicious code. Unlike self-propagating malware, it depends on the user to install and launch it. Its defining trait is deception through disguise rather than exploitation or self-replication.

   Why the other options are wrong

   • AA logic bomb is dormant malicious code that triggers on a condition or date; it does not disguise itself as an application to lure installation.
   • BA rootkit conceals its presence to keep privileged access hidden, rather than posing as attractive legitimate software.
   • DA worm self-replicates across networks without user action, whereas a Trojan needs the user to be deceived into running it.
3. Question 3Security Architecture

   A network engineer separates the guest and corporate networks using VLANs and assumes the VLAN boundary also protects the confidentiality of traffic in transit. Which statement BEST corrects this assumption?

   • AVLANs provide logical separation only; a protocol such as IPsec or TLS is still requiredCorrect
   • BVLANs automatically encrypt all frames once trunk ports and tagging are configured
   • CVLAN tagging with 802.1Q transparently adds AES encryption to each transmitted frame
   • DVLANs provide encryption, but only for broadcast and multicast traffic classes
   ✓ Correct answer: A

   VLANs use 802.1Q tags to logically isolate traffic into separate broadcast domains, which limits which hosts can communicate but does nothing to encrypt the payload. Anyone who can capture frames on the segment can read the plaintext. Protecting confidentiality in transit requires a cryptographic protocol such as IPsec, TLS, or MACsec layered on top of the VLAN.

   Why the other options are wrong

   • BTrunk ports carry tagged VLAN traffic between switches but perform no encryption of the frames.
   • C802.1Q tagging only adds a VLAN identifier to the frame header; it does not apply AES or any cipher.
   • DVLANs do not encrypt any traffic class, including broadcast or multicast; segmentation is not encryption.
4. Question 4Security Operations

   A security analyst notices that a firewall rule allows inbound SSH traffic from any source IP address to a production database server. What should the analyst recommend?

   • AChange the SSH port to a non-standard port number
   • BRestrict SSH access to specific authorized IP addresses or management subnetsCorrect
   • CAllow the rule since SSH traffic is already encrypted
   • DDisable SSH on the database server entirely
   ✓ Correct answer: B

   Allowing SSH from any source IP exposes the database server to brute force attacks, credential stuffing, and exploitation of SSH vulnerabilities from anywhere on the internet. Restricting SSH access through firewall rules to only authorized management workstations or dedicated jump server subnets implements the principle of least privilege at the network layer and dramatically reduces the attack surface. This is a fundamental network security hardening practice that limits exposure while still allowing necessary administrative access.

   Why the other options are wrong

   • AChange the SSH port to a non-standard port number is incorrect because security through obscurity by changing the SSH port to a non-standard value (e.g., 2222) merely reduces automated scanning noise but does not prevent a determined attacker who performs a full port scan from discovering and targeting the SSH service.
   • CAllow the rule since SSH traffic is already encrypted is incorrect because SSH encryption protects the confidentiality and integrity of the session contents but does not prevent unauthorized users from attempting to authenticate to the server; unrestricted inbound SSH still exposes the server to authentication attacks regardless of encryption.
   • DDisable SSH on the database server entirely is incorrect because while disabling SSH eliminates the attack surface completely, database servers often require SSH for legitimate administrative tasks, and a blanket disable would eliminate necessary management capabilities rather than appropriately restricting access.
5. Question 5Security Program Management and Oversight

   An organization wants to evaluate the security practices of its cloud service provider before signing a contract. Which of the following would be MOST useful for this assessment?

   • AThe provider's employee handbook
   • BA SOC 2 Type II audit reportCorrect
   • CThe provider's marketing brochure
   • DThe provider's annual financial report
   ✓ Correct answer: B

   A SOC 2 Type II report is produced by an independent CPA firm that audits a service organization's controls against the AICPA Trust Services Criteria over an extended period (typically 6-12 months), providing evidence that security controls were not only designed appropriately but were also operating effectively over time. This makes it the most meaningful third-party assurance document for evaluating a cloud service provider's security maturity before entering a contractual relationship, as it provides independent verification rather than self-reported claims.

   Why the other options are wrong

   • AThe provider's employee handbook is incorrect because an employee handbook describes internal HR policies and workplace conduct standards; it does not constitute evidence of security control effectiveness, certifications, or compliance with recognized security standards.
   • CThe provider's marketing brochure is incorrect because marketing materials are promotional documents designed to present the provider favorably and are produced by the provider without independent verification; they cannot substitute for audited evidence of security control effectiveness.
   • DThe provider's annual financial report is incorrect because a financial report discloses the provider's financial performance, revenue, and business results; while financial stability is a relevant consideration for vendor risk, it provides no information about the adequacy or effectiveness of security controls protecting customer data.
6. Question 6Security Program Management and Oversight

   A team is planning Management procedures for Security Program Management and Oversight. What should they prioritize?

   • ABase procedures solely on the results of a single one-time scan
   • BAdopt whichever configuration an internal team member prefers on the day
   • CFollow documented best practices and vendor guidelinesCorrect
   • DCopy a competitor's public procedures and apply them unchanged
   ✓ Correct answer: C

   Security program management procedures should follow frameworks like ISO 27001 for ISMS structure, the NIST CSF for program organization, and COBIT for IT governance, supplemented by vendor documentation. These validated frameworks provide structured procedures for planning, implementation, monitoring, and continuous improvement, which is why following them is the priority.

   Why the other options are wrong

   • AA one-time scan is a point-in-time snapshot, not a management framework; ISO 27001, the NIST CSF, and COBIT provide structured, repeatable program procedures instead.
   • BIndividual preference is not an authoritative source and produces inconsistent, non-compliant procedures across the program.
   • DA competitor's procedures reflect their organization and obligations; applying them unchanged ignores your own governance context and validation needs.
7. Question 7Security Operations

   During incident response, an analyst restores affected systems from clean backups and verifies they function normally before returning them to production. Which incident response phase does this describe?

   • AContainment
   • BEradication
   • CRecoveryCorrect
   • DLessons learned
   ✓ Correct answer: C

   In the NIST incident response lifecycle, recovery focuses on returning affected systems to normal operation and confirming they are functioning correctly and securely. It follows eradication, where the threat itself is removed.

   Why the other options are wrong

   • AContainment limits the spread of an incident; it does not restore systems to production.
   • BEradication removes the malicious artifacts and root cause but does not restore service.
   • DLessons learned is the post-incident review phase that occurs after recovery.
8. Question 8Security Program Management and Oversight

   Leadership wants an independent, objective evaluation of whether the organization's security controls are properly designed and operating effectively against a defined standard. Which activity BEST meets this need?

   • AA security auditCorrect
   • BA vulnerability scan
   • CA penetration test
   • DA risk assessment
   ✓ Correct answer: A

   Audits provide formal, independent assurance that controls are designed and operating effectively, measured against a framework or standard. The other activities serve different purposes.

   Why the other options are wrong

   • BA vulnerability scan finds technical weaknesses but is not a formal evaluation of control design/effectiveness against a standard.
   • CA penetration test actively exploits weaknesses to demonstrate impact, not a structured control-effectiveness audit.
   • DA risk assessment identifies and prioritizes risks but does not provide independent attestation that controls operate effectively.
9. Question 9Threats, Vulnerabilities, and Mitigations

   A monitoring tool flags that many corporate workstations have unusually high CPU usage overnight and are making outbound connections to a mining pool, with no files encrypted and no data exfiltrated. Which threat is most likely?

   • ACryptojackingCorrect
   • BRansomware
   • CA keylogger
   • DA logic bomb
   ✓ Correct answer: A

   Cryptojacking secretly uses victim compute resources to mine cryptocurrency, so the telltale signs are sustained high CPU, off-hours activity, and connections to mining pools, with no encryption or data theft. The attacker profits from stolen processing power rather than from the data itself.

   Why the other options are wrong

   • BRansomware encrypts data and demands payment; here nothing is encrypted.
   • CA keylogger captures keystrokes for credential theft, which does not explain mining-pool traffic and high CPU.
   • DA logic bomb is dormant code awaiting a trigger; it does not describe ongoing mining behavior.
10. Question 10Security Operations

    On a BYOD program, security wants corporate email and files kept in an encrypted, policy-controlled space that IT can wipe without touching the employee's personal photos and apps. Which MDM feature BEST provides this separation?

    • AContainerizationCorrect
    • BFull-device wipe
    • CGeofencing
    • DScreen-lock timeout
    ✓ Correct answer: A

    Containerization creates a managed, encrypted partition that isolates corporate apps and data from the personal side of the device. IT can enforce policy on and selectively wipe only that container, leaving personal content untouched, which is essential for employee-owned BYOD phones. This separation is the defining capability the scenario asks for.

    Why the other options are wrong

    • BA full-device wipe erases everything including personal data, which violates the requirement to leave personal content intact.
    • CGeofencing triggers actions based on location and does not separate corporate from personal data.
    • DA screen-lock timeout controls idle locking but provides no data separation between work and personal spaces.

Related Security resources

• CompTIA Security+ SY0-701 study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• (ISC)² CISSP practice examRelated
• (ISC)² Certified in Cybersecurity (CC) practice examRelated
• CompTIA PenTest+ (PT0-003) practice examRelated

CompTIA Security+ SY0-701 practice exam FAQ