CompTIA Security+ SY0-701 Practice Exam

What the CompTIA Security+ SY0-701 exam covers

• General Security Concepts125 questions
• Threats, Vulnerabilities, and Mitigations216 questions
• Security Architecture176 questions
• Security Operations285 questions
• Security Program Management and Oversight188 questions

Free CompTIA Security+ SY0-701 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 990.

1. Question 1General Security Concepts

   Which of the following BEST describes the concept of confidentiality in the CIA triad?

   • AEnsuring that users cannot deny having performed an action
   • BEnsuring that data is only accessible to those with proper authorizationCorrect
   • CEnsuring that data has not been altered in an unauthorized manner
   • DEnsuring that data is accessible when needed by authorized users
   ✓ Correct answer: B

   Confidentiality is correct because it is the CIA triad principle that restricts data access to only those who hold explicit authorization, which is exactly what option B states. It is enforced through mechanisms such as encryption at rest and in transit, access control lists, and need-to-know restrictions that prevent unauthorized viewing or disclosure of sensitive information. Confidentiality answers the question of who is allowed to see the data, not whether the data is accurate or whether it can be reached on demand. The closest wrong choice, D (availability), instead concerns whether authorized users can retrieve data when they need it, a completely different concern from restricting visibility. Preventing unauthorized disclosure, not uptime or accuracy, is the defining goal of confidentiality.

   Why the other options are wrong

   • APreventing a user from denying an action they performed describes non-repudiation, a separate accountability concept, not the secrecy protections that confidentiality provides.
   • CEnsuring data has not been altered without authorization is integrity, which protects accuracy and trustworthiness rather than restricting who can view the data.
   • DEnsuring data is reachable by authorized users on demand is availability, which concerns uptime and access, not the secrecy that confidentiality protects.
2. Question 2Threats, Vulnerabilities, and MitigationsSelect all that apply

   A security team is implementing mitigations against phishing attacks. Which THREE of the following would be effective? (Choose three.)

   • AImplementing DMARC, DKIM, and SPF for email authenticationCorrect
   • BConducting regular security awareness training for employeesCorrect
   • CDisabling all email encryption organization-wide
   • DDeploying email filtering with anti-phishing capabilitiesCorrect
   ✓ Correct answer: A, B, D

   Implementing DMARC, DKIM, and SPF, option A, authenticates the sending domain and lets receiving mail servers reject or flag messages that spoof a trusted sender, directly undercutting look-alike-domain and executive-impersonation phishing before it reaches the inbox. Regular security awareness training, option B, teaches employees to recognize the behavioral red flags of phishing, urgency, mismatched sender addresses, suspicious links, so that even messages that slip past technical filters are caught by a trained human. Deploying email filtering with anti-phishing capabilities, option D, automatically scans inbound messages for known malicious links, attachments, and phishing patterns, blocking or quarantining a large share of attempts before a user ever sees them. Together these three controls address the problem at three different layers, protocol-level sender authentication, technical filtering, and human awareness, which is why a mature anti-phishing program combines all three rather than relying on any single control alone.

   Why the other options are wrong

   • CDisabling all email encryption organization-wide would remove a protection that helps keep message contents confidential and would do nothing to stop phishing; it is a harmful, counterproductive action, not a mitigation.
3. Question 3Security Architecture

   A cloud team wants to eliminate inconsistent, manually configured servers by defining all infrastructure in machine-readable templates that are provisioned automatically. Which approach BEST meets this requirement?

   • AInfrastructure as Code (IaC)Correct
   • BManual runbooks stored in a shared wiki
   • CA configuration baseline emailed to each administrator
   • DScreen-recorded walkthroughs of the setup steps
   ✓ Correct answer: A

   Infrastructure as Code manages and provisions compute, storage, and networking resources through declarative or imperative configuration files, written in tools such as Terraform, CloudFormation, or Ansible playbooks, rather than through manual point-and-click configuration in a console. Because the same template is applied every time, every server, network rule, or storage bucket it creates is provisioned identically, eliminating the configuration drift that happens when different administrators make slightly different manual choices. These templates can also be stored in version control, code-reviewed, and tested before being applied, which brings the same repeatability, auditability, and automation that software development already enjoys to infrastructure provisioning itself. That combination of machine-readable, automatically provisioned, and consistently repeatable infrastructure is exactly what the cloud team is asking for, and it directly eliminates the inconsistent, manually configured servers described in the scenario.

   Why the other options are wrong

   • BManual runbooks still rely on humans executing steps by hand, which is exactly the inconsistency IaC removes.
   • CAn emailed baseline is documentation, not automated provisioning, and offers no enforcement or repeatability.
   • DRecorded walkthroughs guide manual work and cannot automatically provision infrastructure.
4. Question 4Security Operations

   A security analyst at Helios Energy discovers unusual outbound traffic from a server at 3 AM to an external IP address in a country where the company has no business operations. What should the analyst do FIRST?

   • AAdd a firewall rule to block only that single destination IP
   • BPower the server off to stop the outbound connection
   • CReset the server's local administrator password remotely
   • DIsolate the server from the network and begin investigationCorrect
   ✓ Correct answer: D

   Anomalous outbound traffic to an unknown foreign IP address at off-hours is a strong indicator of compromise, potentially indicating data exfiltration, C2 communication, or a beaconing implant. The first step is to contain the potential incident by isolating the server from the network to stop any ongoing data loss while preserving the system state for forensic analysis. After isolation, the analyst should capture memory, review running processes and network connections, examine logs, and identify the source of the traffic before determining whether full remediation is required. Isolating first, rather than partially blocking, powering off, or resetting credentials, stops the immediate risk without destroying evidence or leaving other paths for the attacker to exploit.

   Why the other options are wrong

   • ABlocking one destination IP is easily bypassed by a fallback C2 address and leaves the compromised host connected; full isolation is the correct containment step.
   • BPowering off destroys volatile memory evidence such as running processes and active connections and may disrupt service before the threat is confirmed; isolation preserves state while stopping traffic.
   • CRotating the local admin password does not contain an active outbound session or a compromise using other credentials, and it should follow containment and investigation.
5. Question 5Security Program Management and Oversight

   Northwind Traders is required to comply with a regulation that mandates the protection of credit card data during processing, storage, and transmission. Which compliance standard applies?

   • APCI DSSCorrect
   • BSOX
   • CHIPAA
   • DFERPA
   ✓ Correct answer: A

   PCI DSS mandates specific security requirements for any organization that stores, processes, or transmits credit or debit card data during payment transactions, covering areas such as encrypting cardholder data in transit and at rest, maintaining a vulnerability management program, restricting access on a need-to-know basis, and continuously monitoring and testing networks that touch the cardholder data environment. Because Northwind Traders' requirement is specifically about protecting card data across processing, storage, and transmission, which is precisely PCI DSS's defined scope, it is the applicable standard rather than a regulation targeting an unrelated data type or industry. SOX targets financial reporting controls for public companies, HIPAA targets protected health information in healthcare, and FERPA targets student education records, none of which govern payment card transaction security.

   Why the other options are wrong

   • BSOX governs financial statement accuracy and corporate governance controls for public companies, not payment card transaction security.
   • CHIPAA establishes privacy and security rules for protected health information in healthcare, not credit card data.
   • DFERPA protects student education records at federally funded institutions and has no application to payment card security.
6. Question 6General Security Concepts

   A developer needs to store the same large file in two different ciphertext forms so it can later be decrypted by two separate departments, each holding its own key. The plaintext must never be exposed during this process. Which approach BEST achieves this?

   • AEncrypt the symmetric data key separately under each department's public keyCorrect
   • BEncrypt the entire file twice with each department's password
   • CStore the file hashed with each department's salt
   • DShare a single private key with both departments
   ✓ Correct answer: A

   Encrypting the file just once with a symmetric data key, then separately encrypting that data key under each department's own public key, lets each department use its own private key to unwrap the data key and decrypt the same ciphertext, without ever needing to duplicate the large file or expose the plaintext during the process. This hybrid, or envelope, encryption model combines the speed of symmetric encryption for bulk data with the key-separation benefits of asymmetric encryption for distribution, and it scales to any number of recipients by adding one small wrapped-key entry per department rather than re-encrypting the whole file. Encrypting the entire file twice under a password per department, by contrast, wastes processing time on a large file and relies on weaker, guessable password-based protection instead of proper key-pair separation.

   Why the other options are wrong

   • BEncrypting the entire large file twice, once per department password, wastes processing on a large file and relies on weaker password-based encryption instead of proper asymmetric key separation.
   • CHashing produces a one-way digest that cannot be reversed back into the original file, so neither department could ever recover the plaintext this way.
   • DSharing a single private key between both departments eliminates key separation entirely and would let either department decrypt data intended only for the other, or impersonate it.
7. Question 7Security Operations

   A company is implementing an automated patch management process. Before deploying a critical security patch organization-wide, the IT team installs it in an isolated environment that mirrors production. What is the PRIMARY purpose of this step?

   • ATo test for compatibility issues and avoid breaking production systemsCorrect
   • BTo create a forensic image of the patch
   • CTo verify the patch's digital signature
   • DTo meet regulatory log retention and long-term audit documentation requirements
   ✓ Correct answer: A

   Installing a critical patch in an isolated environment that mirrors production before organization-wide deployment exists primarily to test for compatibility issues and avoid breaking production systems: patches can introduce regressions, conflict with existing applications or configurations, or behave unexpectedly on the specific software stack in use, so validating in a representative staging environment first catches these problems while the blast radius is limited to a test system rather than the live environment everyone depends on. Verifying the patch's digital signature, the closest related but earlier step, confirms the patch is authentic and unmodified before it is even installed anywhere - it is a prerequisite trust check, not the reason for running the patch in a mirrored environment, which is specifically about functional compatibility.

   Why the other options are wrong

   • BForensic imaging is part of incident investigation and evidence handling, unrelated to testing a patch for compatibility.
   • CVerifying a digital signature confirms authenticity before installation; it does not require a mirrored environment and is a separate, earlier step.
   • DRegulatory log retention requirements govern how long logs are kept, unrelated to staging a patch to test compatibility.
8. Question 8Security Operations

   A team proactively searches the environment for signs of undetected compromise, forming hypotheses from threat intelligence and adversary techniques rather than waiting for alerts to fire. What is this activity called?

   • AThreat huntingCorrect
   • BVulnerability scanning
   • CPenetration testing
   • DPatch management
   ✓ Correct answer: A

   Threat hunting is a proactive, human-driven activity in which analysts form hypotheses based on threat intelligence, known adversary tactics and techniques, often mapped to a framework like MITRE ATT&CK, and environmental anomalies, then actively search telemetry across endpoints, logs, and network traffic for evidence supporting or refuting those hypotheses, operating under the assumption that an adversary may already be present undetected. This is fundamentally different from waiting passively for an automated alert to fire, which is how most detection tooling operates by default. Vulnerability scanning instead catalogs known technical weaknesses without searching for evidence of an active, ongoing compromise. Penetration testing simulates an attack to find exploitable gaps under authorized conditions, a different objective than hunting for a real intruder already inside. Patch management remediates known vulnerabilities and is a remediation activity, not a detection one at all.

   Why the other options are wrong

   • BVulnerability scanning catalogs known technical weaknesses that could be exploited; it does not actively search for evidence of an intrusion already in progress.
   • CPenetration testing simulates an attack under authorized conditions to find exploitable gaps, a different objective from proactively hunting for an adversary already present in the environment.
   • DPatch management remediates known vulnerabilities through updates; it is a remediation activity, not a proactive detection technique for hidden compromise.
9. Question 9Security ArchitectureSelect all that apply

   A network team is hardening access-layer switches against attacks that abuse layer 2 trust. Which TWO controls directly mitigate rogue DHCP servers and MAC flooding on those switch ports? (Choose two.)

   • ADHCP snooping to permit DHCP offers only from trusted portsCorrect
   • BPort security limiting the number of MAC addresses learned per portCorrect
   • CEnabling jumbo frames on all access ports
   • DIncreasing the DHCP lease time on the server so client addresses are renewed less frequently overall
   ✓ Correct answer: A, B

   DHCP snooping designates specific uplink ports as trusted, typically the ones facing the legitimate DHCP server, and drops any DHCP offer or ACK message seen arriving on untrusted access ports, which directly stops an attacker's rogue DHCP server from handing out malicious gateway or DNS settings to clients on that segment. Port security instead limits how many distinct MAC addresses a single access port is allowed to learn, so a MAC-flooding attack that tries to overwhelm the switch's content-addressable memory table with forged addresses gets shut down or restricted at the port before the CAM table overflows and the switch degrades into flooding traffic to every port like a hub. Both controls operate at the access layer and target these specific Layer 2 abuse techniques directly.

   Why the other options are wrong

   • CJumbo frames only change the maximum frame size to improve throughput for large transfers; they provide no protection against rogue DHCP servers or MAC flooding.
   • DLengthening the DHCP lease time changes how often clients renew their addresses; it does not detect or block a rogue server or a flooding attack.
10. Question 10Security Operations

    A financial firm must prevent employees from emailing files containing customer credit card numbers to external recipients. Which control is BEST suited to inspect content and block these transfers?

    • AData loss prevention (DLP)Correct
    • BIntrusion detection system (IDS)
    • CWeb application firewall (WAF)
    • DNetwork access control (NAC)
    ✓ Correct answer: A

    Data loss prevention solutions inspect the actual content of data in motion, including email attachments and message bodies, using pattern matching and fingerprinting to recognize sensitive data types such as credit card number formats, and can automatically block, quarantine, or encrypt outbound messages that violate policy before they ever leave the organization's network. That content-aware inspection and real-time enforcement is exactly what is required to stop employees from emailing customer cardholder data to external recipients, satisfying both the detection and the blocking requirement in a single control. An intrusion detection system can alert on suspicious network activity but is not designed to parse message content for regulated data patterns or block a specific email. A web application firewall protects inbound traffic to web applications rather than outbound email, and network access control decides which devices may join the network, neither of which inspects what data is being sent.

    Why the other options are wrong

    • BAn IDS detects and alerts on attacks but does not enforce data-handling policy.
    • CA WAF protects inbound web app traffic, not outbound email content.
    • DNAC decides which devices join the network, not what data they send.

Who this CompTIA Security+ SY0-701 practice exam is for

This practice set is for anyone preparing for the CompTIA Security+ SY0-701 exam - from first-time candidates building a foundation to experienced professionals doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this CompTIA Security+ SY0-701 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real CompTIA Security+ SY0-701 exam.

Related Security resources

• CompTIA Security+ SY0-701 study guideKey concepts
• Security practice examsAll Security
• Certification pathWhere this fits
• Best Security+ Practice Exams (2026)Comparison
• General Security Concepts practice questions125 questions
• Threats, Vulnerabilities, and Mitigations practice questions216 questions
• Security Architecture practice questions176 questions
• Security Operations practice questions285 questions
• Security Program Management and Oversight practice questions188 questions
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• CompTIA SecurityX (CAS-005, formerly CASP+) practice examRelated
• EC-Council CEH (Certified Ethical Hacker) practice examRelated
• Fortinet NSE 4 - FortiOS Administrator practice examRelated

CompTIA Security+ SY0-701 practice exam FAQ