CompTIA Security+ SY0-701 General Security Concepts Practice Questions

Free Security+ General Security Concepts practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main CompTIA Security+ SY0-701 page. Sign up free to practice the full set.

1. Question 1General Security Concepts

   A security administrator wants to implement a framework where no user or device is automatically trusted, regardless of whether they are inside or outside the network perimeter. Which security model does this describe?

   • ADefense in depth
   • BImplicit trust
   • CRole-based access control
   • DZero trustCorrect
   ✓ Correct answer: D

   Zero trust is correct because the scenario explicitly describes removing automatic trust for any user or device, inside or outside the perimeter, which is the defining tenet of this model. Under zero trust, every access request is authenticated, authorized, and evaluated against device posture and contextual signals before access is granted, replacing the older castle-and-moat approach that trusted anything already on the internal network. The guiding maxim, never trust always verify, captures this continuous verification requirement precisely. The closest distractor, defense in depth, instead layers multiple protective controls along an attack path but does not itself eliminate the assumption that internal traffic is safe; a network could be defense in depth without being zero trust. Zero trust is specifically about eliminating implicit trust based on location or prior authentication.

   Why the other options are wrong

   • ADefense in depth stacks multiple overlapping security layers so no single failure exposes an asset, but it does not by itself remove implicit trust granted by network location.
   • BImplicit trust is the opposite of the described model; it automatically grants trust to users or devices based on location, which zero trust is designed to eliminate.
   • CRole-based access control assigns permissions according to job function and does not address whether users or devices are trusted by default based on network position.
2. Question 2General Security Concepts

   A security analyst needs to ensure that data stored in a database remains unaltered and trustworthy. Which element of the CIA triad is the analyst focused on?

   • AIntegrityCorrect
   • BAvailability
   • CConfidentiality
   • DNon-repudiation
   ✓ Correct answer: A

   Integrity is correct because the analyst's concern, that stored database records remain unaltered and trustworthy, maps directly onto this pillar of the CIA triad, which is specifically concerned with accuracy and the absence of unauthorized modification. Integrity is typically verified using cryptographic hashes, checksums, or digital signatures: a hash is computed when data is stored and recomputed later, and any unauthorized change to even a single byte produces a different hash, immediately revealing the tampering. Database systems also use techniques like write-once logs and referential constraints to further protect record accuracy. The closest distractor, confidentiality, instead concerns who is allowed to view the data, a separate concern from whether the data has changed; a record can be fully confidential yet still silently corrupted, or fully public yet perfectly intact. Availability addresses reachability, and non-repudiation addresses proof of authorship, neither of which is what this scenario describes.

   Why the other options are wrong

   • BAvailability ensures data is accessible when needed, not that it remains unmodified.
   • CConfidentiality prevents unauthorized disclosure and does not address unauthorized modification.
   • DNon-repudiation proves who performed an action and is not one of the three CIA triad elements.
3. Question 3General Security ConceptsSelect all that apply

   Which THREE are elements of the AAA framework in security? (Choose three.)

   • AAccountingCorrect
   • BAnonymization
   • CAuthorizationCorrect
   • DAggregation
   • EAuthenticationCorrect
   ✓ Correct answer: A, C, E

   Accounting (A), authorization (C), and authentication (E) are the three genuine elements of the AAA framework. Authentication comes first and verifies a claimed identity through credentials such as a password, certificate, or biometric factor. Authorization comes second and, once identity is confirmed, decides exactly what resources and actions that identity is permitted to access, typically enforced through permissions, roles, or access control lists. Accounting comes third and records what the now-authorized user actually did, including login times, commands issued, and data accessed, supporting audits and forensic investigation after the fact. Together these three stages form the complete AAA model that underlies network access solutions such as RADIUS and TACACS+. Anonymization and aggregation, the wrong options, are data-handling concepts related to privacy and data combination, not recognized components of the AAA framework at all.

   Why the other options are wrong

   • BAnonymization is a data-privacy technique that removes identifying information from a dataset; it is not one of the three AAA components.
   • DAggregation refers to combining or summarizing data, unrelated to identity verification, permission decisions, or activity logging in the AAA model.
4. Question 4General Security Concepts

   A hospital's IT department discovers that patient records were altered by an unauthorized user who gained access to the medical database. Which element of the CIA triad has been primarily compromised?

   • AIntegrityCorrect
   • BNon-repudiation
   • CConfidentiality
   • DAvailability
   ✓ Correct answer: A

   Integrity means data remains accurate, consistent, and unmodified except by authorized parties through approved processes. Because an unauthorized user altered the medical database records, the trustworthiness of that data is broken, which is precisely what an integrity violation means, regardless of whether the attacker also viewed the data. In healthcare, an integrity breach is especially dangerous because clinicians rely on accurate records to make treatment decisions, so altered dosages, allergies, or diagnoses can directly endanger patient safety. Controls that protect integrity include hashing, digital signatures, access logging, and version control, which detect or prevent unauthorized changes and allow administrators to restore records to a known-good state after such an incident is discovered.

   Why the other options are wrong

   • BNon-repudiation is about being able to prove who performed an action so they cannot later deny it; it is not one of the three CIA triad elements and does not describe the alteration itself.
   • CConfidentiality is violated when data is viewed or stolen by someone unauthorized; here the records were modified, not merely accessed or disclosed, so integrity is the affected element.
   • DAvailability concerns whether authorized users can access systems or data when needed; the records remained reachable and readable, they were simply changed, so availability was not the issue.
5. Question 5General Security Concepts

   A security team deploys decoy files containing fabricated but realistic-looking credentials throughout a file server. Any access to these files immediately triggers an alert because no legitimate user has a reason to open them. What is this technique called?

   • AHoneyfileCorrect
   • BHoneynet
   • CSandbox
   • DDNS sinkhole
   ✓ Correct answer: A

   A honeyfile is a deliberately planted, realistic-looking file, in this case one appearing to contain credentials, that has no legitimate business purpose, so any process or user that opens it is almost certainly an intruder or a malicious insider rather than a normal employee going about their job. Because legitimate users have no reason to touch it, an access event is a high-confidence signal rather than a noisy alert that needs extensive triage, which makes honeyfiles an efficient early-warning mechanism for lateral movement or credential-hunting activity on a file server. A honeynet (B), by contrast, is a much larger deception construct, an entire network of decoy systems meant to attract and study attackers, rather than a single bait file placed among real data.

   Why the other options are wrong

   • BA honeynet is an entire decoy network of systems built to attract and study attacker behavior, not a single bait file placed on a file server.
   • CA sandbox isolates and executes untrusted code or files for analysis; it is not a planted decoy meant to trigger an alert when accessed.
   • DA DNS sinkhole redirects malicious domain lookups to a controlled address to disrupt command-and-control traffic; it does not involve planting bait files.
6. Question 6General Security Concepts

   A trusted insider with legitimate administrative access begins exfiltrating intellectual property over several weeks. Which security concept is MOST directly challenged by this scenario, prompting organizations to adopt continuous verification?

   • AImplicit trustCorrect
   • BAvailability
   • CObscurity
   • DRedundancy
   ✓ Correct answer: A

   Implicit trust is the assumption that anyone already inside a defined boundary, such as an authenticated administrator with legitimate access, is automatically safe to trust with ongoing access, and a malicious insider abusing that legitimate access to quietly exfiltrate data over weeks demonstrates exactly why that assumption fails: authentication at login says nothing about intent or behavior afterward. This is precisely the failure mode zero trust architecture is designed to eliminate, since it replaces implicit trust in identity or location with continuous verification, ongoing behavioral monitoring, and least privilege, so that even a legitimate administrator's activity is continually scrutinized rather than assumed safe indefinitely. Availability (B), by contrast, concerns whether systems stay accessible to authorized users, which is not the property under attack in a slow, quiet exfiltration scenario like this one.

   Why the other options are wrong

   • BAvailability concerns keeping systems and data accessible to authorized users; the scenario describes unauthorized data theft by an insider, not a threat to uptime.
   • CObscurity relies on hiding details about a system to make attacks harder; it is not the principle exposed by an already-authorized insider misusing legitimate access.
   • DRedundancy provides backup capacity so systems can withstand failures; it is unrelated to an insider quietly exfiltrating data over several weeks.
7. Question 7General Security Concepts

   A mobile banking app must trust only its provider's specific server public key and reject any other certificate, even one validly issued by a trusted CA, to resist fraudulent CA issuance and on-path interception. Which technique BEST achieves this?

   • ACertificate (public-key) pinning in the appCorrect
   • BOCSP stapling on the server
   • CUsing a wildcard certificate
   • DEnabling HSTS
   ✓ Correct answer: A

   Certificate (or public-key) pinning hardcodes the expected certificate or public key inside the mobile app itself, so at connection time the app compares the server's presented key against that pinned value and rejects anything that does not match, even a certificate that a legitimate, trusted CA validly issued. This directly defeats the threat of a rogue, compromised, or coerced CA issuing a fraudulent certificate for the bank's domain, since normal certificate-chain validation alone would otherwise accept any certificate signed by a trusted root. OCSP stapling only conveys a certificate's revocation status and does not restrict which certificate is trusted, a wildcard certificate merely extends coverage across subdomains without constraining client trust, and HSTS forces HTTPS but still accepts any certificate a trusted CA has validly signed, so none of them stop a rogue-CA-issued certificate the way pinning does.

   Why the other options are wrong

   • BOCSP stapling conveys a certificate's revocation status efficiently; it does nothing to restrict trust to one specific certificate or key.
   • CA wildcard certificate extends coverage across multiple subdomains under one certificate; it does not constrain which certificate or CA the client will accept.
   • DHSTS forces the browser to use HTTPS instead of HTTP but still trusts any certificate validly signed by a trusted CA, so it would not stop a rogue-CA certificate.
8. Question 8General Security ConceptsSelect all that apply

   A software vendor wants recipients to verify that a downloaded installer truly came from the vendor and has not been altered in transit. Which TWO controls together accomplish this? (Choose two.)

   • ACode signing the installer with the vendor's private keyCorrect
   • BPublishing the signing certificate's chain to a trusted CA so clients can validate the signatureCorrect
   • CEncrypting the installer with the recipient's public key, which only that recipient can decrypt using their private key
   • DObfuscating the installer's source code before release
   ✓ Correct answer: A, B

   Code signing the installer with the vendor's private key produces a cryptographic signature over the file's contents, and any client that verifies the signature with the corresponding public key can confirm the file has not been altered since signing. That verification is only trustworthy, however, if the signing certificate chains up to a CA the client already trusts, which is why publishing the certificate chain matters: it binds the public key to the vendor's verified identity rather than leaving the client to trust an arbitrary self-asserted key. Together, signing plus a validated trust chain give both integrity, that the installer is unmodified, and authenticity, that it truly came from the vendor. Encrypting for the recipient only hides content and proves nothing about origin, and obfuscation merely complicates reverse engineering without authenticating anyone.

   Why the other options are wrong

   • CEncrypting the installer with the recipient's public key provides confidentiality so only that recipient can open it, but it proves nothing about who created the file or whether it was altered.
   • DObfuscating source code makes reverse engineering the logic harder but does nothing to prove the publisher's identity or detect tampering in transit, which is the actual requirement here.

How General Security Concepts is tested

This domain holds 125 of the 990 questions in the Security+ bank, about 13%. The mix is 105 single-answer multiple choice and 20 multiple-response, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill General Security Concepts on its own rather than re-running full-length mocks.

Other Security+ exam domains

• Threats, Vulnerabilities, and Mitigations216 questions
• Security Architecture176 questions
• Security Operations285 questions
• Security Program Management and Oversight188 questions
• All Security+ practice questions990 total
• General Security Concepts study notesKey concepts
• Security practice examsAll Security

Security+ General Security Concepts FAQ