CompTIA Security+ SY0-701 Security Operations Practice Questions

Free Security+ Security Operations practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main CompTIA Security+ SY0-701 page. Sign up free to practice the full set.

1. Question 1Security Operations

   A company is implementing a security control that requires employees to use both a smart card and a PIN to access the server room. Which type of authentication is being used?

   • AMulti-factor authenticationCorrect
   • BSingle-factor authentication
   • CFederation
   • DSingle sign-on
   ✓ Correct answer: A

   Multi-factor authentication is correct because the scenario requires two proofs drawn from different factor categories: the smart card is something you have, and the PIN is something you know, and combining categories, not merely combining items, is what defines MFA. Requiring two credentials from the same category, such as a password plus a security question, would still be single-factor in practice because both rely on knowledge. MFA substantially raises the difficulty for an attacker because compromising one factor, such as stealing the PIN through phishing, is not enough without also physically possessing the smart card. The closest distractor, single-factor authentication, would apply only if both the card and PIN belonged to the same category, which they do not here. Federation and single sign-on are unrelated identity-management concepts describing how one login is trusted across systems, not how many factor types are combined.

   Why the other options are wrong

   • BSingle-factor authentication uses only one factor category, but this scenario combines something you have with something you know, which is two distinct categories.
   • CFederation lets one organization trust an identity asserted by another organization's provider and has nothing to do with combining multiple authentication factors.
   • DSingle sign-on lets a user access multiple systems after one login but does not by itself add a second, distinct authentication factor.
2. Question 2Security Operations

   Which of the following is a key benefit of implementing Single Sign-On (SSO) in an enterprise environment?

   • AIt stores a separate local password copy for each application on the endpoint so IT can restore access if a user forgets one password
   • BIt allows users to authenticate once and access multiple applications without re-entering credentialsCorrect
   • CIt replaces user authentication with per-application IP allow lists
   • DIt enforces a unique complex password policy independently on every application
   ✓ Correct answer: B

   Single Sign-On (SSO) centralizes authentication so that a user logs in once through an identity provider (IdP) and receives an authentication token or assertion that grants access to all integrated applications without additional credential prompts. This reduces password fatigue, decreases the likelihood of weak or reused passwords across multiple services, and simplifies user access management. SSO is commonly implemented using protocols such as SAML, OAuth 2.0, or OpenID Connect. This is the key benefit described, one authentication event unlocking many applications, and it directly addresses the alternative of managing separate credentials per app, which is what a password manager, not SSO, would instead help users cope with rather than eliminate.

   Why the other options are wrong

   • ACaching a separate local password per application is closer to what a password manager does than SSO; SSO centralizes authentication at an identity provider instead of storing per-app copies.
   • CIP allow listing is a network access control, not authentication; SSO still authenticates the user through the identity provider rather than trusting source addresses.
   • DIndependent per-application password policies are what SSO consolidates away; SSO removes the need for the user to authenticate separately to each application.
3. Question 3Security Operations

   EaglePoint Defense is implementing a security solution that automatically responds to detected threats by isolating affected endpoints and blocking malicious IP addresses. What type of solution is this?

   • ASOARCorrect
   • BSIEM
   • CNAC
   • DDLP
   ✓ Correct answer: A

   SOAR is correct because Security Orchestration, Automation, and Response platforms execute automated playbooks that carry out a coordinated sequence of response actions across multiple integrated tools the moment a threat is detected, such as isolating a compromised endpoint through the EDR agent and pushing a block rule to the firewall for a malicious IP. This automatic, multi-tool response without manual analyst intervention is the defining behavior that separates SOAR from the other options. A SIEM, by contrast, aggregates and correlates log data to generate the alert in the first place, but it does not itself orchestrate response actions across separate security tools; SOAR is the layer that turns the SIEM's alert into coordinated containment.

   Why the other options are wrong

   • BSIEM aggregates and correlates security events to generate alerts, but it does not by itself orchestrate automated, multi-tool response actions like endpoint isolation across integrated security tools.
   • CNAC enforces device compliance and policy at the moment of network connection; it does not orchestrate automated threat-response playbooks that isolate endpoints and block IPs after detection.
   • DDLP monitors and prevents unauthorized data exfiltration by inspecting content leaving the organization; it does not perform automated endpoint isolation or coordinate IP blocking across other security tools.
4. Question 4Security Operations

   A forensic investigator needs to ensure that evidence collected from a compromised server will be admissible in court. The investigator carefully documents every person who handled the evidence, when it was transferred, and where it was stored. What is this documentation process called?

   • AIncident timeline
   • BData classification
   • CEvidence correlation
   • DChain of custodyCorrect
   ✓ Correct answer: D

   Chain of custody is correct because it is the formal, sequential documentation process that records every person who collected, transferred, analyzed, or stored a piece of evidence, along with the exact dates, times, locations, and purpose behind each transfer. This unbroken documentation trail is what proves to a court that evidence was handled properly, never tampered with, and preserved in its original state from the moment of collection onward, which is an absolute requirement for digital evidence to be legally admissible. This is different from an incident timeline, which reconstructs the attacker's actions during the incident itself for investigative purposes, rather than tracking who physically or digitally possessed the evidence afterward.

   Why the other options are wrong

   • AAn incident timeline is a chronological reconstruction of events and attacker actions during a security incident, used for investigation and reporting; it does not track the handling and transfer of evidence.
   • BData classification categorizes data by sensitivity, such as public, internal, confidential, or restricted, to apply appropriate controls; it has no relationship to documenting who handled evidence during an investigation.
   • CEvidence correlation is the analytical process of linking related pieces of evidence to reconstruct events or attribute actions; it is an investigative technique, not documentation of the physical custody chain.
5. Question 5Security Operations

   An organization configures its endpoints so that scripts and macros are evaluated against rules and only those signed by trusted publishers are permitted to execute. Which control is being applied?

   • AApplication allow listing with code signingCorrect
   • BFull disk encryption
   • CData loss prevention
   • DNetwork segmentation to isolate systems by function and risk level
   ✓ Correct answer: A

   Evaluating scripts and macros against rules so only those signed by trusted publishers may execute is application allow listing enforced through code signing: rather than trying to blocklist every possible malicious script, an endless and reactive task, the endpoint is configured to execute only code carrying a valid digital signature from an approved publisher, so unsigned or tampered scripts and macros, the vector behind a large share of real-world macro-based attacks, are blocked by default regardless of how novel or previously unseen they are. Network segmentation, the closest wrong option in spirit, instead restricts which network zones a host can reach; it governs lateral movement between segments, not whether a given piece of code is permitted to run on the host in the first place.

   Why the other options are wrong

   • BFull disk encryption protects data at rest and has no bearing on which scripts or macros are permitted to execute.
   • CDLP monitors and blocks sensitive data leaving the organization; it does not govern execution of signed versus unsigned code.
   • DNetwork segmentation to isolate systems by function and risk level restricts traffic between zones to limit lateral movement, not which code is allowed to run on a host.
6. Question 6Security Operations

   After confirming an active intrusion, the incident-response team's immediate priority is to limit the damage and stop the threat from spreading further before removing it. Which IR phase is this?

   • AContainmentCorrect
   • BEradication
   • CRecovery
   • DLessons learned
   ✓ Correct answer: A

   Containment is the incident-response phase focused on stopping an active threat from spreading further while preserving evidence and systems for the phases that follow, typically split into short-term containment (isolating affected hosts immediately) and long-term containment (applying temporary fixes so business can continue while a permanent solution is prepared). It comes before eradication, which actually removes the malware, accounts, or footholds the attacker planted, and before recovery, which restores systems to normal production operation once the threat is gone. The scenario's priority, limiting damage and stopping spread before removal, is exactly containment's role; jumping straight to eradication without containing first risks the threat continuing to spread while it is being removed, and lessons learned only happens after the incident is fully resolved.

   Why the other options are wrong

   • BEradication removes the threat itself, malware, malicious accounts, and footholds, and happens after containment has already stopped the spread.
   • CRecovery restores affected systems to normal production operation, which only happens after the threat has been contained and eradicated.
   • DLessons learned is the post-incident review conducted after the incident is fully resolved to improve future response, not an immediate action during active intrusion.
7. Question 7Security Operations

   A SOC manager reports that the average time between an alert firing and an analyst beginning to work it is 22 minutes, and wants to drive that number down by improving triage staffing. Which metric is being measured?

   • AMean time to acknowledgeCorrect
   • BMean time to repair (MTTR)
   • CMean time between failures (MTBF)
   • DRecovery point objective (RPO)
   ✓ Correct answer: A

   Mean time to acknowledge specifically measures the elapsed time between an alert firing in the monitoring system and an analyst actually beginning to work that alert, which is a pure measure of triage responsiveness and staffing adequacy rather than how long it takes to fully resolve the underlying issue once someone starts on it. Improving triage staffing, adjusting shift coverage, or adding automated alert routing are the typical levers used to reduce this metric, since the delay it measures is specifically about the gap before human attention engages with the alert. This is distinct from mean time to repair, which covers the entire duration from when work begins until the issue is fully resolved, meaning an organization could have an excellent MTTA but still a poor MTTR if remediation itself is slow once analysts start working an alert.

   Why the other options are wrong

   • BMean time to repair measures the full duration to actually resolve an issue once work has started, not the initial delay before an analyst picks it up.
   • CMean time between failures measures system reliability as the average uptime between failures; it is unrelated to how quickly alerts get acknowledged.
   • DRecovery point objective defines how much data loss is tolerable in a recovery scenario; it has nothing to do with alert acknowledgment speed.
8. Question 8Security Operations

   A newly disclosed CVE affects a library used across dozens of applications. Leadership asks the security team how urgent the response should be. Which resource BEST helps the team judge the technical severity and exploitability of the flaw in a standardized way?

   • AThe CVSS score for the CVECorrect
   • BThe internal asset inventory count
   • CThe vendor's marketing release notes
   • DThe organization's incident response plan
   ✓ Correct answer: A

   The Common Vulnerability Scoring System produces a standardized, repeatable numeric rating (0 to 10) built from measurable metrics such as attack vector, attack complexity, privileges required, and the confidentiality, integrity, and availability impact of successful exploitation, letting the team compare this newly disclosed CVE's technical severity and exploitability against every other vulnerability they track using a consistent methodology. That standardization is exactly what leadership needs to gauge urgency in a way that is comparable across the dozens of applications the library touches, rather than relying on subjective impressions. The internal asset inventory count instead only shows the blast radius, how many systems are affected, without describing the severity of the flaw itself. Vendor marketing release notes are unstandardized and can understate real risk, and the incident response plan defines organizational process for handling incidents rather than measuring any specific vulnerability's severity.

   Why the other options are wrong

   • BAsset counts show blast radius but not the flaw's technical severity.
   • CMarketing notes are unstandardized and may understate risk.
   • DThe IR plan defines process, not the severity rating of a specific CVE.

How Security Operations is tested

This domain holds 285 of the 990 questions in the Security+ bank, about 29%. The mix is 240 single-answer multiple choice and 45 multiple-response, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Security Operations on its own rather than re-running full-length mocks.

Other Security+ exam domains

• General Security Concepts125 questions
• Threats, Vulnerabilities, and Mitigations216 questions
• Security Architecture176 questions
• Security Program Management and Oversight188 questions
• All Security+ practice questions990 total
• Security Operations study notesKey concepts
• Security practice examsAll Security

Security+ Security Operations FAQ