Free CompTIA Security+ (SY0-701) Practice Test

1. Question 1 of 25Multiple choiceDomain 1: General Security Concepts

   A retailer posts signs at its loading dock reading "Area under 24/7 video surveillance - trespassers will be prosecuted" and mounts visible cameras. Which control type do the signs and visible cameras best represent?

   • A.Compensating
   • B.Deterrent
   • C.Corrective
   • D.Preventive
   Show answer and explanation

   Correct answer: B

   A deterrent control discourages an attacker from acting by raising the perceived risk of being caught. Warning signs and visible cameras do not physically stop anyone (preventive), repair damage after the fact (corrective), or stand in for a missing control (compensating).

   Objective 1.1 · CompTIA Security+ SY0-701 exam objectives

2. Question 2 of 25Multiple choiceDomain 1: General Security Concepts

   In a zero trust architecture, which component evaluates each access request against policy and decides whether access is granted?

   • A.Policy Enforcement Point
   • B.Implicit trust zone
   • C.Policy Engine
   • D.Data plane subject
   Show answer and explanation

   Correct answer: C

   In the NIST zero trust model the Policy Engine makes the grant-or-deny decision, and the Policy Administrator carries out that decision by instructing the Policy Enforcement Point (PEP). The PEP only enforces the outcome at the resource. An implicit trust zone is what zero trust tries to shrink.

   Objective 1.2 · NIST SP 800-207 Zero Trust Architecture

3. Question 3 of 25Performance-based: matchDomain 1: General Security Concepts

   Match each requirement to the cryptographic or data-protection technique that best satisfies it. Each choice may be used once, more than once, or not at all.

   Choices (each may be used once, more than once, or not at all)

   • Hashing
   • Digital signature
   • Salting
   • HSM
   • Tokenization
   • Steganography
   • Key stretching

   Match these

   • 1.Compare a computed fixed-length digest against a published checksum to confirm a download is intact
   • 2.Prove which sender approved a document so they cannot deny it later
   • 3.Make identical passwords produce different stored hashes and defeat precomputed rainbow tables
   • 4.Generate and store private keys inside tamper-resistant dedicated hardware
   • 5.Replace a card number in a database with a surrogate value that has no mathematical relationship to it
   Show answer and explanation

   • 1. Compare a computed fixed-length digest against a published checksum to confirm a download is intact → Hashing
   • 2. Prove which sender approved a document so they cannot deny it later → Digital signature
   • 3. Make identical passwords produce different stored hashes and defeat precomputed rainbow tables → Salting
   • 4. Generate and store private keys inside tamper-resistant dedicated hardware → HSM
   • 5. Replace a card number in a database with a surrogate value that has no mathematical relationship to it → Tokenization

   Hashing provides integrity checking. A digital signature combines a hash with the signer’s private key to give integrity, authentication and non-repudiation. Salting adds a unique random value per password before hashing. A hardware security module (HSM) protects and uses keys without exposing them. Tokenization swaps sensitive data for a token that is only mapped back through a protected vault. Steganography hides data inside other data, and key stretching slows brute-force guessing; neither was needed here.

   Objective 1.4 · CompTIA Security+ SY0-701 exam objectives

4. Question 4 of 25Multiple choiceDomain 2: Threats, Vulnerabilities, and Mitigations

   A group defaces a government agency’s website with a political message to protest a new policy. They want publicity, not money. Which threat actor type does this best describe?

   • A.Hacktivist
   • B.Organized crime
   • C.Nation-state
   • D.Insider threat
   Show answer and explanation

   Correct answer: A

   Hacktivists are driven by philosophical or political beliefs, and defacement and denial-of-service are typical tactics. Organized crime is motivated by financial gain, nation-states by espionage or strategic goals with large resources, and insiders by motives such as revenge or financial gain, using legitimate access.

   Objective 2.1 · CompTIA Security+ SY0-701 exam objectives

5. Question 5 of 25Multiple choiceDomain 2: Threats, Vulnerabilities, and Mitigations

   An accounts-payable clerk receives an email that appears to come from the CEO, asking for an urgent wire transfer to a "new vendor" and saying not to discuss it with anyone. The sender address is a look-alike domain. Which attack is this?

   • A.Smishing
   • B.Watering hole
   • C.Vishing
   • D.Business email compromise
   Show answer and explanation

   Correct answer: D

   Business email compromise (BEC) impersonates an executive or trusted party over email to trigger a fraudulent payment or data release. Smishing uses SMS, a watering hole compromises a site the target visits, and vishing uses voice calls. A look-alike domain may support the attack, but the scenario describes impersonation-driven payment fraud.

   Objective 2.2 · CISA: Recognize and report phishing

6. Question 6 of 25Multiple choiceDomain 2: Threats, Vulnerabilities, and Mitigations

   A public web application builds its login query by concatenating the username field directly into a SQL string. Which change most directly eliminates the SQL injection vulnerability?

   • A.Encode output as HTML before sending it to the browser
   • B.Use parameterized queries (prepared statements)
   • C.Add a CAPTCHA to the login form
   • D.Require TLS 1.3 for the connection
   Show answer and explanation

   Correct answer: B

   Parameterized queries keep user input as data so it can never change the structure of the SQL statement. HTML output encoding defends against cross-site scripting, a CAPTCHA only slows automated abuse, and TLS protects data in transit but does not stop injection.

   Objective 2.3 · OWASP SQL Injection Prevention Cheat Sheet

7. Question 7 of 25Multiple choiceDomain 2: Threats, Vulnerabilities, and Mitigations

   A SOC analyst reviews authentication logs and sees one source IP trying a single password, "Summer2026!", against 400 different user accounts, with one or two failures per account. Which attack is occurring?

   • A.Brute force against one account
   • B.Credential replay
   • C.Password spraying
   • D.Rainbow table attack
   Show answer and explanation

   Correct answer: C

   Password spraying tries one or a few common passwords across many accounts, which stays under per-account lockout thresholds. Brute force hammers a single account with many guesses, replay reuses captured credentials or tokens, and a rainbow table attack works against stolen unsalted hashes offline.

   Objective 2.4 · CompTIA Security+ SY0-701 exam objectives

8. Question 8 of 25Select 2Domain 2: Threats, Vulnerabilities, and Mitigations

   Which TWO actions best reduce the attack surface of a newly deployed Linux web server?

   • A.Enable verbose debug output on the public web application
   • B.Disable unused services and close unneeded listening ports
   • C.Leave the vendor default administrator password until the next audit
   • D.Remove default accounts and change any default credentials
   • E.Allow all inbound traffic so monitoring tools can reach it
   Show answer and explanation

   Correct answers: B, D

   Hardening removes what an attacker could use: unused services and open ports give them fewer entry points, and default credentials are among the first things attackers try. Verbose debug output leaks information, and permitting all inbound traffic or keeping default passwords expands the attack surface.

   Objective 2.5 · NIST SP 800-123 Guide to General Server Security

9. Question 9 of 25Performance-based: matchDomain 2: Threats, Vulnerabilities, and Mitigations

   Match each description to the type of malware it describes.

   Choices (each may be used once, more than once, or not at all)

   • Trojan
   • Worm
   • Ransomware
   • Keylogger
   • Logic bomb
   • Rootkit
   • Virus
   • Bloatware

   Match these

   • 1.Looks like a legitimate utility but installs a hidden backdoor
   • 2.Spreads across the network by itself, with no user action
   • 3.Encrypts files and demands payment for the decryption key
   • 4.Captures everything a user types, including passwords
   • 5.Code planted by an admin that deletes records if their account is ever disabled
   • 6.Modifies the operating system to hide its own processes and files from tools
   Show answer and explanation

   • 1. Looks like a legitimate utility but installs a hidden backdoor → Trojan
   • 2. Spreads across the network by itself, with no user action → Worm
   • 3. Encrypts files and demands payment for the decryption key → Ransomware
   • 4. Captures everything a user types, including passwords → Keylogger
   • 5. Code planted by an admin that deletes records if their account is ever disabled → Logic bomb
   • 6. Modifies the operating system to hide its own processes and files from tools → Rootkit

   A Trojan relies on deception, a worm self-propagates, ransomware extorts through encryption, a keylogger records input, a logic bomb fires when a condition is met, and a rootkit conceals itself by tampering with the OS. A virus needs a host file and user action to spread, and bloatware is unwanted preinstalled software rather than a threat that performs these actions, so neither was needed here.

   Objective 2.4 · CompTIA Security+ SY0-701 exam objectives

10. Question 10 of 25Multiple choiceDomain 3: Security Architecture

    A hospital uses legacy infusion pumps that run an unsupported operating system and cannot be patched. Which action best reduces the risk they pose to the rest of the network?

    • A.Place them on an isolated network segment with strict firewall rules
    • B.Install a host-based antivirus agent on each pump
    • C.Enable automatic updates on the pumps
    • D.Add the pumps to the user VLAN so they are easier to manage
    Show answer and explanation

    Correct answer: A

    When a device cannot be patched or run agents, segmentation is the standard compensating control: isolate it and allow only the specific traffic it needs. Agents and automatic updates are not possible on unsupported embedded systems, and mixing them with user devices increases exposure.

    Objective 3.1 · CompTIA Security+ SY0-701 exam objectives
11. Question 11 of 25Multiple choiceDomain 3: Security Architecture

    Which device is deployed inline with network traffic and can automatically drop packets it identifies as malicious?

    • A.Network TAP
    • B.Intrusion detection system (IDS)
    • C.Honeypot
    • D.Intrusion prevention system (IPS)
    Show answer and explanation

    Correct answer: D

    An IPS sits in the traffic path, so it can block or drop malicious traffic in real time. A passive IDS receives a copy of traffic and alerts only. A TAP simply copies traffic to a monitor, and a honeypot is a decoy used to study attackers.

    Objective 3.2 · NIST SP 800-94 Guide to Intrusion Detection and Prevention Systems

12. Question 12 of 25Multiple choiceDomain 3: Security Architecture

    A company must keep its EU customers’ records in data centers located inside the EU so the data remains governed by EU law. Which concept is the company addressing?

    • A.Data retention
    • B.Data sovereignty
    • C.Data masking
    • D.Data minimization
    Show answer and explanation

    Correct answer: B

    Data sovereignty means data is governed by the laws of the jurisdiction where it resides, which drives decisions about cloud region and geographic restrictions. Retention is how long data is kept, masking hides values, and minimization limits how much data is collected.

    Objective 3.3 · CompTIA Security+ SY0-701 exam objectives

13. Question 13 of 25Multiple choiceDomain 3: Security Architecture

    An organization requires that, after its primary data center fails, operations resume at another site with minimal downtime using continuously replicated data and fully equipped, running systems. Which type of recovery site meets this?

    • A.Cold site
    • B.Warm site
    • C.Hot site
    • D.Backup tape vault
    Show answer and explanation

    Correct answer: C

    A hot site is a fully equipped facility with systems running and data replicated continuously, so failover is fast. A warm site has hardware but needs data restored and configured, and a cold site offers only space and power.

    Objective 3.4 · NIST SP 800-34 Rev. 1 Contingency Planning Guide

14. Question 14 of 25Multiple choiceDomain 4: Security Operations

    A small office wants the strongest protection for its Wi-Fi pre-shared password against offline dictionary attacks after a handshake is captured. Which option is best?

    • A.WPA2-Personal with TKIP
    • B.WEP with a long key
    • C.An open network with a captive portal
    • D.WPA3-Personal using SAE
    Show answer and explanation

    Correct answer: D

    WPA3-Personal replaces the pre-shared-key handshake with Simultaneous Authentication of Equals (SAE), so a captured handshake cannot be attacked offline to recover the passphrase. WEP and TKIP are deprecated and weak, and an open network provides no encryption of the wireless link.

    Objective 4.1 · CompTIA Security+ SY0-701 exam objectives

15. Question 15 of 25Multiple choiceDomain 4: Security Operations

    A vulnerability scanner reports many findings that the team suspects are false positives because it cannot see installed software versions. Which scan type would give more accurate results?

    • A.Credentialed scan
    • B.Non-credentialed scan
    • C.A port scan
    • D.Passive banner capture
    Show answer and explanation

    Correct answer: A

    A credentialed scan logs in to the target, so it can read patch levels, configuration and installed software, which reduces false positives. A non-credentialed scan sees only what an unauthenticated outsider can see.

    Objective 4.3 · NIST SP 800-115 Technical Guide to Information Security Testing

16. Question 16 of 25Multiple choiceDomain 4: Security Operations

    A security team wants a workflow that, when the EDR raises a high-severity alert, automatically isolates the host, opens a ticket and notifies the on-call analyst, with no manual steps. Which capability provides this?

    • A.Vulnerability scanner
    • B.SOAR playbook
    • C.Honeypot
    • D.SIEM log retention policy
    Show answer and explanation

    Correct answer: B

    Security orchestration, automation and response (SOAR) runs playbooks that chain actions across tools, such as quarantining an endpoint and creating a ticket. A SIEM collects and correlates logs and raises alerts but is not built to orchestrate the response.

    Objective 4.7 · CompTIA Security+ SY0-701 exam objectives

17. Question 17 of 25Multiple choiceDomain 4: Security Operations

    A company assigns permissions based on job title, so every "Accounts Payable Clerk" automatically receives the same set of access rights. Which access control model is this?

    • A.Mandatory access control
    • B.Discretionary access control
    • C.Role-based access control
    • D.Attribute-based access control
    Show answer and explanation

    Correct answer: C

    Role-based access control (RBAC) ties permissions to roles that reflect job functions. MAC uses labels and clearances set by a central authority, DAC lets owners grant access, and ABAC evaluates attributes such as location, time and device state.

    Objective 4.6 · NIST SP 800-53 Rev. 5 (AC-2 Account Management)

18. Question 18 of 25Select 2Domain 4: Security Operations

    Which TWO of the following are "something you have" authentication factors?

    • A.Smart card
    • B.Fingerprint
    • C.Hardware OTP key fob
    • D.PIN
    • E.Answer to a security question
    Show answer and explanation

    Correct answers: A, C

    A smart card and a hardware one-time-password token are physical possessions. A fingerprint is something you are (inherence), and a PIN and a security-question answer are something you know.

    Objective 4.6 · NIST SP 800-63B-4 Digital Identity Guidelines

19. Question 19 of 25Performance-based: orderDomain 4: Security Operations

    Put the incident response process in the correct order, from first to last.

    • •Analysis
    • •Containment
    • •Detection
    • •Eradication
    • •Lessons learned
    • •Preparation
    • •Recovery
    Show answer and explanation

    1. Preparation
    2. Detection
    3. Analysis
    4. Containment
    5. Eradication
    6. Recovery
    7. Lessons learned

    Preparation (plans, tools, training) comes before any incident. Detection and analysis confirm and scope the event, containment limits the damage, eradication removes the cause, recovery restores normal operations, and a lessons-learned review closes the loop and feeds back into preparation. This is the seven-step sequence in the CompTIA objectives; NIST SP 800-61 groups the same work into fewer phases.

    Objective 4.8 · CompTIA Security+ SY0-701 exam objectives

20. Question 20 of 25Multiple choiceDomain 4: Security Operations

    An analyst must find out which internal host talked to a suspicious external IP address and roughly how much data was sent, while keeping storage costs low. Which data source is best?

    • A.NetFlow records
    • B.Full packet captures
    • C.A vulnerability scan report
    • D.Application error logs
    Show answer and explanation

    Correct answer: A

    NetFlow records metadata about conversations (source, destination, ports, volume, timing) without storing payloads, so it is compact and answers who-talked-to-whom questions. Full packet capture would show content but is far more expensive to store.

    Objective 4.4 · CompTIA Security+ SY0-701 exam objectives
21. Question 21 of 25Multiple choiceDomain 5: Security Program Management and Oversight

    A company purchases a cyber insurance policy to cover the financial impact of a data breach. Which risk management strategy is this?

    • A.Avoid
    • B.Accept
    • C.Mitigate
    • D.Transfer
    Show answer and explanation

    Correct answer: D

    Transferring risk shifts the financial consequence to a third party, as with insurance or contractual indemnity. The risk itself still exists. Avoid removes the activity, mitigate reduces likelihood or impact, and accept acknowledges the risk without acting.

    Objective 5.2 · NIST SP 800-39 Managing Information Security Risk

22. Question 22 of 25Multiple choiceDomain 5: Security Program Management and Oversight

    A server loss would cost the company $50,000 (single loss expectancy). Analysts estimate this happens once every five years. What is the annualized loss expectancy (ALE)?

    • A.$250,000
    • B.$10,000
    • C.$50,000
    • D.$2,500
    Show answer and explanation

    Correct answer: B

    ALE = SLE × ARO. An event once every five years has an annualized rate of occurrence (ARO) of 0.2, so $50,000 × 0.2 = $10,000 per year.

    Objective 5.2 · CompTIA Security+ SY0-701 exam objectives

23. Question 23 of 25Multiple choiceDomain 5: Security Program Management and Oversight

    A company is hiring a managed service provider and wants a contract that specifies guaranteed uptime, response times and penalties if those targets are missed. Which document is most appropriate?

    • A.Non-disclosure agreement (NDA)
    • B.Memorandum of understanding (MOU)
    • C.Service-level agreement (SLA)
    • D.Business partners agreement (BPA)
    Show answer and explanation

    Correct answer: C

    An SLA defines measurable service levels such as availability and response time, and typically the remedies for missing them. An NDA protects confidential information, an MOU states a general, usually non-binding intent, and a BPA defines how partners share profits, losses and responsibilities.

    Objective 5.3 · CompTIA Security+ SY0-701 exam objectives

24. Question 24 of 25Multiple choiceDomain 5: Security Program Management and Oversight

    Under data privacy regulations such as GDPR, which role determines the purposes and means of processing personal data?

    • A.Data controller
    • B.Data processor
    • C.Data custodian
    • D.Data subject
    Show answer and explanation

    Correct answer: A

    The controller decides why and how personal data is processed. A processor handles data on the controller’s behalf, a custodian manages the technical storage and protection of data, and the data subject is the individual the data is about.

    Objective 5.1 · CompTIA Security+ SY0-701 exam objectives

25. Question 25 of 25Multiple choiceDomain 5: Security Program Management and Oversight

    A penetration tester is hired to test a company’s external defenses and is given only the company name and no other information about its systems. Which type of engagement is this?

    • A.Known environment
    • B.Partially known environment
    • C.Integrated
    • D.Unknown environment
    Show answer and explanation

    Correct answer: D

    In an unknown environment (black-box) test the tester starts with no knowledge of the target and must perform reconnaissance first. A known environment gives full documentation, a partially known one gives limited details, and an integrated test combines offensive and defensive testing.

    Objective 5.5 · CompTIA Security+ SY0-701 exam objectives

CompCertQuiz is an independent practice-exam site and is not affiliated with, endorsed by, or sponsored by CompTIA. These questions are original material written for exam preparation and are not real exam questions. CompTIA and its certification names are trademarks of CompTIA, Inc.