CompTIA SY0-701: CompTIA Security+

Last checked October 22, 2026 against the official CompTIA exam page.

1. Question 1Security Operations

   A SOC analyst must collect evidence from a compromised server while keeping it admissible in court. Which practice is most important?

   1. AMaintaining chain of custody and documenting every action taken
   2. BRebooting the server to clear the malware from RAM before imaging the disk
   3. CCopying files to a personal USB drive formatted as FAT32 for later transfer
   4. DDeleting logs to prevent misuse from the local host and the SIEM collector
   Show answer and explanationHide answer

   Correct answer: A

   Chain of custody and documented actions preserve evidence integrity. Rebooting destroys volatile data, personal USB copies break custody, and deleting logs destroys evidence.

2. Question 2Security Architecture

   A company is designing a network for a web application with a public web tier, an application tier, and a database tier. Which design best limits lateral movement if the web tier is compromised?

   1. ASeparate subnets with firewall rules that permit only required flows between tiers
   2. BA single flat network with every tier in one VLAN and no host-level filtering
   3. CGiving every tier administrator access to every other tier through one shared service account
   4. DExposing the database directly to the internet for monitoring with port 5432 open on a public IP
   Show answer and explanationHide answer

   Correct answer: A

   Segmented tiers with restrictive firewall rules limit how far an attacker can move. Flat networks, shared admin access and exposed databases all make lateral movement easier.

3. Question 3Threats, Vulnerabilities, and Mitigations

   A user receives a text message claiming to be from a bank and asks for account details. What is this attack called?

   1. AWhaling
   2. BSmishing
   3. CVishing
   4. DPharming
   Show answer and explanationHide answer

   Correct answer: B

   Smishing is phishing carried out by SMS text message. Vishing uses voice calls, whaling targets executives, and pharming redirects users to malicious sites through DNS or host manipulation.

4. Question 4General Security Concepts

   A company wants to ensure that a message sent by an employee cannot later be denied as having been sent. Which security concept applies?

   1. ABinary obfuscation
   2. BDynamic elasticity
   3. CNon-repudiation
   4. DLinear scalability
   Show answer and explanationHide answer

   Correct answer: C

   Non-repudiation prevents a party from denying an action, often through digital signatures and logs. Obfuscation hides information, while scalability and elasticity are capacity concepts.

5. Question 5Security Program Management

   A company wants to identify the most important risks to its business and rank them. Which practice does this?

   1. APenetration testing of exposed hosts to locate flaws
   2. BSoftware licensing review of installed applications annually
   3. CRisk assessment with likelihood and impact analysis
   4. DPrinter inventory with model and serial numbers
   Show answer and explanationHide answer

   Correct answer: C

   Risk assessment evaluates likelihood and impact to rank risks. A pen test identifies vulnerabilities, licensing reviews cover software use, and printer inventories are asset lists.