CertArea
All CompTIA exams

Free SY0-701 practice test: 30 questions with answers

30 original questions for CompTIA Security+, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions
Real exam
Maximum of 90 (multiple choice and performance-based) questions, 90 min
Passing score
750 (scale 100-900)

SY0-701 exam guide: topics, cost and format

All 30 SY0-701 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Security Operations (6 questions)

  1. Question 1

    A SOC analyst must collect evidence from a compromised server while keeping it admissible in court. Which practice is most important?

    1. AMaintaining chain of custody and documenting every action taken
    2. BRebooting the server to clear the malware from RAM before imaging the disk
    3. CCopying files to a personal USB drive formatted as FAT32 for later transfer
    4. DDeleting logs to prevent misuse from the local host and the SIEM collector
    Show answer and explanation
    Correct answer: A

    Chain of custody and documented actions preserve evidence integrity. Rebooting destroys volatile data, personal USB copies break custody, and deleting logs destroys evidence.

  2. Question 2

    A company wants to make sure its security tools produce alerts only when there is real activity, and to reduce noise over time. Which practice helps most?

    1. ATurning off alert generation across the SIEM and EDR consoles during the rollout period
    2. BIgnoring alerts with low severity in the triage queue during business hours
    3. CAllowing every alert to page the on-call team at night and weekends
    4. DTuning alert rules based on false positive review and documenting the changes
    Show answer and explanation
    Correct answer: D

    Reviewing false positives and tuning rules improves signal quality over time. Turning off alerts, ignoring them and paging for everything cause missed detection or fatigue.

  3. Question 3

    Which vulnerability management activity identifies assets and their exposure before they are scanned for weaknesses?

    1. APenetration test report writing
    2. BFirewall policy rule cleanup
    3. CAsset inventory and classification
    4. DPhishing simulation campaign
    Show answer and explanation
    Correct answer: C

    Asset inventory and classification establish what must be scanned and how critical it is. Phishing simulations, reporting and firewall cleanup are different activities.

  4. Question 4

    A security team must ensure that a newly deployed server meets the baseline configuration. Which tool or practice helps verify this consistently?

    1. ACopying settings from a random server without reviewing them
    2. BIgnoring the baseline for speed during the overall deployment window
    3. CRelying on the administrator's memory to recall hardening settings
    4. DConfiguration baseline with automated compliance scanning
    Show answer and explanation
    Correct answer: D

    A configuration baseline checked by automated compliance scanning ensures consistency. Memory, random copies and ignoring baselines create drift.

  5. Question 5

    A security analyst must determine whether a file is malicious. Which technique is most appropriate for a file that is not known to antivirus signatures?

    1. AOpening the file on a production server to see if it runs
    2. BDeleting the file from the endpoint without static review
    3. CSandbox analysis to observe its behavior in an isolated environment
    4. DEmailing the file to every staff member's mailbox for team review and comment
    Show answer and explanation
    Correct answer: C

    Sandboxes observe behavior safely in isolation, which reveals unknown malware. Production opening, deletion without analysis and mass emailing are unsafe or unhelpful.

  6. Question 6

    Which activity should occur before an organization decommissions a server that stored sensitive data?

    1. ALeaving the drives in an unlocked closet near the loading dock
    2. BSelling the drives without sanitization to a secondhand reseller through an online auction
    3. CSecurely sanitizing or destroying the storage media according to policy
    4. DFormatting the drives once with a quick format mode using the default settings
    Show answer and explanation
    Correct answer: C

    Sanitizing or destroying media according to policy prevents data recovery. Unlocked storage, unsanitized sales and quick formats leave data recoverable.

Security Architecture (6 questions)

  1. Question 7

    A company is designing a network for a web application with a public web tier, an application tier, and a database tier. Which design best limits lateral movement if the web tier is compromised?

    1. ASeparate subnets with firewall rules that permit only required flows between tiers
    2. BA single flat network with every tier in one VLAN and no host-level filtering
    3. CGiving every tier administrator access to every other tier through one shared service account
    4. DExposing the database directly to the internet for monitoring with port 5432 open on a public IP
    Show answer and explanation
    Correct answer: A

    Segmented tiers with restrictive firewall rules limit how far an attacker can move. Flat networks, shared admin access and exposed databases all make lateral movement easier.

  2. Question 8

    Which network zone is used for servers that must accept connections from the internet but should be isolated from the internal network?

    1. AGuest wireless network VLAN
    2. BOut-of-band management VLAN
    3. CDemilitarized zone (DMZ)
    4. DBackend iSCSI storage network
    Show answer and explanation
    Correct answer: C

    A DMZ hosts publicly reachable services with restricted access to internal networks. Guest, management and storage networks serve other purposes.

  3. Question 9

    A company wants to reduce the risk of a compromised server affecting others in the same data center. Which approach best applies this idea?

    1. AMicro-segmentation with policies applied to individual workloads
    2. BDisabling host firewalls on every server to simplify troubleshooting
    3. CPlacing the workloads in one large subnet with one shared default gateway
    4. DSharing one local account with the same root password across the servers
    Show answer and explanation
    Correct answer: A

    Micro-segmentation applies policies at the workload level, which contains compromises. Single subnets, shared accounts and disabled firewalls increase spread.

  4. Question 10

    Which cloud deployment model uses infrastructure owned and operated exclusively by one organization?

    1. APrivate cloud
    2. BHybrid cloud
    3. CPublic cloud
    4. DCommunity cloud
    Show answer and explanation
    Correct answer: A

    A private cloud is dedicated to one organization. Public cloud is shared among tenants, community cloud serves a defined group, and hybrid combines models.

  5. Question 11

    A company must keep backups available if its primary data center is unavailable. Which strategy addresses this requirement?

    1. AStoring the backups in the same server room cabinet
    2. BDeleting backups after one day automatically to save space
    3. CKeeping backups on the same disk as the live production data
    4. DGeographically separate backups with tested restoration procedures
    Show answer and explanation
    Correct answer: D

    Geographically separate backups with tested restoration protect against site-level failures. Same-room, same-disk and short-lived backups do not survive a site outage.

  6. Question 12

    A firm's application must continue operating if one data center fails. Which concept describes this requirement?

    1. AConfidentiality through symmetric encryption
    2. BHigh availability through redundant sites and failover
    3. CNon-repudiation through digital signatures
    4. DObfuscation through renaming of executable files
    Show answer and explanation
    Correct answer: B

    High availability uses redundancy and failover to keep services running during failures. Encryption, signatures and renaming address other goals.

Threats, Vulnerabilities, and Mitigations (6 questions)

  1. Question 13

    A user receives a text message claiming to be from a bank and asks for account details. What is this attack called?

    1. AWhaling
    2. BSmishing
    3. CVishing
    4. DPharming
    Show answer and explanation
    Correct answer: B

    Smishing is phishing carried out by SMS text message. Vishing uses voice calls, whaling targets executives, and pharming redirects users to malicious sites through DNS or host manipulation.

  2. Question 14

    An attacker places a malicious device between two hosts on a network to intercept traffic. Which attack is this?

    1. ADenial of service
    2. BBrute force
    3. CMan-in-the-middle
    4. DSQL injection
    Show answer and explanation
    Correct answer: C

    A man-in-the-middle attack places the attacker between two parties to intercept or alter traffic. DoS disrupts availability, SQL injection targets databases, and brute force guesses credentials.

  3. Question 15

    Which type of malware encrypts a victim's files and demands payment for the decryption key?

    1. ASnoopware
    2. BAdware bundle
    3. CRootkit tool
    4. DRansomware
    Show answer and explanation
    Correct answer: D

    Ransomware encrypts data and demands payment for recovery. Spyware gathers information, rootkits hide persistence, and adware displays unwanted advertising.

  4. Question 16

    An attacker sends a flood of requests from thousands of compromised devices to overwhelm a web service. Which attack category does this describe?

    1. ADistributed denial of service
    2. BCross-site scripting in a form field
    3. CPrivilege escalation via setuid
    4. DSession hijacking via token reuse
    Show answer and explanation
    Correct answer: A

    A flood from many compromised devices is a distributed denial-of-service attack. Privilege escalation gains higher rights, XSS injects scripts, and session hijacking takes over a session.

  5. Question 17

    An attacker enters a single quote character in a login form and the application returns a database error. Which vulnerability is most likely present?

    1. ACertificate pinning failure
    2. BSQL injection
    3. CClickjacking
    4. DDNS amplification
    Show answer and explanation
    Correct answer: B

    A database error from a quote character suggests unsanitized input to a SQL query, which is SQL injection. The other vulnerabilities do not match this behavior.

  6. Question 18

    A security analyst discovers that an application accepts a stored script in a comment field that runs for every user who views the page. Which attack is this?

    1. AReflected cross-site scripting
    2. BCertificate spoofing
    3. CStored cross-site scripting
    4. DReplay attack
    Show answer and explanation
    Correct answer: C

    A script stored in content and run for every viewer is stored cross-site scripting. Reflected XSS requires a crafted link, replay attacks resend captured messages, and certificate spoofing impersonates servers.

General Security Concepts (6 questions)

  1. Question 19

    A company wants to ensure that a message sent by an employee cannot later be denied as having been sent. Which security concept applies?

    1. ABinary obfuscation
    2. BDynamic elasticity
    3. CNon-repudiation
    4. DLinear scalability
    Show answer and explanation
    Correct answer: C

    Non-repudiation prevents a party from denying an action, often through digital signatures and logs. Obfuscation hides information, while scalability and elasticity are capacity concepts.

  2. Question 20

    An administrator needs to protect data stored on a laptop in case the device is stolen. Which control provides the best protection for data at rest?

    1. AStrong passwords on the desktop background
    2. BFull-disk encryption with a managed recovery key
    3. CA steel cable lock wrapped round the laptop
    4. DAntivirus suite with no disk encryption
    Show answer and explanation
    Correct answer: B

    Full-disk encryption protects data at rest if the device is lost, and a managed recovery key allows recovery. Wallpaper passwords, cable locks and antivirus alone do not protect stored data.

  3. Question 21

    Which cryptographic approach uses the same key for both encryption and decryption?

    1. AAsymmetric encryption
    2. BHashing
    3. CSymmetric encryption
    4. DDigital signatures only
    Show answer and explanation
    Correct answer: C

    Symmetric encryption uses one shared key for both operations. Asymmetric encryption uses a key pair, hashing is one-way, and signatures use a private key to sign.

  4. Question 22

    A security architect wants to protect a web application against an attacker who has stolen a valid session cookie. Which control best limits this risk?

    1. ABinding sessions to the client and expiring them quickly, with secure cookie attributes
    2. BStoring session cookies in a publicly shared text file in the web root
    3. CSetting session cookies to be readable by JavaScript so scripts can read them
    4. DReusing one shared session cookie across many user accounts on the same server
    Show answer and explanation
    Correct answer: A

    Secure cookie attributes, short expiry and session binding limit how useful a stolen cookie is. Readable cookies, shared cookies and public storage make theft easier.

  5. Question 23

    Which security control type is a cable lock on a server rack?

    1. AManagerial
    2. BPhysical
    3. CTechnical
    4. DAdministrative
    Show answer and explanation
    Correct answer: B

    A cable lock is a physical control that restricts access to equipment. Technical controls are logical or software based, and administrative or managerial controls are policies and processes.

  6. Question 24

    A company requires a security awareness program and written acceptable use policies. Which control category do these represent?

    1. AAdministrative
    2. BPhysical
    3. CTechnical
    4. DCorrective only
    Show answer and explanation
    Correct answer: A

    Policies and training are administrative controls that shape behavior and governance. Physical controls are tangible barriers and technical controls are system based.

Security Program Management (6 questions)

  1. Question 25

    A company wants to identify the most important risks to its business and rank them. Which practice does this?

    1. APenetration testing of exposed hosts to locate flaws
    2. BSoftware licensing review of installed applications annually
    3. CRisk assessment with likelihood and impact analysis
    4. DPrinter inventory with model and serial numbers
    Show answer and explanation
    Correct answer: C

    Risk assessment evaluates likelihood and impact to rank risks. A pen test identifies vulnerabilities, licensing reviews cover software use, and printer inventories are asset lists.

  2. Question 26

    An organization accepts a risk because the cost of mitigation is higher than the expected loss. Which risk response is this?

    1. ARisk transference
    2. BRisk acceptance
    3. CRisk avoidance
    4. DRisk amplification
    Show answer and explanation
    Correct answer: B

    Accepting a risk means choosing to live with it when mitigation is not justified. Transference shifts risk to a third party, avoidance stops the activity, and amplification is not a response.

  3. Question 27

    A company buys cyber insurance to cover the financial impact of a data breach. Which risk response does this represent?

    1. ARisk transference
    2. BRisk mitigation through patching
    3. CRisk acceptance
    4. DRisk avoidance
    Show answer and explanation
    Correct answer: A

    Insurance transfers financial risk to another party. Acceptance keeps the risk, avoidance removes the activity, and patching is mitigation.

  4. Question 28

    Which document describes the contractual security requirements and service levels a vendor must meet?

    1. AService level agreement or security addendum
    2. BA printer manual covering duplex printing settings
    3. CA marketing brochure describing product features in full
    4. DAn employee holiday calendar with office closures
    Show answer and explanation
    Correct answer: A

    Service level agreements and security addenda define vendor obligations. Brochures, calendars and manuals do not form binding security requirements.

  5. Question 29

    A company must comply with a data protection regulation that requires notification of breaches within a defined time frame. Which governance element defines this obligation?

    1. ACompliance requirements and incident notification procedures
    2. BDesktop wallpaper policy specifying approved corporate images for staff
    3. CPrinter toner specifications listing cartridge yield and page counts
    4. DHoliday schedules listing office closures and public observance dates
    Show answer and explanation
    Correct answer: A

    Compliance requirements and notification procedures define the obligation and steps to meet it. The other items are not governance obligations.

  6. Question 30

    Which control helps an organization prove that its employees have read and agreed to security policies?

    1. AVerbal agreements given during weekly team meetings
    2. BSigned acknowledgments tracked for each policy
    3. CAssuming staff read the policy upon hire
    4. DPosting the policy on a shared drive without logs
    Show answer and explanation
    Correct answer: B

    Signed and tracked acknowledgments provide evidence of policy acceptance. Verbal agreements, assumptions and unrecorded postings are not verifiable.