Skip to content

CompTIA Security+ (SY0-701) - Practice Questions

15 questions for Security+ prep across general security concepts, threats and vulnerabilities, security architecture, operations, and program management.

Cert page: exams/comptia/security-plus/

Question 1

Scenario: The CIA triad's three components.

A. Control, Integrity, Access B. Confidentiality, Integrity, Authentication, a variant often mistaken for the triad C. Confidentiality, Integrity, Availability D. Cryptography, Isolation, Auditing

Answer **Correct: C** **Why:** Confidentiality keeps data from unauthorized viewers, integrity keeps it unaltered, availability keeps it reachable. Most exam questions asking "which principle is affected" resolve by mapping the incident to one of the three: a leak is confidentiality, tampering is integrity, ransomware is availability.

Question 2

Scenario: A control category question: a security guard, a firewall, and a policy document.

A. All technical, because each one enforces a rule on people or on systems B. All administrative, since each is defined by the organization and applied to staff C. All operational, because each is carried out day to day by security staff D. Physical, technical, and managerial respectively

Answer **Correct: D** **Why:** SY0-701 uses managerial, operational, technical, and physical as the categories, cut across by control types: preventive, deterrent, detective, corrective, compensating, and directive. A single control has one category and one type, and questions often ask for both.

Question 3

Scenario: An attacker sends a targeted email to the CFO impersonating the CEO requesting a wire transfer.

A. Vishing B. Smishing C. Phishing sent as a mass mailing to a broad list with no attempt to target one person D. Business email compromise, a form of spear phishing known as whaling when it targets executives

Answer **Correct: D** **Why:** Spear phishing is targeted, whaling targets high-value individuals, and BEC is the fraud pattern built on it. Vishing is voice and smishing is SMS. The exam distinguishes these by the channel and the targeting, so read for both.

Question 4

Scenario: A user's password is stolen but the attacker still cannot log in.

A. Encryption of the password database at rest, which protects storage but not a stolen password B. Antivirus on the endpoint, which detects malware but does not verify a login C. A firewall at the network edge, which filters traffic but cannot check who is logging in D. Multi-factor authentication requiring a second factor

Answer **Correct: D** **Why:** The factors are something you know, something you have, and something you are, with location and behavior as attributes. Two of the same category is not MFA: a password plus a security question is still one factor.

Question 5

Scenario: Which cryptographic property does a hash provide?

A. Confidentiality, because the digest scrambles the original data so unauthorized readers cannot see it B. Integrity, via a fixed-length digest that changes when the input changes C. Availability, because a hash lets the system recover a damaged file D. Non-repudiation on its own

Answer **Correct: B** **Why:** Hashing is one-way and provides no confidentiality. Non-repudiation needs a digital signature, which combines a hash with the signer's private key. Salting defends stored password hashes against precomputed rainbow tables.

Question 6

Scenario: Symmetric versus asymmetric encryption.

A. Symmetric: one shared key, fast. Asymmetric: a key pair, easier key distribution, higher compute cost B. Asymmetric is always faster, which is why it is preferred for encrypting large volumes of data such as full disk images C. Symmetric cannot encrypt bulk data, because one shared key is only safe for messages of a few kilobytes at a time D. They are the same

Answer **Correct: A** **Why:** The practical pattern combines both: asymmetric to exchange a symmetric session key, symmetric for the bulk data. TLS works this way, which is why it needs certificates for the handshake and a cipher for the payload.

Question 7

Scenario: A certificate is presented and the client must verify it is not revoked.

A. Trust the certificate because it was signed by a CA that the browser already ships in its trust store B. Check the hostname only, confirming the name in the certificate matches the site being visited C. Check a certificate revocation list or use OCSP, ideally with stapling so the server supplies a signed status D. Check the expiry date only, since an expired certificate is the only sign of a bad one

Answer **Correct: C** **Why:** Validation covers the chain to a trusted root, the hostname, the validity dates, and revocation. OCSP stapling has the server present a signed status response, avoiding a separate client lookup and the privacy leak that comes with it.

Question 8

Scenario: Which describes a zero-day vulnerability?

A. A vulnerability disclosed publicly a year ago, for which patches exist but have not been applied B. Any unpatched system exposed to the internet, regardless of whether a fix exists C. A vulnerability with no vendor patch available at the time of exploitation D. A misconfiguration, such as a default password or an open port, that attackers find on their own

Answer **Correct: C** **Why:** The defining property is the absence of a fix, which is why compensating controls matter: segmentation, monitoring, and least privilege limit the damage of something you cannot patch. An old unpatched vulnerability is a patch management failure, not a zero-day.

Question 9

Scenario: A network is divided so that a compromised workstation cannot reach the database tier directly.

A. Load balancing, which spreads requests across servers for performance and availability B. Network segmentation, limiting lateral movement by restricting which zones a compromised host can reach C. Redundancy, which duplicates components so a single failure does not take the service down D. Encryption, which protects data in transit but does not stop a workstation reaching the tier

Answer **Correct: B** **Why:** Segmentation assumes a breach will happen and constrains what happens next. Microsegmentation extends it to individual workloads, and a screened subnet (DMZ) is the classic form for internet-facing services.

Question 10

Scenario: An organization must decide how to handle a risk it cannot cost-effectively mitigate.

A. Choose a response (accept, avoid, transfer, or mitigate) and document the decision B. Always mitigate, even when the control costs more than the loss it would prevent, to keep the register clean C. Always transfer the risk to an insurer or vendor, since the risk can then be ignored by the business owner D. Ignore it

Answer **Correct: A** **Why:** Formal acceptance by an authorized owner is a legitimate outcome and is what the risk register records. The exam also tests the vocabulary around it: risk appetite, residual risk (what remains after controls), and inherent risk (before them).

Question 11

Scenario: The incident response lifecycle order.

A. Preparation, detection and analysis, containment, eradication, recovery, lessons learned B. Containment first, always, because stopping the spread must happen before anyone analyzes the incident C. Detection, preparation, recovery, containment D. Recovery, then detection

Answer **Correct: A** **Why:** Preparation comes first because it is what makes the rest possible, and lessons learned is where the organization actually improves. Containment precedes eradication: stop the spread before you remove the cause.

Question 12

Scenario: RPO and RTO must be distinguished.

A. RPO is acceptable data loss and sets backup frequency; RTO is acceptable downtime and sets recovery design B. RPO measures downtime, meaning how long systems may stay unavailable before the business suffers serious and lasting harm C. RTO measures data loss, meaning how many hours of transactions can be lost D. They are the same

Answer **Correct: A** **Why:** RPO looks backward from the incident and RTO looks forward. A four-hour RPO means backups at least every four hours; a one-hour RTO usually rules out restoring from tape. MTTR and MTBF are the related availability metrics.

Question 13

Scenario: Logs from many systems must be correlated to detect an attack pattern.

A. A firewall, which filters traffic by rule at a network boundary but does not correlate logs B. A SIEM, correlating log data from many sources and alerting on attack patterns C. A vulnerability scanner, which finds known weaknesses on hosts but does not watch for attacks D. An IPS, which blocks matching traffic inline but does not correlate

Answer **Correct: B** **Why:** Correlation across sources is what reveals patterns invisible in any single log. SOAR adds automated response playbooks on top. An IPS blocks in line, and a scanner finds weaknesses rather than detecting active attacks.

Question 14

Scenario: A penetration test where the tester has no prior knowledge of the environment.

A. Partially known (grey box), where the tester is given some credentials or diagrams B. Unknown environment (black box) C. A vulnerability scan, which is automated and only lists potential weaknesses D. White box, where the tester is given full documentation and source access

Answer **Correct: B** **Why:** SY0-701 uses known, partially known, and unknown environment terminology. The other distinction the exam tests is scanner versus test: a vulnerability scan identifies potential weaknesses, while a penetration test attempts to exploit them and demonstrate impact.

Question 15

Scenario: Sensitive data must be replaced with a non-sensitive equivalent that can be reversed by an authorized system.

A. Hashing, which produces a fixed-length digest that cannot be reversed by any system B. Encryption with a lost key, so nobody can recover it C. Tokenization, with the token mapped back to the original in a secure vault D. Masking, which hides part of a value such as the first digits of a card number, usually irreversibly

Answer **Correct: C** **Why:** Tokenization removes the sensitive value from the processing environment entirely, which is why it is common in payment systems for PCI scope reduction. Masking obscures for display, and hashing is one-way and therefore not reversible.

Where to go deeper