CompTIA Security+ SY0-701 Practice Test: 20 Free Questions with Answers

Twenty questions in the exam's domain weights, each with its answer and the reason. The full course has 270 explained questions plus generated math items, scored tests in the real exam's format, and lessons built from what you miss.

1. A hospital cannot patch an infusion pump because the vendor has not released an update. The security team places the pump on an isolated network segment and adds traffic monitoring. Which control type BEST describes these additions?

   1. Deterrent, discouraging an attacker from trying
   2. Compensating
   3. Directive
   4. Corrective, repairing damage after an incident
   Show the answer

   Answer: B. A compensating control substitutes for the ideal control when it cannot be applied. Patching is impossible, so segmentation and monitoring compensate. Corrective controls repair damage after an event; deterrent controls discourage; directive controls instruct.

   From the lesson Security Controls: Categories and Types.

2. An organization wants to guarantee that a contract signed electronically cannot later be denied by the person who signed it. Which security concept and mechanism address this?

   1. Confidentiality, using symmetric encryption
   2. Availability, using a redundant server
   3. Non-repudiation, using a digital signature
   4. Authorization, using role-based access
   Show the answer

   Answer: C. Non-repudiation means the signer cannot deny the action. A digital signature is created with the signer's private key, which only they hold, so it ties the document to them. Encryption provides confidentiality, not proof of origin.

   From the lesson CIA, Non-repudiation, AAA, and Gap Analysis.

3. Forensic analysis of a defense contractor's network reveals custom malware that has been present for nine months, communicating with infrastructure linked to a foreign government. Which threat actor is MOST likely responsible?

   1. Hacktivist
   2. Unskilled attacker
   3. Nation-state
   4. Shadow IT
   Show the answer

   Answer: C. Long-term stealthy access with custom tooling against a defense target is characteristic of a nation-state actor conducting espionage. Hacktivists seek publicity, unskilled attackers use borrowed tools, and shadow IT is not an attacker.

   From the lesson Threat Actors and Motivations.

4. An employee finds a USB drive in the parking lot, plugs it into a workstation to identify the owner, and malware executes. Which threat vector was exploited?

   1. Message-based
   2. Unsecure wireless network
   3. Supply chain
   4. Removable device
   Show the answer

   Answer: D. A removable device such as a USB drive is a physical threat vector; malware runs when it is connected. The defense combines device control policies with user training.

   From the lesson Threat Vectors and Attack Surfaces.

5. The accounts payable clerk receives an email that appears to come from the CFO, instructing an urgent wire transfer to a new supplier account before the end of the day. Which attack is this, and what is the BEST control?

   1. Business email compromise; verify the request through a known phone number
   2. Whaling; install antivirus on the CFO's laptop
   3. Smishing; block SMS messages
   4. Watering hole; filter the supplier's website
   Show the answer

   Answer: A. An email impersonating an executive to redirect a payment is business email compromise. The effective control is procedural: out-of-band verification of any payment change through a known contact, never by replying to the email.

   From the lesson Social Engineering.

6. A tester sends a 3,000-character string to a field that expects a 50-character name. The service crashes and, with a crafted input, executes code supplied by the tester. Which vulnerability is this?

   1. Race condition
   2. Buffer overflow
   3. SQL injection
   4. Directory traversal
   Show the answer

   Answer: B. Copying more data into a memory buffer than it can hold overwrites adjacent memory, including the return address, allowing attacker code to run. That is a buffer overflow.

   From the lesson Application and Operating System Vulnerabilities.

7. A company runs virtual machines in an infrastructure-as-a-service cloud. Under the shared responsibility model, who is responsible for applying operating system patches to those virtual machines?

   1. The cloud provider
   2. The customer
   3. The internet service provider
   4. The hypervisor vendor
   Show the answer

   Answer: B. In IaaS the provider secures the physical infrastructure and hypervisor, while the customer manages and patches the operating systems and everything above them. Data, identities, and configuration are always the customer's responsibility.

   From the lesson Cloud, Infrastructure as Code, Serverless, and Microservices.

8. A defense contractor requires that a classified research network have no possible network path to the internet. Which architecture provides this?

   1. Logical segmentation with VLANs
   2. Software-defined networking
   3. Physical isolation (air gap)
   4. A screened subnet
   Show the answer

   Answer: C. An air gap physically separates the network from all others, so no network path exists. VLANs and SDN provide logical separation on shared infrastructure, and a screened subnet is still connected.

   From the lesson Networks, Virtualization, Containers, and Special Systems.

9. A retailer's website must handle triple its normal traffic during holiday sales without redesign. Which architecture consideration is MOST important?

   1. Responsiveness
   2. Power
   3. Patch availability
   4. Scalability
   Show the answer

   Answer: D. Scalability is the ability to grow capacity with demand. Responsiveness concerns speed for each user, not volume, and the other options are unrelated to traffic growth.

   From the lesson Architecture Considerations.

10. A company must place its public web servers so that they are reachable from the internet but separated from the internal network by firewalls on both sides. Which zone is this?

    1. Screened subnet
    2. Internal trusted zone
    3. Management network
    4. Air gap
    Show the answer

    Answer: A. A screened subnet, historically called a DMZ, sits between the internet and the internal network with firewalls at each boundary, so a compromised public server does not give access to internal systems.

    From the lesson Device Placement, Zones, Failure Modes, and Appliances.

11. Servers were configured according to the approved baseline when built, but an audit months later finds that many now differ from the baseline and from each other. Which step of secure baseline management failed?

    1. Establish
    2. Deploy
    3. Classify
    4. Maintain
    Show the answer

    Answer: D. Maintaining a baseline means monitoring for drift and re-applying the approved configuration. The systems were established and deployed correctly but not maintained.

    From the lesson Secure Baselines and Hardening Targets.

12. Every time an employee leaves, the company must change the Wi-Fi passphrase on all devices. Which change eliminates this problem?

    1. Implement WPA Enterprise with 802.1X and RADIUS
    2. Hide the SSID
    3. Switch to WPA3-Personal with a 20-character passphrase
    4. Enable MAC address filtering
    Show the answer

    Answer: A. Enterprise mode authenticates each user or device individually against a RADIUS server, so one account can be revoked without affecting anyone else. Personal mode shares one passphrase regardless of WPA version.

    From the lesson Wireless and Mobile Security.

13. A single development practice defeats SQL injection, cross-site scripting, buffer overflows, and directory traversal. Which practice is it?

    1. Code signing
    2. Server-side input validation
    3. Sandboxing
    4. Secure cookies
    Show the answer

    Answer: B. Validating every input on the server for type, length, format, and range stops malicious input before it reaches a query, a page, a buffer, or a file path. Client-side validation alone is bypassed by attackers.

    From the lesson Application Security and Sandboxing.

14. A network scan identifies six active devices that do not appear in the organization's asset records. Which asset management activity produced this finding?

    1. Classification
    2. Sanitization
    3. Enumeration
    4. Procurement
    Show the answer

    Answer: C. Enumeration actively discovers what is really on the network and compares it to the inventory; the difference is the set of unknown assets. Inventory alone is only what the organization believes it has.

    From the lesson Asset Management.

15. A security team wants the most accurate report of missing patches and installed software on its servers. Which scanning approach should be used?

    1. Non-credentialed scan from outside the network
    2. Dynamic application analysis
    3. Passive threat feed subscription
    4. Credentialed scan using an account on each server
    Show the answer

    Answer: D. A credentialed scan logs into the system and sees installed software, patch levels, and configuration directly, producing fewer false positives than a non-credentialed scan that sees only exposed services.

    From the lesson Finding Vulnerabilities.

16. A vulnerability scanner reports a critical flaw in a web server version, but the administrator confirms the server runs a different, patched version. What is this finding called?

    1. False positive
    2. False negative
    3. Zero-day
    4. Exception
    Show the answer

    Answer: A. A false positive is a reported vulnerability that does not actually exist. A false negative is a real vulnerability the scanner missed, which is the more dangerous error.

    From the lesson Analyzing, Responding, Validating, and Reporting.

17. A document states: "All company laptops must use AES-256 full-disk encryption and TLS 1.2 or higher for all connections." Which type of governance document is this?

    1. Policy
    2. Procedure
    3. Standard
    4. Guideline
    Show the answer

    Answer: C. A standard specifies exact, mandatory requirements that implement a policy, such as named algorithms and versions. A policy states what must be done at a high level without the specific settings.

    From the lesson Policies, Standards, Procedures, and Guidelines.

18. A company uses a cloud payroll service that processes employee data strictly according to the company's instructions. In privacy terms, which roles do the company and the service hold?

    1. Company is the processor; service is the controller
    2. Company is the custodian; service is the owner
    3. Both are data subjects
    4. Company is the controller; service is the processor
    Show the answer

    Answer: D. The controller decides why and how personal data is processed, and the processor acts on the controller's instructions. The employees are the data subjects.

    From the lesson External Considerations, Governance Structures, and Data Roles.

19. A server is valued at 80,000 and a fire would destroy 50 percent of its value. Fires are expected once every 10 years. What is the annualized loss expectancy?

    1. 4,000
    2. 40,000
    3. 8,000
    4. 400
    Show the answer

    Answer: A. SLE = AV x EF = 80,000 x 0.5 = 40,000. ARO = 1/10 = 0.1. ALE = SLE x ARO = 40,000 x 0.1 = 4,000 per year.

    From the lesson Risk Identification, Assessment, and Analysis.

20. An organization purchases cyber insurance to cover breach response costs. Which risk management strategy is this, and what does it NOT do?

    1. Mitigate; it does not reduce likelihood
    2. Transfer; it does not transfer accountability
    3. Avoid; it does not eliminate the activity
    4. Accept; it does not document the risk
    Show the answer

    Answer: B. Insurance transfers the financial impact of a risk to another party. Accountability to customers and regulators for the outcome remains with the organization.

    From the lesson Risk Register, Tolerance, Strategies, and Business Impact.