Security analyst watching a threat map and shield display in a security operations center
Free practice set · Original questions

All exams/Professional Certifications/CompTIA Security+ (SY0-701)/Free questions

Free CompTIA Security+ (SY0-701) practice questions

Tap an answer to see if you are right, and why. 20 questions across 5 topics, mostly Operations (7).

Start the set Take a timed mock exam
Passing score: 83% (target)
Format: SY0-701
Bank: 300 Qs (20 free)
100% Sourced explanations

Questions last updated October 15, 2026 · Questions written from the published CompTIA Security+ SY0-701 exam objectives; not official or recalled CompTIA items.

0 of 20 answeredTap an answer to check it

  1. Operations1 of 20

    A security team is implementing a vulnerability management program. Which step should immediately follow vulnerability scanning?

    The answer

    Answer: C. After scanning, the next step is risk prioritization to determine which vulnerabilities to address first based on severity, exploitability, and business impact. Immediate patching without prioritization may cause operational issues, and training should occur before scanning begins.

    Source: CompTIA Security+ SY0-701 — 3.4 Vulnerability Management

  2. Operations2 of 20

    A system administrator needs to remove sensitive data from a decommissioned hard drive. Which method provides the MOST secure data destruction?

    The answer

    Answer: D. Degaussing destroys the magnetic field on the drive making data unrecoverable, and physical destruction ensures the platters cannot be accessed. While overwriting provides some assurance, degaussing combined with physical destruction is the most secure method for highly sensitive data.

    Source: CompTIA Security+ SY0-701 — 3.6 Data Destruction and Sanitization

  3. Architecture3 of 20

    A company wants to implement redundancy for its critical web servers. Which architecture provides automatic failover if one server becomes unavailable?

    The answer

    Answer: B. Load balancing with active-passive clustering provides automatic failover by routing traffic to a standby server when the active server becomes unavailable. RAID protects against disk failures, CDN caching improves performance, and snapshots facilitate recovery but do not provide automatic failover.

    Source: CompTIA Security+ SY0-701 — 2.1 High Availability Concepts

  4. Architecture4 of 20

    A network architect is designing a segmented network for a hospital. Patient record servers must be isolated from guest Wi-Fi. Which architecture model BEST achieves this?

    The answer

    Answer: C. Zero-trust architecture with micro-segmentation provides granular isolation between network segments, ensuring patient record servers are completely separated from guest Wi-Fi. A flat network with VLAN tagging offers less isolation, a single DMZ is inappropriate, and a three-tier architecture with ACLs may not provide sufficient segmentation.

    Source: CompTIA Security+ SY0-701 — 2.1 Secure Network Architecture

  5. Threats5 of 20

    A user unknowingly installs a program that displays unwanted advertisements and tracks browsing habits to deliver targeted pop-ups. Which type of malware is this?

    The answer

    Answer: D. Adware automatically displays or downloads advertising material and may track browsing habits to deliver targeted ads. Fileless malware operates in memory, worms self-replicate across networks, and keyloggers record keystrokes to steal credentials.

    Source: CompTIA Security+ SY0-701 — 1.1 Malware Types

  6. Compliance6 of 20

    A company is implementing an information security management system. Which framework provides a certifiable, systematic approach to managing sensitive company information?

    The answer

    Answer: A. ISO/IEC 27001 provides a certifiable, systematic framework for establishing, implementing, maintaining, and continually improving an information security management system. NIST CSF offers guidelines, CIS provides prioritized controls, and COBIT focuses on IT governance.

    Source: CompTIA Security+ SY0-701 — 5.2 Security Frameworks and Controls

  8. Operations7 of 20

    A security analyst is performing a vulnerability assessment on a web server. Which tool would BEST identify misconfigurations in the server settings?

    The answer

    Answer: C. A web application vulnerability scanner is designed to identify misconfigurations and vulnerabilities in web server settings and applications. Nmap scans network hosts and ports, password crackers test authentication strength, and packet analyzers examine network traffic.

    Source: CompTIA Security+ SY0-701 — 3.4 Vulnerability Assessment Tools

  9. Threats8 of 20

    A security researcher discovers a previously unknown vulnerability in a widely used operating system before the vendor has released a patch. What type of vulnerability is this?

    The answer

    Answer: A. A zero-day vulnerability is a previously unknown flaw discovered before the vendor releases a fix, giving attackers an opportunity to exploit it. Legacy vulnerabilities are old and known, configuration weaknesses are setup errors, and design flaws are architectural issues.

    Source: CompTIA Security+ SY0-701 — 1.1 Vulnerability Types

  10. Operations9 of 20

    A security analyst notices unusual outbound traffic from a server at 3:00 AM using an uncommon port and encrypted protocol. What type of indicator is this?

    The answer

    Answer: B. An indicator of attack (IoA) describes the behavior and intent of an active threat rather than just a forensic artifact left behind. IoCs are forensic artifacts like malware hashes, false positives are erroneous alerts, and baseline deviations are statistical observations.

    Source: CompTIA Security+ SY0-701 — 3.1 Indicators of Compromise

  11. Architecture10 of 20

    A developer is building a web application that processes user input. Which coding practice BEST prevents command injection vulnerabilities?

    The answer

    Answer: D. Input validation and parameterized queries prevent command injection by ensuring user input is treated as data rather than executable code. While encryption, HTTPS, and client-side validation improve security, they do not prevent injection attacks at the application layer.

    Source: CompTIA Security+ SY0-701 — 2.4 Secure Coding Practices

  12. Operations11 of 20

    A company is implementing a patch management process. Which approach ensures patches are tested before full deployment to production?

    The answer

    Answer: B. A phased rollout starting with a pilot group allows patches to be tested in a controlled environment before broader deployment, reducing the risk of widespread operational disruption. Simultaneous deployment is risky, and ignoring non-critical patches leaves security gaps.

    Source: CompTIA Security+ SY0-701 — 3.4 Patch Management

  13. Operations12 of 20

    A security team is investigating a malware infection on a workstation. Which step should they perform FIRST to preserve forensic evidence?

    The answer

    Answer: D. Documenting the system state and creating a forensic disk image preserves volatile and non-volatile evidence before any changes are made. Disconnecting may alert the attacker, running antivirus could alter evidence, and reinstalling destroys all forensic data needed for investigation.

    Source: CompTIA Security+ SY0-701 — 3.3 Digital Forensics

  14. Architecture13 of 20

    A company wants to allow remote employees to access internal resources without exposing the entire network. Which solution provides the MOST granular access control?

    The answer

    Answer: C. A software-defined perimeter (SDP) with single-packet authorization provides zero-trust access, hiding resources and granting access only after authentication. This offers more granular control than traditional VPNs, which grant broader network access, or RDP gateways, which are limited to specific applications.

    Source: CompTIA Security+ SY0-701 — 2.3 Secure Access Solutions

  15. Threats14 of 20

    An attacker exploits a web application by inserting malicious SQL commands into a search field to extract database contents. What type of vulnerability is being exploited?

    The answer

    Answer: A. SQL injection occurs when an attacker inserts malicious SQL commands into input fields, manipulating database queries to extract or modify data. XSS injects client-side scripts, SSRF makes requests from the server, and IDOR accesses unauthorized resources.

    Source: CompTIA Security+ SY0-701 — 1.4 Application Attacks

  16. Program management15 of 20

    An organization needs to classify data to ensure appropriate protection. Which classification level is assigned to data whose disclosure could cause severe damage?

    The answer

    Answer: A. Restricted classification is assigned to highly sensitive data whose disclosure could cause severe damage, such as trade secrets or critical security information. Confidential data causes moderate damage, internal data is for general employee use, and public data has no restrictions.

    Source: CompTIA Security+ SY0-701 — 5.1 Data Classification Concepts

  17. Program management16 of 20

    An organization is implementing a vendor risk management program. Which assessment type evaluates a vendor's compliance with security standards?

    The answer

    Answer: A. Security questionnaires and documentation reviews assess vendor compliance with security standards and policies. Technical vulnerability assessments find specific weaknesses, penetration tests actively exploit systems, and business impact analyses evaluate operational effects rather than compliance.

    Source: CompTIA Security+ SY0-701 — 5.4 Risk Mitigation Strategies

  19. Threats17 of 20

    An attacker uses a list of username and password pairs obtained from a previous data breach to attempt access to a company's cloud services. Which type of attack is this?

    The answer

    Answer: C. Credential stuffing uses username and password pairs stolen from one breach to attempt access on other systems, exploiting password reuse. Privilege escalation elevates permissions, session hijacking steals active sessions, and pass-the-hash uses captured password hashes.

    Source: CompTIA Security+ SY0-701 — 1.3 Identity-Based Attacks

  20. Operations18 of 20

    A SOC analyst is configuring a SIEM to detect brute-force attacks. Which log event correlation rule would be MOST effective?

    The answer

    Answer: D. Monitoring for multiple failed login attempts within a short timeframe is the classic detection method for brute-force attacks. While geographic anomalies and password changes are suspicious, they do not directly indicate brute-force activity like repeated authentication failures do.

    Source: CompTIA Security+ SY0-701 — 3.1 Security Monitoring

  21. Program management19 of 20

    An organization is implementing a new security policy requiring strong passwords. Which policy component defines the minimum password complexity requirements?

    The answer

    Answer: B. A Password Policy specifically defines password requirements such as minimum length, complexity, expiration, and history. An AUP covers general IT usage, a Data Classification Policy defines data handling, and a Remote Access Policy governs remote connection methods.

    Source: CompTIA Security+ SY0-701 — 5.1 Governance Policies

  22. Threats20 of 20

    A security analyst discovers a phishing email targeting employees with a link to a credential-harvesting site. Which technical control would BEST prevent users from accessing this site?

    The answer

    Answer: D. A web content filter that blocks known malicious URLs is the most direct technical control for preventing access to credential-harvesting sites. While MFA, training, and sandboxing are valuable, they do not directly block access to a specific malicious URL at the network level.

    Source: CompTIA Security+ SY0-701 — 1.2 Threat Actors and Attack Vectors

Official Test Specs & Sourced Summary

The official CompTIA Security+ (SY0-701) knowledge examination covers SY0-701 with a passing threshold of 83%. Questions written from the published CompTIA Security+ SY0-701 exam objectives; not official or recalled CompTIA items. Every question on this page is original, with an explanation and a note citing its source.

Passing Score83% target
FormatSY0-701 · maximum of 90 items
Question Bank300 questions (20 free)
Verified SourceCompTIA Security+ (SY0-701, V7) exam domains and weights

That’s the free set. The full bank has 300.

More original practice questions across the listed topics, a 90-question timed exam simulator, and saved mistake review. Internal QuizCram practice target. CompTIA scores Security+ as a scaled 750 on a 100–900 scale, which is not a raw percentage and cannot be converted into one. One payment of $19.99, yours forever.

Practice the free set