CompTIA Security+ (SY0-701) practice quiz

Question 1

A security team is implementing a vulnerability management program. Which step should immediately follow vulnerability scanning?

Accepted Answer

Risk prioritization and remediation planning

Answer

Patching all systems immediately

Answer

Acquiring new vulnerability scanning tools

Answer

Training staff on using the scanning software

Question 2

An organization is implementing a vendor risk management program. Which assessment type evaluates a vendor's compliance with security standards?

Accepted Answer

Security questionnaire and documentation review

Answer

Business impact analysis of the services that the vendor provides to us

Answer

Penetration test of vendor systems

Answer

Technical vulnerability assessment of the vendor's network by a scanner

Question 3

A security analyst discovers a phishing email targeting employees with a link to a credential-harvesting site. Which technical control would BEST prevent users from accessing this site?

Accepted Answer

Implement a web content filter with known malicious URL categories

Answer

Enable email attachment sandboxing on the mail gateway

Answer

Require all users to complete quarterly security awareness training

Answer

Enforce multi-factor authentication on all web applications

Question 4

A company processes credit card payments and must comply with PCI DSS. Which requirement addresses the need to regularly test security systems and processes?

Accepted Answer

Regularly test security systems and processes

Answer

Maintain an information security policy

Answer

Install and maintain network security controls

Answer

Restrict access to cardholder data by business need-to-know

Question 5

A security team is implementing a SIEM system. Which capability is essential for identifying advanced persistent threats that evade signature-based detection?

Accepted Answer

User behavior analytics and anomaly detection

Answer

Automated vulnerability scanning

Answer

Network bandwidth monitoring

Answer

Real-time log collection and storage

Question 6

A company's backup server was compromised during a ransomware attack and the backups are now encrypted by the attacker. What is the MOST reliable step to recover?

Accepted Answer

Restore systems from offsite, immutable backups

Answer

Attempt to decrypt the backups using available tools

Answer

Rebuild all systems from scratch using installation media

Answer

Pay the ransom to obtain the decryption key

Question 7

A security team is conducting a risk assessment for a new application. Which factor determines the asset value used in the risk calculation?

Accepted Answer

The application's criticality to business operations

Answer

The frequency of security patches released by the vendor

Answer

The number of known vulnerabilities in the code

Answer

The cost to develop the application

Question 8

A penetration tester uses a tool that systematically tries all possible combinations of characters to crack a password hash. Which attack type is this?

Accepted Answer

Brute-force attack

Answer

Dictionary attack

Answer

Rainbow table attack

Answer

Password spraying

Question 9

A security analyst discovers malware that uses polymorphic techniques to change its code signature each time it replicates. Why is this malware particularly difficult for antivirus tools to detect?

Accepted Answer

Its constantly changing signatures defeat signature-based detection

Answer

It exploits zero-day kernel vulnerabilities exclusively

Answer

It encrypts all of the files on the host and demands a payment

Answer

It operates entirely in volatile memory without touching disk

Question 10

An attacker sends a carefully crafted email to a financial controller that references an ongoing real project and includes a malicious macro-enabled attachment. Which social engineering concept does this best illustrate?

Accepted Answer

Spear phishing with contextual research

Answer

Watering hole attack on a site that the victim often visits

Answer

Typosquatting

Answer

Ransomware as a service (RaaS) sold on a criminal marketplace

Question 11

A red team operator finds that an organization has not trained employees on vishing attacks. Which scenario would most effectively test resilience against this gap?

Accepted Answer

Calling employees and impersonating a bank fraud department

Answer

Sending a phishing email with a credential-harvesting link to the staff

Answer

Performing an external network scan of the company's address range

Answer

Dropping infected USB drives in the parking lot of the company

Question 12

An incident response team identifies ransomware that not only encrypts data but also threatens to publish stolen files on a public leak site unless the ransom is paid. What ransomware trend does this represent?

Accepted Answer

Double extortion

Answer

Ransomware as a service (RaaS)

Answer

Fileless ransomware

Answer

Wiper malware

Question 13

A PKI administrator is generating a new key pair for the organization root certificate authority. Which algorithm and key size provides the strongest asymmetric encryption for this trust anchor?

Accepted Answer

RSA 4096-bit

Answer

RSA 2048-bit

Answer

Diffie-Hellman 512-bit

Answer

DES 56-bit

Question 14

An organization implements a hardware security module to securely generate and store cryptographic keys. Which PKI lifecycle function does the HSM primarily support?

Accepted Answer

Key generation and storage

Answer

Certificate enrollment, in which a subject requests a certificate

Answer

Certificate renewal, in which an expiring certificate is replaced

Answer

Certificate revocation

Question 15

A company needs to protect email confidentiality and ensure the recipient can verify the senders identity. Which combination of cryptographic techniques achieves both goals?

Accepted Answer

Asymmetric encryption of the message with the recipients public key plus a digital signature using the senders private key

Answer

Symmetric encryption of the message with a shared key only

Answer

Encrypting the email transport with TLS between the mail servers

Answer

Hashing the message with SHA-512 and sending the digest separately

Question 16

A security architect implements an authentication system that requires users to provide a password, a hardware token, and a fingerprint scan. Which authentication factor types are combined in this solution?

Accepted Answer

Something you know, something you have, and something you are

Answer

Something you know and something you are only, with no token

Answer

Three instances of something you know, such as three passwords

Answer

Something you have and something you are only, with no password

Question 17

A company implements single sign-on using SAML 2.0 so employees authenticate once with their corporate credentials and then access multiple partner applications. What is the primary security benefit of this approach?

Accepted Answer

Reduces password fatigue and credential sprawl by centralizing authentication

Answer

Guarantees that no phishing attack can ever steal the credentials

Answer

Eliminates the need for encryption of the traffic between the sites

Answer

Provides automatic patch management for all of the integrated applications

Question 18

An organization disables all protocol-based password authentication for administrative accounts and requires all privileged access through a jump server with session recording. Which security principle does this enforce?

Accepted Answer

Privileged access management with full audit trail

Answer

Network address translation for administrative access

Answer

Load balancing across authentication servers

Answer

Defense in depth through redundant authentication

Question 19

A SOC team deploys a network sensor that compares observed traffic patterns against known attack signatures and raises alerts when matches are found. Which type of detection system is this?

Accepted Answer

Signature-based intrusion detection system

Answer

Anomaly-based intrusion detection system

Answer

Host-based intrusion prevention system

Answer

Security information and event management (SIEM)

Question 20

An IDS generates an alert indicating a potential buffer overflow attack against a web server. Upon investigation, the analyst finds the traffic was legitimate user input that triggered a false rule. What should be done first?

Accepted Answer

Tune the IDS signature to reduce false positives for this traffic pattern

Answer

Immediately disconnect the web server from the network and investigate

Answer

Delete the IDS signature entirely to stop the alert from reappearing

Answer

Report the user for malicious activity to the human resources department

Question 21

A company segments its network into separate VLANs for guest Wi-Fi, employee workstations, and the payment processing environment. Which security principle does this segmentation BEST enforce?

Accepted Answer

Network isolation to limit the blast radius of a breach

Answer

Unified threat management to combine the tools in one device

Answer

Bandwidth throttling for quality of service

Answer

Network address translation for the conservation of IP addresses

Question 22

What is an indicator of compromise (IoC)?

Accepted Answer

Evidence that a system has been breached

Answer

A backup schedule

Answer

A type of firewall

Answer

A security policy that lists the rules for the employees

Question 23

What does a zero-day vulnerability refer to?

Accepted Answer

A vulnerability with no available patch that is being exploited

Answer

A vulnerability that is fixed on the same day it is reported

Answer

A hardware defect that is found within the first day of use

Answer

A low-severity flaw that has no effect on the system

Question 24

What is the purpose of a Web Application Firewall (WAF)?

Accepted Answer

To protect web applications from attacks such as SQL injection and XSS

Answer

To route email between the mail servers of the company

Answer

To terminate the cables in the patch panel of the closet

Answer

To assign IP addresses to the hosts on the network

Question 25

What is the principle of least privilege?

Accepted Answer

Granting users only the access they need to perform their job

Answer

Granting all users full access to the system to avoid delays

Answer

Sharing one admin account among the whole team

Answer

Disabling all access until the user requests it

Question 26

What is chain of custody?

Accepted Answer

Documentation that tracks evidence handling from collection to court

Answer

A list of the incident team members and their phone numbers

Answer

A backup schedule for the servers in the data center

Answer

A network diagram showing the devices and the links

Question 27

What does a Business Impact Analysis (BIA) determine?

Accepted Answer

The criticality of systems and impact of disruption

Answer

Which users to disable

Answer

How to encrypt data

Answer

The network topology of the company's main office

Question 28

What is a cloud access security broker (CASB)?

Accepted Answer

A security policy enforcement point between users and cloud services

Answer

A backup service for the data in the cloud

Answer

A certificate authority that issues the cloud certificates

Answer

A type of firewall hardware placed at the network edge

Question 29

A group defaces a government website and posts a political message to draw attention to a social cause rather than to make money. Which type of threat actor is MOST likely responsible?

Accepted Answer

Hacktivist

Answer

Unskilled attacker

Answer

Nation-state actor

Answer

Organized crime group

Question 30

A security team documents identified risks, their likelihood, impact, owners, and planned responses in one living record that is reviewed regularly. What is this document called?

Accepted Answer

Risk register

Answer

Change request log

Answer

Vulnerability report

Answer

Acceptable use policy

Question 31

An organization must prepare a solid-state drive for reuse within the company so that data cannot be recovered with normal tools. Which sanitization method is MOST appropriate?

Accepted Answer

Cryptographic erasure or a vendor-sanctioned secure erase

Answer

Overwriting with a single pass of zeros across the drive

Answer

Quick formatting the volume of the drive before the reuse

Answer

Degaussing the drive with a strong magnetic field

Question 32

An employee receives a suspicious email asking them to open an attachment to update their benefits enrollment. What should security awareness training instruct the employee to do?

Accepted Answer

Report the message through the organization's phishing reporting channel without opening it

Answer

Reply to the sender and ask for confirmation that the benefits message is genuine

Answer

Delete the message from the inbox without telling anyone in the security team about it

Answer

Forward the message to coworkers for a second opinion

Question 33

An employee uses a corporate workstation to stream movies and download pirated software. Which policy document has the employee MOST directly violated?

Accepted Answer

Acceptable Use Policy (AUP)

Answer

Password policy

Answer

Data classification policy

Answer

Change management policy

Question 34

To survive a data center outage, an organization deploys identical application instances in two separate geographic regions with traffic rerouted automatically between them. Which high availability concept does this describe?

Accepted Answer

Geographic redundancy

Answer

A single fault-tolerant server

Answer

A cold backup site

Answer

Local RAID mirroring

Question 35

An organization uses a tool that continuously checks its cloud accounts against a security baseline and flags misconfigured storage buckets and excessive permissions. Which tool is this?

Accepted Answer

A cloud security posture management (CSPM) solution

Answer

A security information and event management (SIEM) system for the logs

Answer

A web application firewall

Answer

A network tap

Question 36

Changing a single character in a large document causes its cryptographic hash to differ completely from the original. Which property of hashing does this illustrate?

Accepted Answer

The avalanche effect

Answer

Symmetric encryption

Answer

Key exchange

Answer

Reversible compression

Question 37

After an alert fires, the response team is determining the scope, impact, and severity of the event to decide whether it constitutes a true incident. Which incident response phase is this?

Accepted Answer

Detection and analysis

Answer

Post-incident activity

Answer

Preparation

Answer

Containment, eradication, and recovery

Question 38

Which of the following is an example of a technical security control?

Accepted Answer

Encryption of data at rest

Answer

Security awareness training

Answer

Background checks for new hires

Answer

An acceptable use policy

Question 39

Which data classification label is appropriate for information that the organization intends to release to the general public with no confidentiality requirement?

Accepted Answer

Public

Answer

Internal

Answer

Confidential

Answer

Restricted

Question 40

What is the primary purpose of a certificate authority's digital signature on an issued certificate?

Accepted Answer

To bind the subject's identity to its public key

Answer

To encrypt the certificate contents

Answer

To revoke expired certificates

Answer

To store the subject's private key