Security Operations & Incident Response practice test: free CompTIA Security+ (SY0-701) questions

Sample Practice Questions for Security Operations & Incident Response

1. Question 1Ref: CompTIA Security+ SY0-701 — 3.4 Vulnerability Management

   A security team is implementing a vulnerability management program. Which step should immediately follow vulnerability scanning?

   AAcquiring new vulnerability scanning toolsBTraining staff on using the scanning softwareCRisk prioritization and remediation planningDPatching all systems immediately
   Show Answer & Explanation

   Correct Answer
   C. Risk prioritization and remediation planning

   The keyed answer is "Risk prioritization and remediation planning". After scanning, the next step is risk prioritization to determine which vulnerabilities to address first based on severity, exploitability, and business impact. Immediate patching without prioritization may cause operational issues, and training should occur before scanning begins.

2. Question 2Ref: CompTIA Security+ SY0-701 — 3.6 Data Destruction and Sanitization

   A system administrator needs to remove sensitive data from a decommissioned hard drive. Which method provides the MOST secure data destruction?

   AQuick format of the driveBOverwriting with a single pass of zerosCDeleting all partitions and reinstalling the operating systemDDegaussing followed by physical destruction
   Show Answer & Explanation

   Correct Answer
   D. Degaussing followed by physical destruction

   The keyed answer is "Degaussing followed by physical destruction". Degaussing destroys the magnetic field on the drive making data unrecoverable, and physical destruction ensures the platters cannot be accessed. While overwriting provides some assurance, degaussing combined with physical destruction is the most secure method for highly sensitive data.

3. Question 3Ref: CompTIA Security+ SY0-701 — 3.4 Vulnerability Assessment Tools

   A security analyst is performing a vulnerability assessment on a web server. Which tool would BEST identify misconfigurations in the server settings?

   ANetwork mapper (Nmap)BWeb application vulnerability scannerCPassword crackerDPacket analyzer
   Show Answer & Explanation

   Correct Answer
   B. Web application vulnerability scanner

   The keyed answer is "Web application vulnerability scanner". A web application vulnerability scanner is designed to identify misconfigurations and vulnerabilities in web server settings and applications. Nmap scans network hosts and ports, password crackers test authentication strength, and packet analyzers examine network traffic.

4. Question 4Ref: CompTIA Security+ SY0-701 — 3.1 Indicators of Compromise

   A security analyst notices unusual outbound traffic from a server at 3:00 AM using an uncommon port and encrypted protocol. What type of indicator is this?

   AIndicator of attack (IoA)BBaseline deviationCFalse positiveDIndicator of compromise (IoC)
   Show Answer & Explanation

   Correct Answer
   A. Indicator of attack (IoA)

   An indicator of attack (IoA) describes the behavior and intent of an active threat rather than just a forensic artifact left behind. IoCs are forensic artifacts like malware hashes, false positives are erroneous alerts, and baseline deviations are statistical observations.

5. Question 5Ref: CompTIA Security+ SY0-701 — 3.4 Patch Management

   A company is implementing a patch management process. Which approach ensures patches are tested before full deployment to production?

   AApply only critical patches and ignore the restBLet users decide when to install patchesCDeploy patches to all systems simultaneouslyDUse a phased rollout starting with a pilot group
   Show Answer & Explanation

   Correct Answer
   D. Use a phased rollout starting with a pilot group

   The keyed answer is "Use a phased rollout starting with a pilot group". A phased rollout starting with a pilot group allows patches to be tested in a controlled environment before broader deployment, reducing the risk of widespread operational disruption. Simultaneous deployment is risky, and ignoring non-critical patches leaves security gaps.

6. Question 6Ref: CompTIA Security+ SY0-701 — 3.3 Digital Forensics

   A security team is investigating a malware infection on a workstation. Which step should they perform FIRST to preserve forensic evidence?

   ADisconnect the workstation from the network immediatelyBRun a full antivirus scan to remove the malwareCDocument the system state and create a forensic disk imageDReinstall the operating system from clean media
   Show Answer & Explanation

   Correct Answer
   C. Document the system state and create a forensic disk image

   The keyed answer is "Document the system state and create a forensic disk image". Documenting the system state and creating a forensic disk image preserves volatile and non-volatile evidence before any changes are made. Disconnecting may alert the attacker, running antivirus could alter evidence, and reinstalling destroys all forensic data needed for investigation.

7. Question 7Ref: CompTIA Security+ SY0-701 — 3.1 Security Monitoring

   A SOC analyst is configuring a SIEM to detect brute-force attacks. Which log event correlation rule would be MOST effective?

   AAlert when any user changes their passwordBAlert when any user logs in successfullyCAlert when a user logs in from a different countryDAlert when a single account has more than 10 failed logins within 5 minutes
   Show Answer & Explanation

   Correct Answer
   D. Alert when a single account has more than 10 failed logins within 5 minutes

   The keyed answer is "Alert when a single account has more than 10 failed logins within 5 minutes". Monitoring for multiple failed login attempts within a short timeframe is the classic detection method for brute-force attacks. While geographic anomalies and password changes are suspicious, they do not directly indicate brute-force activity like repeated authentication failures do.