All exams/CompTIA Security+ (SY0-701)/Free questions
CompTIA Security+ (SY0-701) practice questions and answers
20 free questions from our 300-question CompTIA Security+ (SY0-701) bank, each with the correct answer, explanation, and source note. Official format: SY0-701 · maximum of 90 items · 90-minute limit · 750/900 to pass.
Operations
1. A security team is implementing a vulnerability management program. Which step should immediately follow vulnerability scanning?
Answer: C. The keyed answer is "Risk prioritization and remediation planning". After scanning, the next step is risk prioritization to determine which vulnerabilities to address first based on severity, exploitability, and business impact. Immediate patching without prioritization may cause operational issues, and training should occur before scanning begins. This item tests operations in the context of CompTIA Security+ SY0-701 — 3.4 Vulnerability Management. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.
Source: CompTIA Security+ SY0-701 — 3.4 Vulnerability Management
Operations
2. A system administrator needs to remove sensitive data from a decommissioned hard drive. Which method provides the MOST secure data destruction?
Answer: D. The keyed answer is "Degaussing followed by physical destruction". Degaussing destroys the magnetic field on the drive making data unrecoverable, and physical destruction ensures the platters cannot be accessed. While overwriting provides some assurance, degaussing combined with physical destruction is the most secure method for highly sensitive data. This item tests operations in the context of CompTIA Security+ SY0-701 — 3.6 Data Destruction and Sanitization. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.
Source: CompTIA Security+ SY0-701 — 3.6 Data Destruction and Sanitization
Architecture
3. A company wants to implement redundancy for its critical web servers. Which architecture provides automatic failover if one server becomes unavailable?
Answer: B. Load balancing with active-passive clustering provides automatic failover by routing traffic to a standby server when the active server becomes unavailable. RAID protects against disk failures, CDN caching improves performance, and snapshots facilitate recovery but do not provide automatic failover.
Source: CompTIA Security+ SY0-701 — 2.1 High Availability Concepts
Architecture
4. A network architect is designing a segmented network for a hospital. Patient record servers must be isolated from guest Wi-Fi. Which architecture model BEST achieves this?
Answer: A. Zero-trust architecture with micro-segmentation provides granular isolation between network segments, ensuring patient record servers are completely separated from guest Wi-Fi. A flat network with VLAN tagging offers less isolation, a single DMZ is inappropriate, and a three-tier architecture with ACLs may not provide sufficient segmentation.
Source: CompTIA Security+ SY0-701 — 2.1 Secure Network Architecture
Threats
5. A user unknowingly installs a program that displays unwanted advertisements and tracks browsing habits to deliver targeted pop-ups. Which type of malware is this?
Answer: A. The keyed answer is "Adware". Adware automatically displays or downloads advertising material and may track browsing habits to deliver targeted ads. Fileless malware operates in memory, worms self-replicate across networks, and keyloggers record keystrokes to steal credentials. This item tests threats in the context of CompTIA Security+ SY0-701 — 1.1 Malware Types. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.
Source: CompTIA Security+ SY0-701 — 1.1 Malware Types
Compliance
6. A company is implementing an information security management system. Which framework provides a certifiable, systematic approach to managing sensitive company information?
Answer: C. The keyed answer is "ISO/IEC 27001". ISO/IEC 27001 provides a certifiable, systematic framework for establishing, implementing, maintaining, and continually improving an information security management system. NIST CSF offers guidelines, CIS provides prioritized controls, and COBIT focuses on IT governance. This item tests compliance in the context of CompTIA Security+ SY0-701 — 5.2 Security Frameworks and Controls. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.
Source: CompTIA Security+ SY0-701 — 5.2 Security Frameworks and Controls
Operations
7. A security analyst is performing a vulnerability assessment on a web server. Which tool would BEST identify misconfigurations in the server settings?
Answer: B. The keyed answer is "Web application vulnerability scanner". A web application vulnerability scanner is designed to identify misconfigurations and vulnerabilities in web server settings and applications. Nmap scans network hosts and ports, password crackers test authentication strength, and packet analyzers examine network traffic. This item tests operations in the context of CompTIA Security+ SY0-701 — 3.4 Vulnerability Assessment Tools. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.
Source: CompTIA Security+ SY0-701 — 3.4 Vulnerability Assessment Tools
Threats
8. A security researcher discovers a previously unknown vulnerability in a widely used operating system before the vendor has released a patch. What type of vulnerability is this?
Answer: D. The keyed answer is "Zero-day vulnerability". A zero-day vulnerability is a previously unknown flaw discovered before the vendor releases a fix, giving attackers an opportunity to exploit it. Legacy vulnerabilities are old and known, configuration weaknesses are setup errors, and design flaws are architectural issues. This item tests threats in the context of CompTIA Security+ SY0-701 — 1.1 Vulnerability Types. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.
Source: CompTIA Security+ SY0-701 — 1.1 Vulnerability Types
Operations
9. A security analyst notices unusual outbound traffic from a server at 3:00 AM using an uncommon port and encrypted protocol. What type of indicator is this?
Answer: A. An indicator of attack (IoA) describes the behavior and intent of an active threat rather than just a forensic artifact left behind. IoCs are forensic artifacts like malware hashes, false positives are erroneous alerts, and baseline deviations are statistical observations.
Source: CompTIA Security+ SY0-701 — 3.1 Indicators of Compromise
Architecture
10. A developer is building a web application that processes user input. Which coding practice BEST prevents command injection vulnerabilities?
Answer: D. The keyed answer is "Implementing input validation and parameterized queries". Input validation and parameterized queries prevent command injection by ensuring user input is treated as data rather than executable code. While encryption, HTTPS, and client-side validation improve security, they do not prevent injection attacks at the application layer. This item tests architecture in the context of CompTIA Security+ SY0-701 — 2.4 Secure Coding Practices. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.
Source: CompTIA Security+ SY0-701 — 2.4 Secure Coding Practices
Operations
11. A company is implementing a patch management process. Which approach ensures patches are tested before full deployment to production?
Answer: D. The keyed answer is "Use a phased rollout starting with a pilot group". A phased rollout starting with a pilot group allows patches to be tested in a controlled environment before broader deployment, reducing the risk of widespread operational disruption. Simultaneous deployment is risky, and ignoring non-critical patches leaves security gaps. This item tests operations in the context of CompTIA Security+ SY0-701 — 3.4 Patch Management. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.
Source: CompTIA Security+ SY0-701 — 3.4 Patch Management
Operations
12. A security team is investigating a malware infection on a workstation. Which step should they perform FIRST to preserve forensic evidence?
Answer: C. The keyed answer is "Document the system state and create a forensic disk image". Documenting the system state and creating a forensic disk image preserves volatile and non-volatile evidence before any changes are made. Disconnecting may alert the attacker, running antivirus could alter evidence, and reinstalling destroys all forensic data needed for investigation. This item tests operations in the context of CompTIA Security+ SY0-701 — 3.3 Digital Forensics. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.
Source: CompTIA Security+ SY0-701 — 3.3 Digital Forensics
Architecture
13. A company wants to allow remote employees to access internal resources without exposing the entire network. Which solution provides the MOST granular access control?
Answer: A. A software-defined perimeter (SDP) with single-packet authorization provides zero-trust access, hiding resources and granting access only after authentication. This offers more granular control than traditional VPNs, which grant broader network access, or RDP gateways, which are limited to specific applications.
Source: CompTIA Security+ SY0-701 — 2.3 Secure Access Solutions
Threats
14. An attacker exploits a web application by inserting malicious SQL commands into a search field to extract database contents. What type of vulnerability is being exploited?
Answer: C. The keyed answer is "SQL injection". SQL injection occurs when an attacker inserts malicious SQL commands into input fields, manipulating database queries to extract or modify data. XSS injects client-side scripts, SSRF makes requests from the server, and IDOR accesses unauthorized resources. This item tests threats in the context of CompTIA Security+ SY0-701 — 1.4 Application Attacks. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.
Source: CompTIA Security+ SY0-701 — 1.4 Application Attacks
Program management
15. An organization needs to classify data to ensure appropriate protection. Which classification level is assigned to data whose disclosure could cause severe damage?
Answer: B. Restricted classification is assigned to highly sensitive data whose disclosure could cause severe damage, such as trade secrets or critical security information. Confidential data causes moderate damage, internal data is for general employee use, and public data has no restrictions.
Source: CompTIA Security+ SY0-701 — 5.1 Data Classification Concepts
Program management
16. An organization is implementing a vendor risk management program. Which assessment type evaluates a vendor's compliance with security standards?
Answer: B. The keyed answer is "Security questionnaire and documentation review". Security questionnaires and documentation reviews assess vendor compliance with security standards and policies. Technical vulnerability assessments find specific weaknesses, penetration tests actively exploit systems, and business impact analyses evaluate operational effects rather than compliance. This item tests program_management in the context of CompTIA Security+ SY0-701 — 5.4 Risk Mitigation Strategies. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.
Source: CompTIA Security+ SY0-701 — 5.4 Risk Mitigation Strategies
Threats
17. An attacker uses a list of username and password pairs obtained from a previous data breach to attempt access to a company's cloud services. Which type of attack is this?
Answer: A. The keyed answer is "Credential stuffing". Credential stuffing uses username and password pairs stolen from one breach to attempt access on other systems, exploiting password reuse. Privilege escalation elevates permissions, session hijacking steals active sessions, and pass-the-hash uses captured password hashes. This item tests threats in the context of CompTIA Security+ SY0-701 — 1.3 Identity-Based Attacks. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.
Source: CompTIA Security+ SY0-701 — 1.3 Identity-Based Attacks
Operations
18. A SOC analyst is configuring a SIEM to detect brute-force attacks. Which log event correlation rule would be MOST effective?
Answer: D. The keyed answer is "Alert when a single account has more than 10 failed logins within 5 minutes". Monitoring for multiple failed login attempts within a short timeframe is the classic detection method for brute-force attacks. While geographic anomalies and password changes are suspicious, they do not directly indicate brute-force activity like repeated authentication failures do. This item tests operations in the context of CompTIA Security+ SY0-701 — 3.1 Security Monitoring. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.
Source: CompTIA Security+ SY0-701 — 3.1 Security Monitoring
Program management
19. An organization is implementing a new security policy requiring strong passwords. Which policy component defines the minimum password complexity requirements?
Answer: D. The keyed answer is "Password Policy". A Password Policy specifically defines password requirements such as minimum length, complexity, expiration, and history. An AUP covers general IT usage, a Data Classification Policy defines data handling, and a Remote Access Policy governs remote connection methods. This item tests program_management in the context of CompTIA Security+ SY0-701 — 5.1 Governance Policies. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.
Source: CompTIA Security+ SY0-701 — 5.1 Governance Policies
Threats
20. A security analyst discovers a phishing email targeting employees with a link to a credential-harvesting site. Which technical control would BEST prevent users from accessing this site?
Answer: B. A web content filter that blocks known malicious URLs is the most direct technical control for preventing access to credential-harvesting sites. While MFA, training, and sandboxing are valuable, they do not directly block access to a specific malicious URL at the network level.
Source: CompTIA Security+ SY0-701 — 1.2 Threat Actors and Attack Vectors
That’s the free set. The full bank has 300.
More original practice questions across the listed topics, a 90-question timed benchmark, and saved mistake review. Internal QuizCram practice target. CompTIA scores Security+ as a scaled 750 on a 100–900 scale, which is not a raw percentage and cannot be converted into one. One payment of $19.99, yours forever.