All exams/CompTIA Security+ (SY0-701)/Free questions

CompTIA Security+ (SY0-701) practice questions and answers

20 free questions from our 300-question CompTIA Security+ (SY0-701) bank, each with the correct answer, explanation, and source note. Official format: SY0-701 · maximum of 90 items · 90-minute limit · 750/900 to pass.

Questions last updated September 22, 2026 · Questions written from the published CompTIA Security+ SY0-701 exam objectives; not official or recalled CompTIA items.

  1. Operations

    1. A security team is implementing a vulnerability management program. Which step should immediately follow vulnerability scanning?

    1. AAcquiring new vulnerability scanning tools
    2. BTraining staff on using the scanning software
    3. CRisk prioritization and remediation planning
    4. DPatching all systems immediately

    Answer: C. The keyed answer is "Risk prioritization and remediation planning". After scanning, the next step is risk prioritization to determine which vulnerabilities to address first based on severity, exploitability, and business impact. Immediate patching without prioritization may cause operational issues, and training should occur before scanning begins. This item tests operations in the context of CompTIA Security+ SY0-701 — 3.4 Vulnerability Management. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.

    Source: CompTIA Security+ SY0-701 — 3.4 Vulnerability Management

  2. Operations

    2. A system administrator needs to remove sensitive data from a decommissioned hard drive. Which method provides the MOST secure data destruction?

    1. AQuick format of the drive
    2. BOverwriting with a single pass of zeros
    3. CDeleting all partitions and reinstalling the operating system
    4. DDegaussing followed by physical destruction

    Answer: D. The keyed answer is "Degaussing followed by physical destruction". Degaussing destroys the magnetic field on the drive making data unrecoverable, and physical destruction ensures the platters cannot be accessed. While overwriting provides some assurance, degaussing combined with physical destruction is the most secure method for highly sensitive data. This item tests operations in the context of CompTIA Security+ SY0-701 — 3.6 Data Destruction and Sanitization. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.

    Source: CompTIA Security+ SY0-701 — 3.6 Data Destruction and Sanitization

  3. Architecture

    3. A company wants to implement redundancy for its critical web servers. Which architecture provides automatic failover if one server becomes unavailable?

    1. AVirtual machine with snapshots
    2. BLoad balancing with active-passive clustering
    3. CContent delivery network (CDN) caching
    4. DSingle server with RAID storage

    Answer: B. Load balancing with active-passive clustering provides automatic failover by routing traffic to a standby server when the active server becomes unavailable. RAID protects against disk failures, CDN caching improves performance, and snapshots facilitate recovery but do not provide automatic failover.

    Source: CompTIA Security+ SY0-701 — 2.1 High Availability Concepts

  4. Architecture

    4. A network architect is designing a segmented network for a hospital. Patient record servers must be isolated from guest Wi-Fi. Which architecture model BEST achieves this?

    1. ADeploy a zero-trust architecture with micro-segmentation
    2. BConfigure a standard three-tier architecture with ACLs
    3. CUse a single DMZ for all public and internal servers
    4. DImplement a flat network with VLAN tagging

    Answer: A. Zero-trust architecture with micro-segmentation provides granular isolation between network segments, ensuring patient record servers are completely separated from guest Wi-Fi. A flat network with VLAN tagging offers less isolation, a single DMZ is inappropriate, and a three-tier architecture with ACLs may not provide sufficient segmentation.

    Source: CompTIA Security+ SY0-701 — 2.1 Secure Network Architecture

  5. Threats

    5. A user unknowingly installs a program that displays unwanted advertisements and tracks browsing habits to deliver targeted pop-ups. Which type of malware is this?

    1. AAdware
    2. BKeylogger
    3. CFileless malware
    4. DWorm

    Answer: A. The keyed answer is "Adware". Adware automatically displays or downloads advertising material and may track browsing habits to deliver targeted ads. Fileless malware operates in memory, worms self-replicate across networks, and keyloggers record keystrokes to steal credentials. This item tests threats in the context of CompTIA Security+ SY0-701 — 1.1 Malware Types. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.

    Source: CompTIA Security+ SY0-701 — 1.1 Malware Types

  6. Compliance

    6. A company is implementing an information security management system. Which framework provides a certifiable, systematic approach to managing sensitive company information?

    1. ACOBIT
    2. BCIS Controls
    3. CISO/IEC 27001
    4. DNIST Cybersecurity Framework (CSF)

    Answer: C. The keyed answer is "ISO/IEC 27001". ISO/IEC 27001 provides a certifiable, systematic framework for establishing, implementing, maintaining, and continually improving an information security management system. NIST CSF offers guidelines, CIS provides prioritized controls, and COBIT focuses on IT governance. This item tests compliance in the context of CompTIA Security+ SY0-701 — 5.2 Security Frameworks and Controls. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.

    Source: CompTIA Security+ SY0-701 — 5.2 Security Frameworks and Controls

  7. Operations

    7. A security analyst is performing a vulnerability assessment on a web server. Which tool would BEST identify misconfigurations in the server settings?

    1. ANetwork mapper (Nmap)
    2. BWeb application vulnerability scanner
    3. CPassword cracker
    4. DPacket analyzer

    Answer: B. The keyed answer is "Web application vulnerability scanner". A web application vulnerability scanner is designed to identify misconfigurations and vulnerabilities in web server settings and applications. Nmap scans network hosts and ports, password crackers test authentication strength, and packet analyzers examine network traffic. This item tests operations in the context of CompTIA Security+ SY0-701 — 3.4 Vulnerability Assessment Tools. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.

    Source: CompTIA Security+ SY0-701 — 3.4 Vulnerability Assessment Tools

  8. Threats

    8. A security researcher discovers a previously unknown vulnerability in a widely used operating system before the vendor has released a patch. What type of vulnerability is this?

    1. ALegacy vulnerability
    2. BConfiguration weakness
    3. CDesign flaw
    4. DZero-day vulnerability

    Answer: D. The keyed answer is "Zero-day vulnerability". A zero-day vulnerability is a previously unknown flaw discovered before the vendor releases a fix, giving attackers an opportunity to exploit it. Legacy vulnerabilities are old and known, configuration weaknesses are setup errors, and design flaws are architectural issues. This item tests threats in the context of CompTIA Security+ SY0-701 — 1.1 Vulnerability Types. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.

    Source: CompTIA Security+ SY0-701 — 1.1 Vulnerability Types

  9. Operations

    9. A security analyst notices unusual outbound traffic from a server at 3:00 AM using an uncommon port and encrypted protocol. What type of indicator is this?

    1. AIndicator of attack (IoA)
    2. BBaseline deviation
    3. CFalse positive
    4. DIndicator of compromise (IoC)

    Answer: A. An indicator of attack (IoA) describes the behavior and intent of an active threat rather than just a forensic artifact left behind. IoCs are forensic artifacts like malware hashes, false positives are erroneous alerts, and baseline deviations are statistical observations.

    Source: CompTIA Security+ SY0-701 — 3.1 Indicators of Compromise

  10. Architecture

    10. A developer is building a web application that processes user input. Which coding practice BEST prevents command injection vulnerabilities?

    1. AEncrypting all user data before transmission
    2. BImplementing client-side input validation only
    3. CUsing HTTPS for all web traffic
    4. DImplementing input validation and parameterized queries

    Answer: D. The keyed answer is "Implementing input validation and parameterized queries". Input validation and parameterized queries prevent command injection by ensuring user input is treated as data rather than executable code. While encryption, HTTPS, and client-side validation improve security, they do not prevent injection attacks at the application layer. This item tests architecture in the context of CompTIA Security+ SY0-701 — 2.4 Secure Coding Practices. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.

    Source: CompTIA Security+ SY0-701 — 2.4 Secure Coding Practices

  11. Operations

    11. A company is implementing a patch management process. Which approach ensures patches are tested before full deployment to production?

    1. AApply only critical patches and ignore the rest
    2. BLet users decide when to install patches
    3. CDeploy patches to all systems simultaneously
    4. DUse a phased rollout starting with a pilot group

    Answer: D. The keyed answer is "Use a phased rollout starting with a pilot group". A phased rollout starting with a pilot group allows patches to be tested in a controlled environment before broader deployment, reducing the risk of widespread operational disruption. Simultaneous deployment is risky, and ignoring non-critical patches leaves security gaps. This item tests operations in the context of CompTIA Security+ SY0-701 — 3.4 Patch Management. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.

    Source: CompTIA Security+ SY0-701 — 3.4 Patch Management

  12. Operations

    12. A security team is investigating a malware infection on a workstation. Which step should they perform FIRST to preserve forensic evidence?

    1. ADisconnect the workstation from the network immediately
    2. BRun a full antivirus scan to remove the malware
    3. CDocument the system state and create a forensic disk image
    4. DReinstall the operating system from clean media

    Answer: C. The keyed answer is "Document the system state and create a forensic disk image". Documenting the system state and creating a forensic disk image preserves volatile and non-volatile evidence before any changes are made. Disconnecting may alert the attacker, running antivirus could alter evidence, and reinstalling destroys all forensic data needed for investigation. This item tests operations in the context of CompTIA Security+ SY0-701 — 3.3 Digital Forensics. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.

    Source: CompTIA Security+ SY0-701 — 3.3 Digital Forensics

  13. Architecture

    13. A company wants to allow remote employees to access internal resources without exposing the entire network. Which solution provides the MOST granular access control?

    1. ASoftware-defined perimeter (SDP) with single-packet authorization
    2. BTraditional client-to-site VPN with split tunneling
    3. CSite-to-site VPN between branch offices
    4. DRemote Desktop Protocol (RDP) gateway server

    Answer: A. A software-defined perimeter (SDP) with single-packet authorization provides zero-trust access, hiding resources and granting access only after authentication. This offers more granular control than traditional VPNs, which grant broader network access, or RDP gateways, which are limited to specific applications.

    Source: CompTIA Security+ SY0-701 — 2.3 Secure Access Solutions

  14. Threats

    14. An attacker exploits a web application by inserting malicious SQL commands into a search field to extract database contents. What type of vulnerability is being exploited?

    1. AInsecure direct object reference (IDOR)
    2. BServer-side request forgery (SSRF)
    3. CSQL injection
    4. DCross-site scripting (XSS)

    Answer: C. The keyed answer is "SQL injection". SQL injection occurs when an attacker inserts malicious SQL commands into input fields, manipulating database queries to extract or modify data. XSS injects client-side scripts, SSRF makes requests from the server, and IDOR accesses unauthorized resources. This item tests threats in the context of CompTIA Security+ SY0-701 — 1.4 Application Attacks. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.

    Source: CompTIA Security+ SY0-701 — 1.4 Application Attacks

  15. Program management

    15. An organization needs to classify data to ensure appropriate protection. Which classification level is assigned to data whose disclosure could cause severe damage?

    1. AInternal
    2. BRestricted
    3. CPublic
    4. DConfidential

    Answer: B. Restricted classification is assigned to highly sensitive data whose disclosure could cause severe damage, such as trade secrets or critical security information. Confidential data causes moderate damage, internal data is for general employee use, and public data has no restrictions.

    Source: CompTIA Security+ SY0-701 — 5.1 Data Classification Concepts

  16. Program management

    16. An organization is implementing a vendor risk management program. Which assessment type evaluates a vendor's compliance with security standards?

    1. ABusiness impact analysis
    2. BSecurity questionnaire and documentation review
    3. CTechnical vulnerability assessment
    4. DPenetration test of vendor systems

    Answer: B. The keyed answer is "Security questionnaire and documentation review". Security questionnaires and documentation reviews assess vendor compliance with security standards and policies. Technical vulnerability assessments find specific weaknesses, penetration tests actively exploit systems, and business impact analyses evaluate operational effects rather than compliance. This item tests program_management in the context of CompTIA Security+ SY0-701 — 5.4 Risk Mitigation Strategies. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.

    Source: CompTIA Security+ SY0-701 — 5.4 Risk Mitigation Strategies

  17. Threats

    17. An attacker uses a list of username and password pairs obtained from a previous data breach to attempt access to a company's cloud services. Which type of attack is this?

    1. ACredential stuffing
    2. BPrivilege escalation
    3. CSession hijacking
    4. DPass-the-hash

    Answer: A. The keyed answer is "Credential stuffing". Credential stuffing uses username and password pairs stolen from one breach to attempt access on other systems, exploiting password reuse. Privilege escalation elevates permissions, session hijacking steals active sessions, and pass-the-hash uses captured password hashes. This item tests threats in the context of CompTIA Security+ SY0-701 — 1.3 Identity-Based Attacks. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.

    Source: CompTIA Security+ SY0-701 — 1.3 Identity-Based Attacks

  18. Operations

    18. A SOC analyst is configuring a SIEM to detect brute-force attacks. Which log event correlation rule would be MOST effective?

    1. AAlert when any user changes their password
    2. BAlert when any user logs in successfully
    3. CAlert when a user logs in from a different country
    4. DAlert when a single account has more than 10 failed logins within 5 minutes

    Answer: D. The keyed answer is "Alert when a single account has more than 10 failed logins within 5 minutes". Monitoring for multiple failed login attempts within a short timeframe is the classic detection method for brute-force attacks. While geographic anomalies and password changes are suspicious, they do not directly indicate brute-force activity like repeated authentication failures do. This item tests operations in the context of CompTIA Security+ SY0-701 — 3.1 Security Monitoring. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.

    Source: CompTIA Security+ SY0-701 — 3.1 Security Monitoring

  19. Program management

    19. An organization is implementing a new security policy requiring strong passwords. Which policy component defines the minimum password complexity requirements?

    1. AAcceptable Use Policy (AUP)
    2. BRemote Access Policy
    3. CData Classification Policy
    4. DPassword Policy

    Answer: D. The keyed answer is "Password Policy". A Password Policy specifically defines password requirements such as minimum length, complexity, expiration, and history. An AUP covers general IT usage, a Data Classification Policy defines data handling, and a Remote Access Policy governs remote connection methods. This item tests program_management in the context of CompTIA Security+ SY0-701 — 5.1 Governance Policies. Apply the rule only under the conditions stated in the stem, and compare the distractors with the keyed answer before using the rule in a different situation.

    Source: CompTIA Security+ SY0-701 — 5.1 Governance Policies

  20. Threats

    20. A security analyst discovers a phishing email targeting employees with a link to a credential-harvesting site. Which technical control would BEST prevent users from accessing this site?

    1. AEnforce multi-factor authentication on all web applications
    2. BImplement a web content filter with known malicious URL categories
    3. CRequire all users to complete quarterly security awareness training
    4. DEnable email attachment sandboxing on the mail gateway

    Answer: B. A web content filter that blocks known malicious URLs is the most direct technical control for preventing access to credential-harvesting sites. While MFA, training, and sandboxing are valuable, they do not directly block access to a specific malicious URL at the network level.

    Source: CompTIA Security+ SY0-701 — 1.2 Threat Actors and Attack Vectors

That’s the free set. The full bank has 300.

More original practice questions across the listed topics, a 90-question timed benchmark, and saved mistake review. Internal QuizCram practice target. CompTIA scores Security+ as a scaled 750 on a 100–900 scale, which is not a raw percentage and cannot be converted into one. One payment of $19.99, yours forever.

Practice the free set