CompTIA Security+ SY0-701 Practice Exam
CompTIA Security+ SY0-701
The CompTIA Security+ SY0-701 certification validates the core skills needed to secure networks, endpoints and cloud services. The exam covers general security concepts, threats, vulnerabilities and mitigations, security architecture, security operations, and security program management and oversight. Candidates demonstrate knowledge of control types, cryptographic solutions, threat actors and attack surfaces, indicators of malicious activity, zero trust and resilient design, data protection, identity and access management, vulnerability and incident response, automation, and governance, risk and compliance. The exam consists of 90 questions over 90 minutes, with a 75% passing score.
Exam version: V7
878 questions in the bank
Question bank updated : questions, answers, explanations and chapters.
Certification Overview
- Exam name: Security+ SY0-701
- Vendor: CompTIA
- Exam code: SY0-701
- Duration: 90 minutes
- Total questions: about 90
- Official passing score: 750 on a scale of 100-900 (source)
- Our practice exam pass mark: 75%
Who Should Take This Exam?
Security Administrator, Systems Administrator, Network Administrator, Security Analyst, SOC Analyst, Security Specialist, Junior IT Auditor, Junior Penetration Tester
Prerequisites
No formal prerequisite. CompTIA recommends Network+ and about two years of experience in IT administration with a security focus.
Topics Covered
- General Security Concepts
- Threats, Vulnerabilities, and Mitigations
- Security Architecture
- Security Operations
- Security Program Management and Oversight
Question Types
- Multiple Choice (Single Answer)
- Multiple Choice (Multiple Answers)
- Drag and Drop
- Scenario-Based
Security+ SY0-701 Practice Questions
Our question bank contains 878+ practice questions for this certification. Sample questions from each exam chapter. Expand a question to see the answer choices. With full access, you get unlimited practice exams with randomized questions from our full question bank.
General Security Concepts
A company runs mandatory phishing-awareness training for all employees. Which control category does this program fall under?
- A. Technical
- B. Operational Correct answer
- C. Physical
- D. Managerial
Option B is correct because security awareness training is an operational control, carried out by people as a routine process. Technical controls run in systems, physical controls protect facilities, and managerial controls cover planning, risk and policy.
Which control type is intended to discourage a potential attacker from attempting an intrusion, for example by displaying a warning sign?
- A. Compensating
- B. Corrective
- C. Directive
- D. Deterrent Correct answer
Option D is correct because deterrent controls, such as warning signs, are meant to discourage an attacker from trying. Compensating controls substitute for a missing control, corrective controls fix damage afterwards, and directive controls instruct behavior.
Which element of the CIA triad ensures that data has not been altered by an unauthorized party?
- A. Integrity Correct answer
- B. Confidentiality
- C. Availability
- D. Non-repudiation
Option A is correct because integrity means data has not been altered without authorization. Confidentiality limits who can read it, availability keeps it accessible, and non-repudiation prevents denying an action.
Which TWO of the following are technical controls? (Choose two)
- A. Host-based firewall Correct answer
- B. Full-disk encryption Correct answer
- C. Security guard
- D. Security awareness training
- E. Acceptable use policy
Options A and B are correct because a host-based firewall and full-disk encryption are implemented in technology, so they are technical controls. A security guard is physical, awareness training is operational, and an acceptable use policy is managerial.
Threats, Vulnerabilities, and Mitigations
Which type of threat actor is typically driven by political or social beliefs and often defaces websites to make a statement?
- A. Organized crime group
- B. Hacktivist Correct answer
- C. Unskilled attacker
- D. Competitor
Option B is correct because hacktivists are driven by political or social causes and often use defacement or DDoS. Organized crime seeks profit, unskilled attackers use ready-made tools, and competitors seek advantage.
Which threat actor typically has the largest budget and most advanced capabilities, and is often motivated by espionage?
- A. Unskilled attacker
- B. Hacktivist
- C. Insider
- D. Nation-state Correct answer
Option D is correct because a nation-state has the largest budget and most advanced capabilities and often pursues espionage. Unskilled attackers, hacktivists and insiders typically have fewer resources.
Which TWO attributes are typical of a nation-state threat actor? (Choose two)
- A. Substantial funding Correct answer
- B. High technical sophistication Correct answer
- C. Limited to downloading ready-made tools
- D. Always an internal employee
- E. Relies on publicly posted exploit kits
Options A and B are correct because nation-states have substantial funding and high sophistication. They are not limited to ready-made tools, always insiders, or reliant on public kits.
Based on the log shown, which statement best describes the activity from 203.0.113.45?
- A. A single password was tried across many accounts, and h.brennan authenticated successfully Correct answer
- B. Users mistyped passwords after a scheduled password reset across the domain
- C. A service account failed repeatedly because its stored password had expired
- D. Many passwords were tried against a.patel until that account was locked out
Option A is correct because the same source fails against many different accounts and one login, h.brennan, succeeds, which is password spraying. Trying many passwords against one account would show repeated failures for a.patel only, and a password reset or expired service account would not produce failures across many users.
Security Architecture
In an infrastructure-as-a-service deployment, who is responsible for patching the guest operating system on a virtual machine?
- A. The cloud provider
- B. The customer Correct answer
- C. The hypervisor vendor
- D. The internet service provider
Option B is correct because in IaaS the customer manages the guest operating system and patches it. The provider secures the hypervisor and facilities.
What best describes an air-gapped network?
- A. A network protected by a next-generation firewall at its edge
- B. A network where all traffic runs through encrypted tunnels
- C. A network split into VLANs with access control lists applied
- D. A network with no connection to other networks or the internet Correct answer
Option D is correct because an air-gapped network has no connection to other networks or the internet. Firewalls, tunnels and VLANs still connect networks.
Which TWO responsibilities belong to the customer in an infrastructure-as-a-service deployment? (Choose two)
- A. Patching the guest operating system Correct answer
- B. Configuring security groups and access rules Correct answer
- C. Maintaining the physical data center
- D. Patching the hypervisor
- E. Physical access control to the racks
Options A and B are correct because the customer patches the guest OS and configures security groups in IaaS. The provider maintains the data center, hypervisor and rack access.
Which change would most improve the security of this VPN configuration?
- A. Move the gateway to a different public address
- B. Use IKEv2 with AES-GCM and a strong Diffie-Hellman group Correct answer
- C. Change the lifetime of the pre-shared key to one day
- D. Enable aggressive mode to speed up negotiation
Option B is correct because the configuration uses IKEv1 aggressive mode with 3DES, MD5 and a 768-bit group, so moving to IKEv2 with AES-GCM and a strong group is the best improvement. Changing the address, key lifetime or aggressive mode would not help.
Security Operations
Which type of tool centrally detects, investigates and responds to threats on endpoints?
- A. Load balancer
- B. Content delivery network
- C. Endpoint detection and response Correct answer
- D. DNS forwarder
Option C is correct because endpoint detection and response detects, investigates and responds to threats on endpoints. A load balancer, CDN and DNS forwarder do not.
A user keeps accumulating permissions as they move between departments. What is this problem called, and what fixes it?
- A. Session fixation, fixed by longer passwords
- B. Privilege creep, fixed by periodic access reviews Correct answer
- C. Tailgating, fixed by cameras
- D. Shadow IT, fixed by encryption
Option B is correct because accumulated permissions after job changes are privilege creep, fixed by periodic access reviews. The other pairings match the wrong problem and fix.
Which TWO reduce the impact of a compromised administrator account? (Choose two)
- A. Just-in-time privileged access Correct answer
- B. Least privilege role assignment Correct answer
- C. Sharing one admin password
- D. Permanent domain admin rights for all staff
- E. Longer password expiry for administrators
Options A and B are correct because just-in-time access and least privilege limit what a compromised administrator account can do. Shared passwords, permanent domain admin rights and longer expiry increase impact.
Based on the scan output shown, which finding should be remediated first?
- A. CVE-2025-8890, because deprecated TLS versions fail most compliance audits
- B. CVE-2026-0155, because it carries the highest CVSS score in the scan
- C. CVE-2026-1042, because it is internet-facing and an exploit is public Correct answer
- D. CVE-2026-0777, because it affects the most hosts in the scan
Option C is correct because CVE-2026-1042 is on an internet-facing host with a public proof of concept, so it is the most likely to be exploited. The 9.8 findings are internal with no known exploit, and TLS 1.0 or the number of hosts affected do not outweigh exposure plus exploitability.
Security Program Management and Oversight
Which document defines what employees may and may not do with company IT resources?
- A. Business impact analysis
- B. Acceptable use policy Correct answer
- C. Service level agreement
- D. Incident response playbook
Option B is correct because the acceptable use policy defines what employees may do with IT resources. A BIA, SLA and playbook do not.
In data privacy terms, which role determines the purposes and means of processing personal data?
- A. Data processor
- B. Data custodian
- C. Data subject
- D. Data controller Correct answer
Option D is correct because the data controller determines the purposes and means of processing. Processors act for controllers, custodians protect data, and data subjects are the individuals.
Which TWO are types of governance documents that specify requirements or instructions? (Choose two)
- A. Standard Correct answer
- B. Procedure Correct answer
- C. Invoice
- D. Purchase order
- E. Guideline
Options A and B are correct because standards and procedures specify requirements and instructions. Invoices, purchase orders and advisory guidelines do not.
Based on the headers shown, which findings best support treating this message as phishing?
- A. The Content-Type is HTML, which legitimate corporate mail never uses
- B. The Date header uses a UTC offset instead of a local time zone
- C. SPF and DMARC failed, and the Reply-To domain differs from the From domain Correct answer
- D. The Message-ID domain matches the recipient's own mail server
Option C is correct because SPF and DMARC both failed and the Reply-To domain differs from the From domain, which are classic spoofing signs. HTML content and UTC dates are normal, and the Message-ID domain does not match the recipient's server.
Free Study Guide
Read the free CompTIA Security+ SY0-701 study guide: every exam topic explained in plain English, with diagrams, exam tips and the mistakes to avoid.
More CompTIA Practice Exams
Practice with realistic mock exams to prepare for your CompTIA certification.