COMPTIA SECURITY+ SY0-701 EXAM 2026 – EXAM-STYLE QUESTIONS AND
ANSWERS | VERIFIED AND WELL DETAILED ANSWERS | PLUS RATIONALES |
GUARANTEED PASS | 2026/27 LATEST UPDATE | EXAM PREP | STUDY GUIDE |
PRACTICE TEST
SECTION ONE: QUESTIONS 1-50
1. A security analyst is investigating a potential data exfiltration incident. The
analyst discovers that a large volume of sensitive database records was
exported to a CSV file and then compressed into a password-protected archive.
The archive was subsequently uploaded to a personal cloud storage account
using a standard web browser during non-business hours. Which of the
following data loss prevention (DLP) controls would have been MOST effective
at preventing this specific exfiltration attempt?
A. Endpoint DLP agent that monitors file system activity and blocks the creation
of archive files
B. Network DLP appliance that inspects HTTPS traffic for unauthorized data
transfers to cloud storage
C. Database activity monitoring (DAM) that alerts on unusual query patterns, such
as large data exports
D. File integrity monitoring (FIM) that detects changes to sensitive database files
Correct Answer: B. Network DLP appliance that inspects HTTPS traffic for
unauthorized data transfers to cloud storage
Rationale: A network DLP appliance is designed to inspect data in motion. In this
scenario, the data is being exfiltrated over the network via HTTPS to a personal
cloud service. A properly configured network DLP would analyze the outgoing web
,traffic, identify the sensitive data patterns within the upload, and block the transfer.
Endpoint DLP (A) is less effective because it might not block the creation of a
password-protected archive if it cannot inspect the contents. DAM (C) is a detective
control, not a preventative one, for data leaving the database. FIM (D) monitors for
changes to files, not the transfer of data.
2. A company is implementing a new web-based application that will handle
sensitive customer data. To ensure the confidentiality of data in transit, which
of the following security controls is MOST critical to implement and properly
configure?
A. Secure Sockets Layer (SSL) with a self-signed certificate
B. Transport Layer Security (TLS) with a certificate from a trusted certificate
authority (CA)
C. An intrusion detection system (IDS) to monitor for man-in-the-middle attacks
D. A web application firewall (WAF) to filter HTTP traffic
Correct Answer: B. Transport Layer Security (TLS) with a certificate from a
trusted certificate authority (CA)
Rationale: TLS is the modern, secure standard for encrypting data in transit. Using a
certificate signed by a trusted CA ensures that clients can verify the server's identity,
preventing impersonation attacks. SSL (A) is deprecated and insecure. While an IDS
(C) and WAF (D) are important security controls, they are for detection and
application security, respectively, and do not directly provide the primary
mechanism for securing data in transit (confidentiality and integrity).
,3. A cybersecurity analyst needs to identify which processes are listening on
network ports on a Windows server without installing additional software.
Which of the following built-in command-line utilities should the analyst use to
accomplish this task?
A. ping
B. ipconfig
C. netstat
D. nslookup
Correct Answer: C. netstat
Rationale: The netstat command is a standard networking utility used to display
active TCP connections, ports on which the computer is listening, and routing
tables. With the appropriate switches (e.g., -an ), it can display all listening ports
and their associated processes. ping (A) is used for connectivity testing. ipconfig (B)
displays IP configuration details. nslookup (D) is used for DNS name resolution
queries.
4. An organization has a BYOD (Bring Your Own Device) policy for employees.
Which of the following is the BEST approach for securing company data stored
on personal mobile devices?
A. Implementing a full-disk encryption policy for all BYOD devices
B. Installing a mobile device management (MDM) agent to containerize corporate
data
C. Requiring users to sign an acceptable use policy (AUP) outlining data handling
, rules
D. Restricting access to company resources using network access control (NAC)
Correct Answer: B. Installing a mobile device management (MDM) agent to
containerize corporate data
Rationale: Mobile Device Management (MDM) allows an organization to apply
policies, enforce security configurations, and most importantly, create a secure
container on the device to separate corporate data from personal data. This allows
the organization to wipe corporate data remotely without affecting the user's
personal information. Full-disk encryption (A) is a good practice but is not as
granular as containerization for data segregation. An AUP (C) is a policy, not a
technical control. NAC (D) controls network access but does not manage data on
the device itself.
5. A systems administrator has just patched a critical vulnerability in a Linux
web server. To ensure the patch was successfully applied and the system is now
secure, what is the NEXT best step?
A. Reboot the server to load the new kernel and system libraries.
B. Run a vulnerability scanner against the server.
C. Review the patch log files for any errors.
D. Notify the change management board of the completed task.
Correct Answer: B. Run a vulnerability scanner against the server.
Rationale: Verifying the security posture is the key step after remediation. Running
a vulnerability scan provides independent, empirical evidence that the vulnerability
ANSWERS | VERIFIED AND WELL DETAILED ANSWERS | PLUS RATIONALES |
GUARANTEED PASS | 2026/27 LATEST UPDATE | EXAM PREP | STUDY GUIDE |
PRACTICE TEST
SECTION ONE: QUESTIONS 1-50
1. A security analyst is investigating a potential data exfiltration incident. The
analyst discovers that a large volume of sensitive database records was
exported to a CSV file and then compressed into a password-protected archive.
The archive was subsequently uploaded to a personal cloud storage account
using a standard web browser during non-business hours. Which of the
following data loss prevention (DLP) controls would have been MOST effective
at preventing this specific exfiltration attempt?
A. Endpoint DLP agent that monitors file system activity and blocks the creation
of archive files
B. Network DLP appliance that inspects HTTPS traffic for unauthorized data
transfers to cloud storage
C. Database activity monitoring (DAM) that alerts on unusual query patterns, such
as large data exports
D. File integrity monitoring (FIM) that detects changes to sensitive database files
Correct Answer: B. Network DLP appliance that inspects HTTPS traffic for
unauthorized data transfers to cloud storage
Rationale: A network DLP appliance is designed to inspect data in motion. In this
scenario, the data is being exfiltrated over the network via HTTPS to a personal
cloud service. A properly configured network DLP would analyze the outgoing web
,traffic, identify the sensitive data patterns within the upload, and block the transfer.
Endpoint DLP (A) is less effective because it might not block the creation of a
password-protected archive if it cannot inspect the contents. DAM (C) is a detective
control, not a preventative one, for data leaving the database. FIM (D) monitors for
changes to files, not the transfer of data.
2. A company is implementing a new web-based application that will handle
sensitive customer data. To ensure the confidentiality of data in transit, which
of the following security controls is MOST critical to implement and properly
configure?
A. Secure Sockets Layer (SSL) with a self-signed certificate
B. Transport Layer Security (TLS) with a certificate from a trusted certificate
authority (CA)
C. An intrusion detection system (IDS) to monitor for man-in-the-middle attacks
D. A web application firewall (WAF) to filter HTTP traffic
Correct Answer: B. Transport Layer Security (TLS) with a certificate from a
trusted certificate authority (CA)
Rationale: TLS is the modern, secure standard for encrypting data in transit. Using a
certificate signed by a trusted CA ensures that clients can verify the server's identity,
preventing impersonation attacks. SSL (A) is deprecated and insecure. While an IDS
(C) and WAF (D) are important security controls, they are for detection and
application security, respectively, and do not directly provide the primary
mechanism for securing data in transit (confidentiality and integrity).
,3. A cybersecurity analyst needs to identify which processes are listening on
network ports on a Windows server without installing additional software.
Which of the following built-in command-line utilities should the analyst use to
accomplish this task?
A. ping
B. ipconfig
C. netstat
D. nslookup
Correct Answer: C. netstat
Rationale: The netstat command is a standard networking utility used to display
active TCP connections, ports on which the computer is listening, and routing
tables. With the appropriate switches (e.g., -an ), it can display all listening ports
and their associated processes. ping (A) is used for connectivity testing. ipconfig (B)
displays IP configuration details. nslookup (D) is used for DNS name resolution
queries.
4. An organization has a BYOD (Bring Your Own Device) policy for employees.
Which of the following is the BEST approach for securing company data stored
on personal mobile devices?
A. Implementing a full-disk encryption policy for all BYOD devices
B. Installing a mobile device management (MDM) agent to containerize corporate
data
C. Requiring users to sign an acceptable use policy (AUP) outlining data handling
, rules
D. Restricting access to company resources using network access control (NAC)
Correct Answer: B. Installing a mobile device management (MDM) agent to
containerize corporate data
Rationale: Mobile Device Management (MDM) allows an organization to apply
policies, enforce security configurations, and most importantly, create a secure
container on the device to separate corporate data from personal data. This allows
the organization to wipe corporate data remotely without affecting the user's
personal information. Full-disk encryption (A) is a good practice but is not as
granular as containerization for data segregation. An AUP (C) is a policy, not a
technical control. NAC (D) controls network access but does not manage data on
the device itself.
5. A systems administrator has just patched a critical vulnerability in a Linux
web server. To ensure the patch was successfully applied and the system is now
secure, what is the NEXT best step?
A. Reboot the server to load the new kernel and system libraries.
B. Run a vulnerability scanner against the server.
C. Review the patch log files for any errors.
D. Notify the change management board of the completed task.
Correct Answer: B. Run a vulnerability scanner against the server.
Rationale: Verifying the security posture is the key step after remediation. Running
a vulnerability scan provides independent, empirical evidence that the vulnerability
