COMPTIA SECURITY+ SY0-701 CERTIFICATION EXAM
2026/2027 TEST BANK COMPREHENSIVE PRACTICE
QUESTIONS AND STUDY GUIDE COMPLETE ACCURATE
EXAM APPROVED QUESTIONS AND CORRECT DETAILED
ANSWERS WITH RATIONALES (100% CORRECT
VERIFIED SOLUTIONS) CURRENTLY UPDATED.
EXAM OVERVIEW
The CompTIA Security+ SY0-701 certification exam validates the foundational skills
required for a career in cybersecurity. The exam consists of a maximum of 90 questions,
including multiple-choice and performance-based questions (PBQs). Candidates have 90
minutes to complete the exam. The passing score is 750 on a scale of 100–900.
The exam is organized into five domains:
Domain Percentage Weight
Core principles, controls, cryptography, zero
1.0 General Security Concepts 12%
trust
2.0 Threats, Vulnerabilities, and Threat actors, attack vectors, vulnerabilities,
22%
Mitigations mitigation
3.0 Security Architecture 18% Secure design, cloud, mobile, and IoT securi
Monitoring, hardening, identity, incident
4.0 Security Operations 28%
response
5.0 Security Program Management &
20% Governance, risk, compliance, policies, traini
Oversight
, DOMAIN 1.0: GENERAL SECURITY CONCEPTS (12%)
Questions 1–84
Section 1.1: The CIA Triad & Core Security Principles
Question 1: A hospital's electronic health record system experienced a ransomware
attack that prevented clinicians from accessing patient data for 6 hours. Which pillar of
the CIA triad was most directly compromised?
• A. Confidentiality
• B. Integrity
• C. Availability
• D. Non-repudiation
Correct Answer: C
Rationale: Availability ensures that systems and data are accessible when needed. The
ransomware attack prevented access to patient data for 6 hours, directly impacting
availability. Confidentiality (unauthorized access) and integrity (unauthorized
modification) were not the primary issues in this scenario. Non-repudiation ensures
someone cannot deny an action they performed.
Question 2: A security analyst discovers that an employee's email account was
compromised, and the attacker sent fraudulent invoices to vendors. Which security goal
was most directly violated?
• A. Availability
• B. Confidentiality
• C. Integrity
• D. Authentication
Correct Answer: C
Rationale: Integrity ensures that data is accurate and has not been tampered with. The
attacker sending fraudulent invoices from the compromised account violated the
, integrity of the email system and the trustworthiness of communications. Confidentiality
would involve unauthorized reading of data; availability would involve denial of access.
Question 3: Which of the following best describes the relationship between the CIA triad
and the Parkerian hexad?
• A. The Parkerian hexad adds three additional principles to the CIA triad
• B. The Parkerian hexad replaces the CIA triad
• C. The Parkerian hexad is a subset of the CIA triad
• D. The Parkerian hexad is unrelated to the CIA triad
Correct Answer: A
Rationale: The Parkerian hexad expands upon the CIA triad by adding three additional
principles: Possession/Control, Authenticity, and Utility. This provides a more
comprehensive framework for information security.
Question 4: A financial institution implements multi-factor authentication for all online
banking transactions. This control primarily supports which security objective?
• A. Confidentiality
• B. Integrity
• C. Authentication
• D. Non-repudiation
Correct Answer: C
Rationale: Multi-factor authentication (MFA) is a control that supports
authentication—verifying the identity of users before granting access. While
authentication contributes to confidentiality, integrity, and non-repudiation, its primary
purpose is identity verification.
Question 5: A security manager is reviewing access controls. Which principle ensures
that users have only the minimum level of access necessary to perform their job
functions?
, • A. Separation of duties
• B. Need-to-know
• C. Least privilege
• D. Defense in depth
Correct Answer: C
Rationale: The principle of least privilege dictates that users should be granted only
the minimum access rights necessary to perform their job functions. Need-to-know is
similar but focuses on information access rather than system permissions. Separation of
duties divides critical functions among multiple people. Defense in depth uses multiple
layers of security.
Question 6: An organization implements a policy requiring two different individuals to
approve financial transactions over $10,000. This is an example of:
• A. Least privilege
• B. Separation of duties
• C. Need-to-know
• D. Job rotation
Correct Answer: B
Rationale: Separation of duties (also called segregation of duties) requires that critical
functions be divided among multiple individuals to prevent fraud and errors. Requiring
two approvals for large transactions ensures no single person has complete control over
financial processes.
Question 7: A security analyst is investigating a data breach. The analyst needs to prove
that a specific user accessed a sensitive file at a particular time. Which security principle is
most relevant?
• A. Confidentiality
• B. Integrity
• C. Non-repudiation
• D. Availability
Correct Answer: C
2026/2027 TEST BANK COMPREHENSIVE PRACTICE
QUESTIONS AND STUDY GUIDE COMPLETE ACCURATE
EXAM APPROVED QUESTIONS AND CORRECT DETAILED
ANSWERS WITH RATIONALES (100% CORRECT
VERIFIED SOLUTIONS) CURRENTLY UPDATED.
EXAM OVERVIEW
The CompTIA Security+ SY0-701 certification exam validates the foundational skills
required for a career in cybersecurity. The exam consists of a maximum of 90 questions,
including multiple-choice and performance-based questions (PBQs). Candidates have 90
minutes to complete the exam. The passing score is 750 on a scale of 100–900.
The exam is organized into five domains:
Domain Percentage Weight
Core principles, controls, cryptography, zero
1.0 General Security Concepts 12%
trust
2.0 Threats, Vulnerabilities, and Threat actors, attack vectors, vulnerabilities,
22%
Mitigations mitigation
3.0 Security Architecture 18% Secure design, cloud, mobile, and IoT securi
Monitoring, hardening, identity, incident
4.0 Security Operations 28%
response
5.0 Security Program Management &
20% Governance, risk, compliance, policies, traini
Oversight
, DOMAIN 1.0: GENERAL SECURITY CONCEPTS (12%)
Questions 1–84
Section 1.1: The CIA Triad & Core Security Principles
Question 1: A hospital's electronic health record system experienced a ransomware
attack that prevented clinicians from accessing patient data for 6 hours. Which pillar of
the CIA triad was most directly compromised?
• A. Confidentiality
• B. Integrity
• C. Availability
• D. Non-repudiation
Correct Answer: C
Rationale: Availability ensures that systems and data are accessible when needed. The
ransomware attack prevented access to patient data for 6 hours, directly impacting
availability. Confidentiality (unauthorized access) and integrity (unauthorized
modification) were not the primary issues in this scenario. Non-repudiation ensures
someone cannot deny an action they performed.
Question 2: A security analyst discovers that an employee's email account was
compromised, and the attacker sent fraudulent invoices to vendors. Which security goal
was most directly violated?
• A. Availability
• B. Confidentiality
• C. Integrity
• D. Authentication
Correct Answer: C
Rationale: Integrity ensures that data is accurate and has not been tampered with. The
attacker sending fraudulent invoices from the compromised account violated the
, integrity of the email system and the trustworthiness of communications. Confidentiality
would involve unauthorized reading of data; availability would involve denial of access.
Question 3: Which of the following best describes the relationship between the CIA triad
and the Parkerian hexad?
• A. The Parkerian hexad adds three additional principles to the CIA triad
• B. The Parkerian hexad replaces the CIA triad
• C. The Parkerian hexad is a subset of the CIA triad
• D. The Parkerian hexad is unrelated to the CIA triad
Correct Answer: A
Rationale: The Parkerian hexad expands upon the CIA triad by adding three additional
principles: Possession/Control, Authenticity, and Utility. This provides a more
comprehensive framework for information security.
Question 4: A financial institution implements multi-factor authentication for all online
banking transactions. This control primarily supports which security objective?
• A. Confidentiality
• B. Integrity
• C. Authentication
• D. Non-repudiation
Correct Answer: C
Rationale: Multi-factor authentication (MFA) is a control that supports
authentication—verifying the identity of users before granting access. While
authentication contributes to confidentiality, integrity, and non-repudiation, its primary
purpose is identity verification.
Question 5: A security manager is reviewing access controls. Which principle ensures
that users have only the minimum level of access necessary to perform their job
functions?
, • A. Separation of duties
• B. Need-to-know
• C. Least privilege
• D. Defense in depth
Correct Answer: C
Rationale: The principle of least privilege dictates that users should be granted only
the minimum access rights necessary to perform their job functions. Need-to-know is
similar but focuses on information access rather than system permissions. Separation of
duties divides critical functions among multiple people. Defense in depth uses multiple
layers of security.
Question 6: An organization implements a policy requiring two different individuals to
approve financial transactions over $10,000. This is an example of:
• A. Least privilege
• B. Separation of duties
• C. Need-to-know
• D. Job rotation
Correct Answer: B
Rationale: Separation of duties (also called segregation of duties) requires that critical
functions be divided among multiple individuals to prevent fraud and errors. Requiring
two approvals for large transactions ensures no single person has complete control over
financial processes.
Question 7: A security analyst is investigating a data breach. The analyst needs to prove
that a specific user accessed a sensitive file at a particular time. Which security principle is
most relevant?
• A. Confidentiality
• B. Integrity
• C. Non-repudiation
• D. Availability
Correct Answer: C
