CompTIA Security+ SY0-701 Certification Exam
Practice Questions 2026
Question 1
An organization wants to ensure that if a security incident occurs, they can demonstrate
that a specific user performed a specific action. Which security principle is the
organization trying to implement?
A. Confidentiality
B. Integrity
C. Non-repudiation
D. Availability
*Correct Answer: C. Non-repudiation. *
Rationale: Non-repudiation ensures that an individual cannot deny having performed a
specific action. This is typically achieved through digital signatures and comprehensive
audit logs .
Question 2
A security analyst is creating an inbound firewall rule to block a malicious IP address
(10.1.4.9) from accessing the organization's network. Which of the following rules fulfills
this request?
A. access-list inbound deny ip source 0.0.0.0/0 destination 10.1.4.9/32
B. access-list inbound deny ip source 10.1.4.9/32 destination 0.0.0.0/0
C. access-list inbound permit ip source 10.1.4.9/32 destination 0.0.0.0/0
D. access-list inbound permit ip source 0.0.0.0/0 destination 10.1.4.9/32
*Correct Answer: B. access-list inbound deny ip source 10.1.4.9/32 destination
0.0.0.0/0. *
Rationale: An inbound rule should block traffic originating from the malicious source IP
(10.1.4.9/32) to any destination (0.0.0.0/0) on the network. The "deny" action is required
with the attacker's IP as the source .
,Question 3
A company is expanding its threat surface program and inviting external security
researchers to test their internet-facing application in exchange for compensation. This
describes a:
A. Red team exercise
B. Bug bounty program
C. Penetration testing engagement
D. Vulnerability assessment
*Correct Answer: B. Bug bounty program. *
Rationale: A bug bounty program invites external security researchers to find and report
vulnerabilities in exchange for monetary compensation, effectively crowdsourcing security
testing .
Question 4
Which of the following is the correct final step of the incident response process?
A. Containment
B. Eradication
C. Recovery
D. Lessons learned
*Correct Answer: D. Lessons learned. *
Rationale: The incident response lifecycle includes detection, containment, eradication, and
recovery, but the final step is "lessons learned" where the organization reviews the incident
to improve future response .
Question 5
Which of the following provides the details about the terms and scope of a test with a
third-party penetration tester?
A. Rules of engagement
B. Supply chain analysis
,C. Right to audit clause
D. Due diligence
*Correct Answer: A. Rules of engagement. *
Rationale: Rules of engagement define the scope, boundaries, and specific terms of a
penetration test, including what systems can be tested, testing methods, and
communication protocols .
Question 6
An organization is using a VPN between its headquarters and a branch location. What
type of data is the VPN primarily protecting?
A. Data in use
B. Data in transit
C. Data at rest
D. Data sovereignty
*Correct Answer: B. Data in transit. *
Rationale: A VPN encrypts data as it travels across networks, protecting data in transit
(data moving between locations) from interception by unauthorized parties .
Question 7
Which of the following would be the most helpful in restoring data in the event of a
ransomware infection?
A. Load balancing
B. Geographic dispersion
C. Encryption
D. Backups
*Correct Answer: D. Backups. *
Rationale: Regular, tested backups are the most effective defense against ransomware,
allowing organizations to restore encrypted data without paying the ransom .
, Question 8
Which type of security control is an intrusion detection system (IDS)?
A. Deterrent control
B. Preventive control
C. Detective control
D. Corrective control
*Correct Answer: C. Detective control. *
Rationale: An IDS monitors network traffic for suspicious activity and alerts administrators,
making it a detective control. It detects threats after they occur rather than preventing
them .
Question 9
Which type of security control is an intrusion prevention system (IPS)?
A. Deterrent control
B. Preventive control
C. Detective control
D. Corrective control
*Correct Answer: B. Preventive control. *
Rationale: An IPS actively monitors and blocks malicious traffic, preventing attacks from
reaching their targets. Unlike an IDS, it takes action to stop threats .
Question 10
An attacker registers a domain name that is a common misspelling of a legitimate
banking website. This is known as:
A. Brand impersonation
B. Typosquatting
Practice Questions 2026
Question 1
An organization wants to ensure that if a security incident occurs, they can demonstrate
that a specific user performed a specific action. Which security principle is the
organization trying to implement?
A. Confidentiality
B. Integrity
C. Non-repudiation
D. Availability
*Correct Answer: C. Non-repudiation. *
Rationale: Non-repudiation ensures that an individual cannot deny having performed a
specific action. This is typically achieved through digital signatures and comprehensive
audit logs .
Question 2
A security analyst is creating an inbound firewall rule to block a malicious IP address
(10.1.4.9) from accessing the organization's network. Which of the following rules fulfills
this request?
A. access-list inbound deny ip source 0.0.0.0/0 destination 10.1.4.9/32
B. access-list inbound deny ip source 10.1.4.9/32 destination 0.0.0.0/0
C. access-list inbound permit ip source 10.1.4.9/32 destination 0.0.0.0/0
D. access-list inbound permit ip source 0.0.0.0/0 destination 10.1.4.9/32
*Correct Answer: B. access-list inbound deny ip source 10.1.4.9/32 destination
0.0.0.0/0. *
Rationale: An inbound rule should block traffic originating from the malicious source IP
(10.1.4.9/32) to any destination (0.0.0.0/0) on the network. The "deny" action is required
with the attacker's IP as the source .
,Question 3
A company is expanding its threat surface program and inviting external security
researchers to test their internet-facing application in exchange for compensation. This
describes a:
A. Red team exercise
B. Bug bounty program
C. Penetration testing engagement
D. Vulnerability assessment
*Correct Answer: B. Bug bounty program. *
Rationale: A bug bounty program invites external security researchers to find and report
vulnerabilities in exchange for monetary compensation, effectively crowdsourcing security
testing .
Question 4
Which of the following is the correct final step of the incident response process?
A. Containment
B. Eradication
C. Recovery
D. Lessons learned
*Correct Answer: D. Lessons learned. *
Rationale: The incident response lifecycle includes detection, containment, eradication, and
recovery, but the final step is "lessons learned" where the organization reviews the incident
to improve future response .
Question 5
Which of the following provides the details about the terms and scope of a test with a
third-party penetration tester?
A. Rules of engagement
B. Supply chain analysis
,C. Right to audit clause
D. Due diligence
*Correct Answer: A. Rules of engagement. *
Rationale: Rules of engagement define the scope, boundaries, and specific terms of a
penetration test, including what systems can be tested, testing methods, and
communication protocols .
Question 6
An organization is using a VPN between its headquarters and a branch location. What
type of data is the VPN primarily protecting?
A. Data in use
B. Data in transit
C. Data at rest
D. Data sovereignty
*Correct Answer: B. Data in transit. *
Rationale: A VPN encrypts data as it travels across networks, protecting data in transit
(data moving between locations) from interception by unauthorized parties .
Question 7
Which of the following would be the most helpful in restoring data in the event of a
ransomware infection?
A. Load balancing
B. Geographic dispersion
C. Encryption
D. Backups
*Correct Answer: D. Backups. *
Rationale: Regular, tested backups are the most effective defense against ransomware,
allowing organizations to restore encrypted data without paying the ransom .
, Question 8
Which type of security control is an intrusion detection system (IDS)?
A. Deterrent control
B. Preventive control
C. Detective control
D. Corrective control
*Correct Answer: C. Detective control. *
Rationale: An IDS monitors network traffic for suspicious activity and alerts administrators,
making it a detective control. It detects threats after they occur rather than preventing
them .
Question 9
Which type of security control is an intrusion prevention system (IPS)?
A. Deterrent control
B. Preventive control
C. Detective control
D. Corrective control
*Correct Answer: B. Preventive control. *
Rationale: An IPS actively monitors and blocks malicious traffic, preventing attacks from
reaching their targets. Unlike an IDS, it takes action to stop threats .
Question 10
An attacker registers a domain name that is a common misspelling of a legitimate
banking website. This is known as:
A. Brand impersonation
B. Typosquatting
