COMPTIA SECURITY+ SY0-701
CERTIFICATION EXAM 2026/2027 | PRACTICE
QUESTIONS, VERIFIED ANSWERS &
DETAILED RATIONALES | COMPLETE STUDY
GUIDE
COMPTIA SECURITY+ SY0-701 CERTIFICATION EXAM 2026/2027 | PRACTICE
QUESTIONS, VERIFIED ANSWERS & DETAILED RATIONALES | COMPLETE STUDY
GUIDE
• This comprehensive practice exam contains 200 verified questions covering all five
domains of the CompTIA Security+ SY0-701 certification with detailed rationales to
reinforce your understanding of each concept.
• Study this material by reviewing each question carefully, attempting to answer
before checking the correct response, and reading the rationale thoroughly to
identify knowledge gaps and strengthen weak areas.
1. Which of the following is BEST described as a social engineering attack
where an attacker impersonates an authority figure to trick users into
divulging sensitive information?
A) Tailgating
B) Phishing
C) Pretexting
D) Baiting
E) Shoulder surfing
CORRECT ANSWER: C) Pretexting
Pretexting is a social engineering technique where an attacker creates a fabricated
scenario and assumes a false identity (such as IT support, management, or law
enforcement) to manipulate targets into revealing confidential information. The
,attacker establishes a false premise or relationship to gain trust. While phishing
uses deceptive emails, tailgating involves physical access, baiting leaves malicious
items for discovery, and shoulder surfing involves observing information directly,
pretexting specifically involves impersonation and creating a false context to extract
information through manipulation.
2. A security administrator discovers that an employee's credentials were
compromised and used to access company resources during non-business
hours. Which of the following controls would BEST prevent unauthorized
access using stolen credentials?
A) Implementing a password policy
B) Enabling multi-factor authentication (MFA)
C) Conducting security awareness training
D) Implementing role-based access control (RBAC)
E) Increasing audit logging
CORRECT ANSWER: B) Enabling multi-factor authentication (MFA)
Multi-factor authentication requires attackers to provide multiple forms of
verification beyond just the password, such as a one-time code from a mobile
device or biometric identification. Even if credentials are stolen, the attacker cannot
access resources without the second factor. While password policies and RBAC are
important controls, they do not prevent unauthorized access once credentials are
compromised. Security training and audit logging are detective rather than
preventive controls that would not stop the initial unauthorized access.
3. Which cryptographic algorithm is BEST suited for protecting data at rest in
modern security deployments?
A) RSA
B) AES
,C) SHA-256
D) HMAC
E) Diffie-Hellman
CORRECT ANSWER: B) AES
AES (Advanced Encryption Standard) is a symmetric encryption algorithm
specifically designed for protecting data at rest due to its speed, efficiency, and
strong security properties. It uses block cipher encryption and is the industry
standard for protecting stored data. RSA is asymmetric and better suited for key
exchange and digital signatures; SHA-256 is a hash function for integrity
verification; HMAC provides authentication and integrity; and Diffie-Hellman is used
for key agreement. AES provides the confidentiality needed for protecting data in
storage.
4. An organization experiences a data breach where customer personal
information is exposed. Under which regulation would the organization MOST
LIKELY be required to notify affected individuals?
A) HIPAA
B) GDPR
C) FISMA
D) SOC 2
E) ISO 27001
CORRECT ANSWER: B) GDPR
GDPR (General Data Protection Regulation) mandates that organizations must
notify individuals of personal data breaches without undue delay and no later than
72 hours after becoming aware of the breach. While HIPAA applies to healthcare
organizations, FISMA applies to U.S. federal agencies, SOC 2 is a compliance
framework rather than a regulation, and ISO 27001 is an international information
security standard, GDPR is specifically designed to protect personal data and
, requires breach notifications for individuals in the EU. Many other jurisdictions
have similar requirements (CCPA in California, for example), but GDPR is the most
comprehensive regulation requiring immediate breach notification.
5. Which of the following BEST describes the principle of least privilege?
A) Giving all users administrative access to perform their jobs efficiently
B) Granting users only the minimum permissions necessary to perform their job
functions
C) Removing all access controls to improve usability
D) Providing temporary access that automatically escalates to higher privileges
E) Implementing access controls only for external users
CORRECT ANSWER: B) Granting users only the minimum permissions
necessary to perform their job functions
The principle of least privilege is a fundamental security control that limits user
access rights to the minimum level required for them to perform their assigned
tasks. This significantly reduces the attack surface and damage potential if an
account is compromised. Granting excessive privileges increases risk, removing
controls eliminates security, automatic escalation bypasses review processes, and
restricting controls only to external users leaves internal threats unmitigated. Least
privilege applies to all users and systems universally.
6. Which type of malware disguises itself as legitimate software to trick users
into installing it?
A) Rootkit
B) Trojan
C) Worm
D) Ransomware
CERTIFICATION EXAM 2026/2027 | PRACTICE
QUESTIONS, VERIFIED ANSWERS &
DETAILED RATIONALES | COMPLETE STUDY
GUIDE
COMPTIA SECURITY+ SY0-701 CERTIFICATION EXAM 2026/2027 | PRACTICE
QUESTIONS, VERIFIED ANSWERS & DETAILED RATIONALES | COMPLETE STUDY
GUIDE
• This comprehensive practice exam contains 200 verified questions covering all five
domains of the CompTIA Security+ SY0-701 certification with detailed rationales to
reinforce your understanding of each concept.
• Study this material by reviewing each question carefully, attempting to answer
before checking the correct response, and reading the rationale thoroughly to
identify knowledge gaps and strengthen weak areas.
1. Which of the following is BEST described as a social engineering attack
where an attacker impersonates an authority figure to trick users into
divulging sensitive information?
A) Tailgating
B) Phishing
C) Pretexting
D) Baiting
E) Shoulder surfing
CORRECT ANSWER: C) Pretexting
Pretexting is a social engineering technique where an attacker creates a fabricated
scenario and assumes a false identity (such as IT support, management, or law
enforcement) to manipulate targets into revealing confidential information. The
,attacker establishes a false premise or relationship to gain trust. While phishing
uses deceptive emails, tailgating involves physical access, baiting leaves malicious
items for discovery, and shoulder surfing involves observing information directly,
pretexting specifically involves impersonation and creating a false context to extract
information through manipulation.
2. A security administrator discovers that an employee's credentials were
compromised and used to access company resources during non-business
hours. Which of the following controls would BEST prevent unauthorized
access using stolen credentials?
A) Implementing a password policy
B) Enabling multi-factor authentication (MFA)
C) Conducting security awareness training
D) Implementing role-based access control (RBAC)
E) Increasing audit logging
CORRECT ANSWER: B) Enabling multi-factor authentication (MFA)
Multi-factor authentication requires attackers to provide multiple forms of
verification beyond just the password, such as a one-time code from a mobile
device or biometric identification. Even if credentials are stolen, the attacker cannot
access resources without the second factor. While password policies and RBAC are
important controls, they do not prevent unauthorized access once credentials are
compromised. Security training and audit logging are detective rather than
preventive controls that would not stop the initial unauthorized access.
3. Which cryptographic algorithm is BEST suited for protecting data at rest in
modern security deployments?
A) RSA
B) AES
,C) SHA-256
D) HMAC
E) Diffie-Hellman
CORRECT ANSWER: B) AES
AES (Advanced Encryption Standard) is a symmetric encryption algorithm
specifically designed for protecting data at rest due to its speed, efficiency, and
strong security properties. It uses block cipher encryption and is the industry
standard for protecting stored data. RSA is asymmetric and better suited for key
exchange and digital signatures; SHA-256 is a hash function for integrity
verification; HMAC provides authentication and integrity; and Diffie-Hellman is used
for key agreement. AES provides the confidentiality needed for protecting data in
storage.
4. An organization experiences a data breach where customer personal
information is exposed. Under which regulation would the organization MOST
LIKELY be required to notify affected individuals?
A) HIPAA
B) GDPR
C) FISMA
D) SOC 2
E) ISO 27001
CORRECT ANSWER: B) GDPR
GDPR (General Data Protection Regulation) mandates that organizations must
notify individuals of personal data breaches without undue delay and no later than
72 hours after becoming aware of the breach. While HIPAA applies to healthcare
organizations, FISMA applies to U.S. federal agencies, SOC 2 is a compliance
framework rather than a regulation, and ISO 27001 is an international information
security standard, GDPR is specifically designed to protect personal data and
, requires breach notifications for individuals in the EU. Many other jurisdictions
have similar requirements (CCPA in California, for example), but GDPR is the most
comprehensive regulation requiring immediate breach notification.
5. Which of the following BEST describes the principle of least privilege?
A) Giving all users administrative access to perform their jobs efficiently
B) Granting users only the minimum permissions necessary to perform their job
functions
C) Removing all access controls to improve usability
D) Providing temporary access that automatically escalates to higher privileges
E) Implementing access controls only for external users
CORRECT ANSWER: B) Granting users only the minimum permissions
necessary to perform their job functions
The principle of least privilege is a fundamental security control that limits user
access rights to the minimum level required for them to perform their assigned
tasks. This significantly reduces the attack surface and damage potential if an
account is compromised. Granting excessive privileges increases risk, removing
controls eliminates security, automatic escalation bypasses review processes, and
restricting controls only to external users leaves internal threats unmitigated. Least
privilege applies to all users and systems universally.
6. Which type of malware disguises itself as legitimate software to trick users
into installing it?
A) Rootkit
B) Trojan
C) Worm
D) Ransomware
