COMPTIA SECURITY+ SY0-701 CERTIFICATION EXAM QUESTIONS & ANSWERS 2026-202… EXAM
P R O F E S S I O N A L P R A C T I C E M AT E R I A L S
CompTIA Security+ SY0-701
Certification Exam Questions
& Answers 2026-2027 | Latest
Verified Edition (Rationales)
Verified Answers Exam Ready With Rationales
99 QUESTIONS
DOCUMENT OVERVIEW
This verified document provides 99 CompTIA Security+ SY0-701 exam questions, complete with correct
answers and detailed rationales, including diagrams. It covers essential cybersecurity concepts, offering a
comprehensive resource for study and certification preparation. Students can effectively review and solidify
their understanding of key security principles and their practical application.
CONTENTS
Vulnerabilities and Exploits Q1–Q17
Security Controls and Policies Q18–Q36
Threat Actors and Social Engineering Q37–Q52
Incident Response and Forensics Q53–Q63
Network Security and Access Control Q64–Q99
Page 1
, E XA M Q U EST I O N S
Q1 QUESTION 1 OF 99
Which of the following vulnerabilities is exploited when an attacker overwrites a register with amalicious address?
A. VM escape
B. SQL injection
C. Buffer overflow
D. Race condition
CORRECT ANSWER
C. Buffer overflow
RATIONALE
Overwriting a register with a malicious address exploits a buffer overflow, a vulnerability where program execution is diverted by
writing data beyond the allocated buffer's boundaries. This principle of exceeding allocated memory space is central to buffer
overflow attacks.
Q2 QUESTION 2 OF 99
Which of the following is a primary security concern for a company setting up a BYODprogram?
A. End of life
B. Buffer overflow
C. VM escape
D. Jailbreaking
CORRECT ANSWER
D. Jailbreaking
RATIONALE
Jailbreaking circumvents the built-in security controls of a mobile device, allowing unauthorized access and modification of the
operating system, which is a primary concern when personal devices are used for corporate data. This bypass of security
measures poses a significant risk to data integrity and confidentiality within a BYOD program.
Q3 QUESTION 3 OF 99
Which of the following describes the process of concealing code or text inside a graphicalimage?
A. Symmetric encryption
B. Hashing
C. Data masking
D. Steganography
CORRECT ANSWER
D. Steganography
Page 2
, RATIONALE
Steganography is the practice of hiding secret data within an ordinary, non-secret file or message, such as an image, to avoid
detection. This differs from encryption, which scrambles data, and hashing, which creates a fixed-size digest for integrity checks.
Q4 QUESTION 4 OF 99
Which of the following is a hardware-specific vulnerability?
A. Firmware version
B. Buffer overflow
C. SQL injection
D. Cross-site scripting
CORRECT ANSWER
A. Firmware version
RATIONALE
A hardware-specific vulnerability arises from a flaw in the physical device's embedded software or design, such as an outdated
firmware version, which is distinct from software-level exploits like buffer overflows, SQL injection, or cross-site scripting. The
key concept tested is the distinction between hardware-dependent vulnerabilities and software-based exploits.
Q5 QUESTION 5 OF 99
A newly identified network access vulnerability has been found in the OS of legacy loTdevices. Which of the following
would best mitigate this vulnerability quickly?
A. Insurance
B. Patching
C. Segmentation
D. Replacement
CORRECT ANSWER
C. Segmentation
RATIONALE
Network segmentation isolates the vulnerable legacy devices from the main network, preventing the exploit from spreading and
impacting critical systems, thus providing the quickest mitigation without requiring immediate patching or replacement. This
addresses the immediate risk by limiting the blast radius of the vulnerability.
Q6 QUESTION 6 OF 99
An administrator finds that all user workstations and servers are displaying a message that is associated with files
containing an extension of .ryk. Which of the following types of infections is present on the systems?
A. Virus
B. Trojan
C. Spyware
D. Ransomware
CORRECT ANSWER
D. Ransomware
Page 3
, RATIONALE
ryk extension indicating compromised data. This scenario tests the understanding of ransomware's characteristic file alteration
and extortion tactics.
Q7 QUESTION 7 OF 99
After reviewing the following vulnerability scanning report: Server:192.168.14.6Service: TelnetPort: 23 Protocol: TCP
Status: Open Severity: HighVulnerability: Use of an insecure network protocolA security analyst performs the following
test:nmap -p 23 192.168.14.6 -script telnet-encryptionPORT STATE SERVICE REASON23/tcp open telnet syn-ackI telnet
encryption:| _ Telnet server supports encryption
Which of the following would the security analyst conclude for this reported vulnerability?
A. It is a false positive.
B. A rescan is required.
C. It is considered noise.
D. Compensating controls exist.
CORRECT ANSWER
A. It is a false positive.
RATIONALE
The `telnet-encryption` Nmap script verifies if the Telnet server supports encryption, which is a mitigation against the inherent
insecurity of the Telnet protocol itself. Since the script confirms encryption support, the initial report of "Use of an insecure
network protocol" is invalidated, indicating a false positive.
Q8 QUESTION 8 OF 99
An organization's internet-facing website was compromised when an attacker exploited a buffer overflow. Which of
the following should the organization deploy to best protect against similar attacks in the future?
A. NGFW
B. WAF
C. TLS
D. SD-WAN
CORRECT ANSWER
B. WAF
RATIONALE
A Web Application Firewall (WAF) inspects and filters HTTP traffic to and from a web application, specifically designed to detect
and block common web attacks like buffer overflows. This directly addresses the vulnerability exploited in the compromise by
providing application-layer security.
Q9 QUESTION 9 OF 99
Which of the following can best protect against an employee inadvertently installing malware on a company system?
A. Host-based firewall
B. System isolation
C. Least privilege
D. Application allow list
Page 4
P R O F E S S I O N A L P R A C T I C E M AT E R I A L S
CompTIA Security+ SY0-701
Certification Exam Questions
& Answers 2026-2027 | Latest
Verified Edition (Rationales)
Verified Answers Exam Ready With Rationales
99 QUESTIONS
DOCUMENT OVERVIEW
This verified document provides 99 CompTIA Security+ SY0-701 exam questions, complete with correct
answers and detailed rationales, including diagrams. It covers essential cybersecurity concepts, offering a
comprehensive resource for study and certification preparation. Students can effectively review and solidify
their understanding of key security principles and their practical application.
CONTENTS
Vulnerabilities and Exploits Q1–Q17
Security Controls and Policies Q18–Q36
Threat Actors and Social Engineering Q37–Q52
Incident Response and Forensics Q53–Q63
Network Security and Access Control Q64–Q99
Page 1
, E XA M Q U EST I O N S
Q1 QUESTION 1 OF 99
Which of the following vulnerabilities is exploited when an attacker overwrites a register with amalicious address?
A. VM escape
B. SQL injection
C. Buffer overflow
D. Race condition
CORRECT ANSWER
C. Buffer overflow
RATIONALE
Overwriting a register with a malicious address exploits a buffer overflow, a vulnerability where program execution is diverted by
writing data beyond the allocated buffer's boundaries. This principle of exceeding allocated memory space is central to buffer
overflow attacks.
Q2 QUESTION 2 OF 99
Which of the following is a primary security concern for a company setting up a BYODprogram?
A. End of life
B. Buffer overflow
C. VM escape
D. Jailbreaking
CORRECT ANSWER
D. Jailbreaking
RATIONALE
Jailbreaking circumvents the built-in security controls of a mobile device, allowing unauthorized access and modification of the
operating system, which is a primary concern when personal devices are used for corporate data. This bypass of security
measures poses a significant risk to data integrity and confidentiality within a BYOD program.
Q3 QUESTION 3 OF 99
Which of the following describes the process of concealing code or text inside a graphicalimage?
A. Symmetric encryption
B. Hashing
C. Data masking
D. Steganography
CORRECT ANSWER
D. Steganography
Page 2
, RATIONALE
Steganography is the practice of hiding secret data within an ordinary, non-secret file or message, such as an image, to avoid
detection. This differs from encryption, which scrambles data, and hashing, which creates a fixed-size digest for integrity checks.
Q4 QUESTION 4 OF 99
Which of the following is a hardware-specific vulnerability?
A. Firmware version
B. Buffer overflow
C. SQL injection
D. Cross-site scripting
CORRECT ANSWER
A. Firmware version
RATIONALE
A hardware-specific vulnerability arises from a flaw in the physical device's embedded software or design, such as an outdated
firmware version, which is distinct from software-level exploits like buffer overflows, SQL injection, or cross-site scripting. The
key concept tested is the distinction between hardware-dependent vulnerabilities and software-based exploits.
Q5 QUESTION 5 OF 99
A newly identified network access vulnerability has been found in the OS of legacy loTdevices. Which of the following
would best mitigate this vulnerability quickly?
A. Insurance
B. Patching
C. Segmentation
D. Replacement
CORRECT ANSWER
C. Segmentation
RATIONALE
Network segmentation isolates the vulnerable legacy devices from the main network, preventing the exploit from spreading and
impacting critical systems, thus providing the quickest mitigation without requiring immediate patching or replacement. This
addresses the immediate risk by limiting the blast radius of the vulnerability.
Q6 QUESTION 6 OF 99
An administrator finds that all user workstations and servers are displaying a message that is associated with files
containing an extension of .ryk. Which of the following types of infections is present on the systems?
A. Virus
B. Trojan
C. Spyware
D. Ransomware
CORRECT ANSWER
D. Ransomware
Page 3
, RATIONALE
ryk extension indicating compromised data. This scenario tests the understanding of ransomware's characteristic file alteration
and extortion tactics.
Q7 QUESTION 7 OF 99
After reviewing the following vulnerability scanning report: Server:192.168.14.6Service: TelnetPort: 23 Protocol: TCP
Status: Open Severity: HighVulnerability: Use of an insecure network protocolA security analyst performs the following
test:nmap -p 23 192.168.14.6 -script telnet-encryptionPORT STATE SERVICE REASON23/tcp open telnet syn-ackI telnet
encryption:| _ Telnet server supports encryption
Which of the following would the security analyst conclude for this reported vulnerability?
A. It is a false positive.
B. A rescan is required.
C. It is considered noise.
D. Compensating controls exist.
CORRECT ANSWER
A. It is a false positive.
RATIONALE
The `telnet-encryption` Nmap script verifies if the Telnet server supports encryption, which is a mitigation against the inherent
insecurity of the Telnet protocol itself. Since the script confirms encryption support, the initial report of "Use of an insecure
network protocol" is invalidated, indicating a false positive.
Q8 QUESTION 8 OF 99
An organization's internet-facing website was compromised when an attacker exploited a buffer overflow. Which of
the following should the organization deploy to best protect against similar attacks in the future?
A. NGFW
B. WAF
C. TLS
D. SD-WAN
CORRECT ANSWER
B. WAF
RATIONALE
A Web Application Firewall (WAF) inspects and filters HTTP traffic to and from a web application, specifically designed to detect
and block common web attacks like buffer overflows. This directly addresses the vulnerability exploited in the compromise by
providing application-layer security.
Q9 QUESTION 9 OF 99
Which of the following can best protect against an employee inadvertently installing malware on a company system?
A. Host-based firewall
B. System isolation
C. Least privilege
D. Application allow list
Page 4
