COMPTIA SECURITY+ SYO-701 CERTIFICATION EXAM | LATEST
VERSION 2027-2028 Q&A EXAM | ALL QUESTIONS AND
ANSWERS PLUS DETAILED RATIONALES | COMPLETE
STUDYGUIDE| GUARANTEED PASS | DOWNLOAD INSTANT
PDF 2027-2028
1. A network administrator wants to ensure that data sent across an untrusted local
network cannot be read by unauthorized eavesdroppers. Which of the following security
concepts directly addresses this requirement?
A. Availability
B. Non-repudiation
C. Confidentiality
D. Integrity
Confidentiality ensures that sensitive information is accessed only by authorized individuals
and remains protected from unauthorized interception or disclosure. Encryption mechanisms
are primary controls used to maintain confidentiality across untrusted networks.
2. An organization is reviewing its data protection policies. Management wants to ensure
that financial transaction records cannot be modified or tampered with after they are
written. Which security principle is being prioritized?
A. Integrity
B. Confidentiality
C. Accounting
D. Availability
Integrity guarantees that data remains accurate, complete, and unaltered by unauthorized
parties or accidental corruption. Hashing, digital signatures, and strict access controls are
commonly implemented to enforce integrity.
3. A enterprise web server needs to maintain a 99.99% uptime SLA to support global
customer transactions. Which of the following components or techniques primarily
supports this goal?
A. Symmetric encryption
B. Redundant power supplies and load balancing
C. Multifactor authentication
D. Role-based access control
,Availability ensures that systems, networks, and applications are accessible to authorized
users whenever needed. Redundant hardware, failover clustering, and load balancing
mitigate single points of failure to maintain system availability.
4. A company requires users to log in using a password and a one-time passcode generated
by an authenticator application on their mobile devices. Which access control mechanism is
being utilized?
A. Single factor authentication
B. Identity federation
C. Multifactor authentication
D. Context-aware access control
Multifactor authentication (MFA) requires users to provide two or more distinct credential
categories—such as something you know (password) and something you have (authenticator
app)—before granting access, significantly raising the security baseline.
5. A security analyst receives an alert indicating that a malicious user is sending forged
ARP responses over the local subnet to redirect network traffic through an attacker-
controlled host. Which type of attack is occurring?
A. Man-in-the-middle via ARP poisoning
B. Domain Name System amplification
C. Distributed Denial of Service
D. SQL injection
ARP poisoning spoofing sends deceptive Address Resolution Protocol messages over a local
area network to link the attacker's MAC address with the IP address of a legitimate node,
enabling interception or tampering with network traffic in a man-in-the-middle position.
6. An organization's remote workers use a virtual private network (VPN) to access internal
company assets. To prevent session hijacking during transit, which protocol suite should be
deployed on the VPN gateway?
A. Telnet
B. IPsec
C. HTTP
D. SNMPv2
IPsec (Internet Protocol Security) provides end-to-end security at the Network Layer by
authenticating and encrypting each IP packet in a communication session, guaranteeing both
confidentiality and integrity for remote access tunnels.
,7. A chief information security officer (CISO) is formulating a strategy to lower the risk of
insider threat data exfiltration. Which technical control specifically inspects outgoing
network traffic for sensitive corporate data markers?
A. Intrusion Prevention System (IPS)
B. Data Loss Prevention (DLP)
C. Web Application Firewall (WAF)
D. Network Address Translation (NAT)
Data Loss Prevention (DLP) solutions monitor, detect, and block sensitive data in use, in
motion, and at rest. Endpoint and network DLP prevent unauthorized transfers of confidential
files or information outside the perimeter.
8. During a security audit, an administrator identifies several unpatched server operating
systems running obsolete service packs. Which vulnerability management phase is required
immediately to minimize threat exploitation?
A. Threat hunting
B. Patch management
C. Penetration testing
D. Incident response
Patch management involves identifying, acquiring, testing, and installing code updates
(patches) on deployment systems to address security flaws and operational software
vulnerabilities before adversaries can exploit them.
9. A systems engineer must establish non-repudiation for email communications sent by
corporate executives. Which technology should be implemented?
A. SHA-256 hashing alone
B. Asymmetric encryption with digital signatures
C. Symmetric AES-256 encryption
D. Obfuscation scripts
Digital signatures utilize asymmetric cryptography (private keys to sign, public keys to verify)
to provide non-repudiation and integrity, ensuring the sender cannot plausibly deny having
generated and transmitted the message.
10. An IT team wants to isolate vulnerable legacy accounting software from the rest of the
production network without purchasing new hardware. Which method provides logical
separation?
A. Installing a physical hub
B. Creating a Virtual Local Area Network (VLAN)
C. Implementing air-gapping
, D. Enabling port mirroring
A Virtual Local Area Network (VLAN) logically segments a physical network switch into
separate broadcast domains, allowing security teams to restrict traffic between legacy
applications and sensitive infrastructure via network access control lists.
11. A developer accidentally hardcodes an API secret key into a public source code
repository. A security scanner flags the upload. What risk mitigation action must be
executed first?
A. Revoke and invalidate the exposed API key
B. Re-index the public code repository
C. Send a formal warning letter to the software developer
D. Reinstall the local development environment
Once a credential or cryptographic secret is exposed publicly, it must be considered
compromised immediately. Revoking and replacing the key terminates potential
unauthorized access before exploitation can take place.
12. A security operation center (SOC) analyst notes high volumes of outbound traffic to a
known malicious IP address originating from an internal workstation at 2:00 AM. What is
the immediate incident response step?
A. Erase the workstation hard drive
B. Isolate the workstation from the network
C. Submit a purchase order for new security software
D. Notify external law enforcement authorities
The containment phase of incident response mandates isolating affected systems to stop
potential malware propagation or ongoing exfiltration while preserving evidence for forensic
examination.
13. A company implements a security control where no single employee possesses sufficient
authority to execute a high-risk financial transfer independently. This practice is known as:
A. Least privilege
B. Job rotation
C. Separation of duties
D. Mandatory access control
Separation of duties splits critical business functions across multiple individuals so that no
single employee has end-to-end control, reducing fraudulent activity and accidental errors.
VERSION 2027-2028 Q&A EXAM | ALL QUESTIONS AND
ANSWERS PLUS DETAILED RATIONALES | COMPLETE
STUDYGUIDE| GUARANTEED PASS | DOWNLOAD INSTANT
PDF 2027-2028
1. A network administrator wants to ensure that data sent across an untrusted local
network cannot be read by unauthorized eavesdroppers. Which of the following security
concepts directly addresses this requirement?
A. Availability
B. Non-repudiation
C. Confidentiality
D. Integrity
Confidentiality ensures that sensitive information is accessed only by authorized individuals
and remains protected from unauthorized interception or disclosure. Encryption mechanisms
are primary controls used to maintain confidentiality across untrusted networks.
2. An organization is reviewing its data protection policies. Management wants to ensure
that financial transaction records cannot be modified or tampered with after they are
written. Which security principle is being prioritized?
A. Integrity
B. Confidentiality
C. Accounting
D. Availability
Integrity guarantees that data remains accurate, complete, and unaltered by unauthorized
parties or accidental corruption. Hashing, digital signatures, and strict access controls are
commonly implemented to enforce integrity.
3. A enterprise web server needs to maintain a 99.99% uptime SLA to support global
customer transactions. Which of the following components or techniques primarily
supports this goal?
A. Symmetric encryption
B. Redundant power supplies and load balancing
C. Multifactor authentication
D. Role-based access control
,Availability ensures that systems, networks, and applications are accessible to authorized
users whenever needed. Redundant hardware, failover clustering, and load balancing
mitigate single points of failure to maintain system availability.
4. A company requires users to log in using a password and a one-time passcode generated
by an authenticator application on their mobile devices. Which access control mechanism is
being utilized?
A. Single factor authentication
B. Identity federation
C. Multifactor authentication
D. Context-aware access control
Multifactor authentication (MFA) requires users to provide two or more distinct credential
categories—such as something you know (password) and something you have (authenticator
app)—before granting access, significantly raising the security baseline.
5. A security analyst receives an alert indicating that a malicious user is sending forged
ARP responses over the local subnet to redirect network traffic through an attacker-
controlled host. Which type of attack is occurring?
A. Man-in-the-middle via ARP poisoning
B. Domain Name System amplification
C. Distributed Denial of Service
D. SQL injection
ARP poisoning spoofing sends deceptive Address Resolution Protocol messages over a local
area network to link the attacker's MAC address with the IP address of a legitimate node,
enabling interception or tampering with network traffic in a man-in-the-middle position.
6. An organization's remote workers use a virtual private network (VPN) to access internal
company assets. To prevent session hijacking during transit, which protocol suite should be
deployed on the VPN gateway?
A. Telnet
B. IPsec
C. HTTP
D. SNMPv2
IPsec (Internet Protocol Security) provides end-to-end security at the Network Layer by
authenticating and encrypting each IP packet in a communication session, guaranteeing both
confidentiality and integrity for remote access tunnels.
,7. A chief information security officer (CISO) is formulating a strategy to lower the risk of
insider threat data exfiltration. Which technical control specifically inspects outgoing
network traffic for sensitive corporate data markers?
A. Intrusion Prevention System (IPS)
B. Data Loss Prevention (DLP)
C. Web Application Firewall (WAF)
D. Network Address Translation (NAT)
Data Loss Prevention (DLP) solutions monitor, detect, and block sensitive data in use, in
motion, and at rest. Endpoint and network DLP prevent unauthorized transfers of confidential
files or information outside the perimeter.
8. During a security audit, an administrator identifies several unpatched server operating
systems running obsolete service packs. Which vulnerability management phase is required
immediately to minimize threat exploitation?
A. Threat hunting
B. Patch management
C. Penetration testing
D. Incident response
Patch management involves identifying, acquiring, testing, and installing code updates
(patches) on deployment systems to address security flaws and operational software
vulnerabilities before adversaries can exploit them.
9. A systems engineer must establish non-repudiation for email communications sent by
corporate executives. Which technology should be implemented?
A. SHA-256 hashing alone
B. Asymmetric encryption with digital signatures
C. Symmetric AES-256 encryption
D. Obfuscation scripts
Digital signatures utilize asymmetric cryptography (private keys to sign, public keys to verify)
to provide non-repudiation and integrity, ensuring the sender cannot plausibly deny having
generated and transmitted the message.
10. An IT team wants to isolate vulnerable legacy accounting software from the rest of the
production network without purchasing new hardware. Which method provides logical
separation?
A. Installing a physical hub
B. Creating a Virtual Local Area Network (VLAN)
C. Implementing air-gapping
, D. Enabling port mirroring
A Virtual Local Area Network (VLAN) logically segments a physical network switch into
separate broadcast domains, allowing security teams to restrict traffic between legacy
applications and sensitive infrastructure via network access control lists.
11. A developer accidentally hardcodes an API secret key into a public source code
repository. A security scanner flags the upload. What risk mitigation action must be
executed first?
A. Revoke and invalidate the exposed API key
B. Re-index the public code repository
C. Send a formal warning letter to the software developer
D. Reinstall the local development environment
Once a credential or cryptographic secret is exposed publicly, it must be considered
compromised immediately. Revoking and replacing the key terminates potential
unauthorized access before exploitation can take place.
12. A security operation center (SOC) analyst notes high volumes of outbound traffic to a
known malicious IP address originating from an internal workstation at 2:00 AM. What is
the immediate incident response step?
A. Erase the workstation hard drive
B. Isolate the workstation from the network
C. Submit a purchase order for new security software
D. Notify external law enforcement authorities
The containment phase of incident response mandates isolating affected systems to stop
potential malware propagation or ongoing exfiltration while preserving evidence for forensic
examination.
13. A company implements a security control where no single employee possesses sufficient
authority to execute a high-risk financial transfer independently. This practice is known as:
A. Least privilege
B. Job rotation
C. Separation of duties
D. Mandatory access control
Separation of duties splits critical business functions across multiple individuals so that no
single employee has end-to-end control, reducing fraudulent activity and accidental errors.
