COMPTIA SECURITY+ SY0-701
EXAM PREP TEST BANK: 600
DOMAIN-ALIGNED PRACTICE
QUESTIONS WITH CORRECT
ANSWERS AND EXPLANATIONS
Q1. What is the PRIMARY goal of the principle of least privilege?
A. Improve system performance
B. Reduce administrative overhead
C. Limit user access to only what is necessary
D. Enforce strong authentication
Correct Answer: C
Explanation: Least privilege grants users only the minimum access
needed to perform their job, reducing attack surface and misuse risk.
Q2. Which of the following is used to add extra complexity before
using a one-way data transformation algorithm?
A. Key stretching
B. Data masking
C. Steganography
D. Salting
Correct Answer: D
Explanation: Salting adds random data to a password before hashing,
preventing identical passwords from producing the same hash.
Q3. Which cryptographic concept ensures that a sender cannot
deny having sent a message?
A. Non-repudiation
B. Confidentiality
C. Integrity
D. Availability
,Correct Answer: A
Explanation: Non-repudiation proves the sender sent the message, often
through digital signatures.
Q4. A security administrator is implementing controls to protect
the confidentiality of data at rest. Which should they use?
A. Hashing
B. Digital signatures
C. Encryption
D. Steganography
Correct Answer: C
Explanation: Encryption protects confidentiality by converting plaintext
into ciphertext.
Q5. What is the primary function of a hashing algorithm?
A. Encrypt data for confidentiality
B. Verify data integrity
C. Compress data for storage
D. Obfuscate data for privacy
Correct Answer: B
Explanation: Hashing produces a fixed-size digest used to verify that
data has not changed.
Q6. Which threat actor is MOST likely to be hired by a foreign
government to attack critical systems?
A. Hacktivist
B. Whistleblower
C. Organized crime
D. Unskilled attacker
Correct Answer: C
Explanation: Organized crime groups are often financially motivated and
may conduct attacks on behalf of nation-states.
,Q7. An employee clicks a link in an email from a payment website
and enters login information but receives a “page not found”
error. Which attack occurred?
A. Brand impersonation
B. Pretexting
C. Typosquatting
D. Phishing
Correct Answer: D
Explanation: Phishing impersonates a legitimate entity to trick users into
revealing credentials.
Q8. Which scenario describes a possible business email
compromise (BEC) attack?
A. An employee receives a gift card request in an email with an
executive’s name in the subject line.
B. An attacker floods a network to make a service unavailable.
C. A user downloads a malicious attachment that encrypts files.
D. An attacker intercepts communication between two parties.
Correct Answer: A
Explanation: BEC often impersonates executives to trick employees into
transferring funds or buying gift cards.
Q9. A healthcare company experienced a phishing incident
leading to unauthorized email access. Which control BEST
prevents a similar incident?
A. Deploy multifactor authentication (MFA).
B. Install bollards outside the entrance.
C. Enable SIEM alerting.
D. Conduct vulnerability scans.
Correct Answer: A
Explanation: MFA adds a layer beyond passwords, so stolen credentials
alone are not enough.
, Q10. Which is a characteristic of a zero-day vulnerability?
A. It has been patched by the vendor.
B. It is exploited before a patch is available.
C. It is only exploitable by nation-state actors.
D. It affects only legacy systems.
Correct Answer: B
Explanation: A zero-day is unknown to the vendor and has no available
patch when exploited.
Q11. An enterprise wants to limit outbound DNS to one device at
10.50.10.25. Which firewall ACL accomplishes this?
A. Permit all DNS; deny 10.50.10.25 DNS
B. Permit all DNS to 10.50.10.25; deny all DNS
C. Permit all DNS; deny all DNS from 10.50.10.25
D. Permit 10.50.10.25 DNS; deny all other DNS
Correct Answer: D
Explanation: The ACL must permit DNS from the approved host and deny
all other DNS traffic.
Q12. Under the shared responsibility model, which is the cloud
customer’s responsibility?
A. Physical security of the data center
B. Encryption of data at rest
C. Hypervisor security
D. Network infrastructure security
Correct Answer: B
Explanation: Customers are generally responsible for securing their
data, including encryption.
Q13. Which is a benefit of Zero Trust architecture?
A. It eliminates the need for a firewall.
EXAM PREP TEST BANK: 600
DOMAIN-ALIGNED PRACTICE
QUESTIONS WITH CORRECT
ANSWERS AND EXPLANATIONS
Q1. What is the PRIMARY goal of the principle of least privilege?
A. Improve system performance
B. Reduce administrative overhead
C. Limit user access to only what is necessary
D. Enforce strong authentication
Correct Answer: C
Explanation: Least privilege grants users only the minimum access
needed to perform their job, reducing attack surface and misuse risk.
Q2. Which of the following is used to add extra complexity before
using a one-way data transformation algorithm?
A. Key stretching
B. Data masking
C. Steganography
D. Salting
Correct Answer: D
Explanation: Salting adds random data to a password before hashing,
preventing identical passwords from producing the same hash.
Q3. Which cryptographic concept ensures that a sender cannot
deny having sent a message?
A. Non-repudiation
B. Confidentiality
C. Integrity
D. Availability
,Correct Answer: A
Explanation: Non-repudiation proves the sender sent the message, often
through digital signatures.
Q4. A security administrator is implementing controls to protect
the confidentiality of data at rest. Which should they use?
A. Hashing
B. Digital signatures
C. Encryption
D. Steganography
Correct Answer: C
Explanation: Encryption protects confidentiality by converting plaintext
into ciphertext.
Q5. What is the primary function of a hashing algorithm?
A. Encrypt data for confidentiality
B. Verify data integrity
C. Compress data for storage
D. Obfuscate data for privacy
Correct Answer: B
Explanation: Hashing produces a fixed-size digest used to verify that
data has not changed.
Q6. Which threat actor is MOST likely to be hired by a foreign
government to attack critical systems?
A. Hacktivist
B. Whistleblower
C. Organized crime
D. Unskilled attacker
Correct Answer: C
Explanation: Organized crime groups are often financially motivated and
may conduct attacks on behalf of nation-states.
,Q7. An employee clicks a link in an email from a payment website
and enters login information but receives a “page not found”
error. Which attack occurred?
A. Brand impersonation
B. Pretexting
C. Typosquatting
D. Phishing
Correct Answer: D
Explanation: Phishing impersonates a legitimate entity to trick users into
revealing credentials.
Q8. Which scenario describes a possible business email
compromise (BEC) attack?
A. An employee receives a gift card request in an email with an
executive’s name in the subject line.
B. An attacker floods a network to make a service unavailable.
C. A user downloads a malicious attachment that encrypts files.
D. An attacker intercepts communication between two parties.
Correct Answer: A
Explanation: BEC often impersonates executives to trick employees into
transferring funds or buying gift cards.
Q9. A healthcare company experienced a phishing incident
leading to unauthorized email access. Which control BEST
prevents a similar incident?
A. Deploy multifactor authentication (MFA).
B. Install bollards outside the entrance.
C. Enable SIEM alerting.
D. Conduct vulnerability scans.
Correct Answer: A
Explanation: MFA adds a layer beyond passwords, so stolen credentials
alone are not enough.
, Q10. Which is a characteristic of a zero-day vulnerability?
A. It has been patched by the vendor.
B. It is exploited before a patch is available.
C. It is only exploitable by nation-state actors.
D. It affects only legacy systems.
Correct Answer: B
Explanation: A zero-day is unknown to the vendor and has no available
patch when exploited.
Q11. An enterprise wants to limit outbound DNS to one device at
10.50.10.25. Which firewall ACL accomplishes this?
A. Permit all DNS; deny 10.50.10.25 DNS
B. Permit all DNS to 10.50.10.25; deny all DNS
C. Permit all DNS; deny all DNS from 10.50.10.25
D. Permit 10.50.10.25 DNS; deny all other DNS
Correct Answer: D
Explanation: The ACL must permit DNS from the approved host and deny
all other DNS traffic.
Q12. Under the shared responsibility model, which is the cloud
customer’s responsibility?
A. Physical security of the data center
B. Encryption of data at rest
C. Hypervisor security
D. Network infrastructure security
Correct Answer: B
Explanation: Customers are generally responsible for securing their
data, including encryption.
Q13. Which is a benefit of Zero Trust architecture?
A. It eliminates the need for a firewall.
