CompTIA Security+ (SY0-701) – 2026/2027 –
Questions & Verified Answers with Rationales
– Grade A+
Introduction
The CompTIA Security+ (SY0-701) certification validates the baseline skills
necessary to perform core security functions and pursue an IT security career. The
exam consists of a maximum of 90 questions to be completed in 90 minutes, with
a passing score of 750 on a scale of 100–900. The exam includes multiple-choice,
multiple-select (SATA), and performance-based questions (PBQs).
The SY0-701 exam covers five domains with the following weights:
Domain Weight
1.0 General Security Concepts 12%
2.0 Threats, Vulnerabilities, and Mitigations 22%
3.0 Security Architecture 18%
4.0 Security Operations 28%
5.0 Security Program Management and Oversight 20%
Instructions: Select the BEST answer for each question. For SATA (Select All That
Apply) questions, select all correct answers. Performance-based question
simulations are included where indicated.
Domain 1: General Security Concepts (Questions 1–24)
,Question 1
A security analyst is reviewing the organization's security framework and notes
that the primary goal is to ensure that data is accessible only to authorized users
when needed. Which core security principle is being prioritized?
A. Integrity
B. Confidentiality
C. Availability
D. Non-repudiation
Correct Answer: B
Rationale: Confidentiality ensures that data is accessible only to
authorized users. Integrity ensures data has not been altered. Availability ensures
data is accessible when needed. Non-repudiation ensures a user cannot deny an
action. The scenario describes preventing unauthorized access, which is the
definition of confidentiality.
Question 2
A financial services company wants to ensure that a customer cannot later deny
having authorized a wire transfer. Which security control should be
implemented?
A. Encryption
B. Digital signatures
C. Access control lists
D. Hashing
Correct Answer: B
Rationale: Non-repudiation prevents a party from denying an action.
Digital signatures provide non-repudiation by cryptographically binding a user's
identity to a transaction. Encryption provides confidentiality. ACLs provide access
control. Hashing provides integrity verification.
,Question 3
Which of the following BEST describes the principle of least privilege?
A. Users should have access to all resources to perform their job efficiently
B. Users should have the minimum level of access necessary to perform their job
functions
C. Users should have their access reviewed annually
D. Users should share accounts to reduce administrative overhead
Correct Answer: B
Rationale: The principle of least privilege dictates that users should be
granted only the minimum permissions required to perform their job duties. This
reduces the attack surface and limits potential damage from compromised
accounts.
Question 4
Which of the following is an example of a physical control?
A. Firewall rules
B. Biometric access reader
C. Password policy
D. Encryption algorithm
Correct Answer: B
Rationale: Physical controls are tangible measures that prevent or detect
unauthorized physical access. Biometric readers (fingerprint, retina scanners) are
physical security devices. Firewall rules and encryption are technical controls.
Password policies are administrative controls.
Question 5
A security administrator is implementing a defense-in-depth strategy. Which of
the following BEST describes this approach?
A. Using a single, powerful security solution
B. Implementing multiple layers of security controls
, C. Focusing exclusively on perimeter security
D. Relying solely on employee training
Correct Answer: B
Rationale: Defense-in-depth involves implementing multiple layers of
security controls throughout an environment so that if one layer fails, others
remain in place to protect assets.
Question 6
Which type of security control is designed to discourage an attacker from
attempting an attack?
A. Preventive
B. Detective
C. Deterrent
D. Compensating
Correct Answer: C
Rationale: Deterrent controls are designed to discourage attackers.
Examples include warning signs, security cameras, and visible security personnel.
Preventive controls stop attacks. Detective controls identify attacks.
Compensating controls provide alternative measures when primary controls are
not feasible.
Question 7
A company wants to implement a control that will detect unauthorized changes
to a critical file. Which technology should be used?
A. Encryption
B. File integrity monitoring (FIM)
C. Data loss prevention (DLP)
D. Load balancing
Correct Answer: B
Questions & Verified Answers with Rationales
– Grade A+
Introduction
The CompTIA Security+ (SY0-701) certification validates the baseline skills
necessary to perform core security functions and pursue an IT security career. The
exam consists of a maximum of 90 questions to be completed in 90 minutes, with
a passing score of 750 on a scale of 100–900. The exam includes multiple-choice,
multiple-select (SATA), and performance-based questions (PBQs).
The SY0-701 exam covers five domains with the following weights:
Domain Weight
1.0 General Security Concepts 12%
2.0 Threats, Vulnerabilities, and Mitigations 22%
3.0 Security Architecture 18%
4.0 Security Operations 28%
5.0 Security Program Management and Oversight 20%
Instructions: Select the BEST answer for each question. For SATA (Select All That
Apply) questions, select all correct answers. Performance-based question
simulations are included where indicated.
Domain 1: General Security Concepts (Questions 1–24)
,Question 1
A security analyst is reviewing the organization's security framework and notes
that the primary goal is to ensure that data is accessible only to authorized users
when needed. Which core security principle is being prioritized?
A. Integrity
B. Confidentiality
C. Availability
D. Non-repudiation
Correct Answer: B
Rationale: Confidentiality ensures that data is accessible only to
authorized users. Integrity ensures data has not been altered. Availability ensures
data is accessible when needed. Non-repudiation ensures a user cannot deny an
action. The scenario describes preventing unauthorized access, which is the
definition of confidentiality.
Question 2
A financial services company wants to ensure that a customer cannot later deny
having authorized a wire transfer. Which security control should be
implemented?
A. Encryption
B. Digital signatures
C. Access control lists
D. Hashing
Correct Answer: B
Rationale: Non-repudiation prevents a party from denying an action.
Digital signatures provide non-repudiation by cryptographically binding a user's
identity to a transaction. Encryption provides confidentiality. ACLs provide access
control. Hashing provides integrity verification.
,Question 3
Which of the following BEST describes the principle of least privilege?
A. Users should have access to all resources to perform their job efficiently
B. Users should have the minimum level of access necessary to perform their job
functions
C. Users should have their access reviewed annually
D. Users should share accounts to reduce administrative overhead
Correct Answer: B
Rationale: The principle of least privilege dictates that users should be
granted only the minimum permissions required to perform their job duties. This
reduces the attack surface and limits potential damage from compromised
accounts.
Question 4
Which of the following is an example of a physical control?
A. Firewall rules
B. Biometric access reader
C. Password policy
D. Encryption algorithm
Correct Answer: B
Rationale: Physical controls are tangible measures that prevent or detect
unauthorized physical access. Biometric readers (fingerprint, retina scanners) are
physical security devices. Firewall rules and encryption are technical controls.
Password policies are administrative controls.
Question 5
A security administrator is implementing a defense-in-depth strategy. Which of
the following BEST describes this approach?
A. Using a single, powerful security solution
B. Implementing multiple layers of security controls
, C. Focusing exclusively on perimeter security
D. Relying solely on employee training
Correct Answer: B
Rationale: Defense-in-depth involves implementing multiple layers of
security controls throughout an environment so that if one layer fails, others
remain in place to protect assets.
Question 6
Which type of security control is designed to discourage an attacker from
attempting an attack?
A. Preventive
B. Detective
C. Deterrent
D. Compensating
Correct Answer: C
Rationale: Deterrent controls are designed to discourage attackers.
Examples include warning signs, security cameras, and visible security personnel.
Preventive controls stop attacks. Detective controls identify attacks.
Compensating controls provide alternative measures when primary controls are
not feasible.
Question 7
A company wants to implement a control that will detect unauthorized changes
to a critical file. Which technology should be used?
A. Encryption
B. File integrity monitoring (FIM)
C. Data loss prevention (DLP)
D. Load balancing
Correct Answer: B
