CompTIA Security+ SY0-701 2025 — 60 Practice Questions
Verified Answers with Rationales
Series:
CrashCourses Professional Study Series
Author:
Dr Z. Moomba, MBChB, MRCPsych | BethelWellness Ltd
Exam Target:
CompTIA Security+
Year:
2025/2026
Format:
60 Questions with Verified Answers and Rationales
>
Author's Note:
This document is an original work produced for the CrashCourses Professional Study Series.
Clinical questions and professional scenarios were composed by Dr Z. Moomba based on current
exam objectives, published guidelines, and evidence-based sources (2024–2025). All patient
names, ages, and case details are fictional. Any resemblance to existing published Q&A banks is
coincidental. For personal study use only — not for reproduction or redistribution.
PART 1: CORE PRINCIPLES & FOUNDATIONS
Question 1
A database administrator at a regional clinic is deploying a new patient management system. Their
primary directive is to guarantee that medical records remain completely unmodified by malicious
actors or unauthorized staff. Which fundamental security concept is being prioritized here?
A) The prevention of unauthorized data access (Confidentiality)
B) The assurance of data accuracy and unalterability (Integrity)
C) The reliable accessibility of systems (Availability)
D) The inability to deny a transaction (Non-repudiation)
E) The verification of user identity (Authentication)
,Answer: B
Rationale:
Lead: Integrity is the core principle that guarantees information has not been improperly
modified, corrupted, or destroyed.
Discriminator: The scenario explicitly focuses on ensuring records remain "completely
unmodified," which directly aligns with the integrity component of the CIA triad.
Distractor: Confidentiality (A) is tempting because it involves unauthorized actors, but it
pertains to unauthorized viewing, not unauthorized modification.
Examiner Insight: Cryptographic hash functions (such as SHA-256) are standard mechanisms
deployed to mathematically prove data integrity. [NIST SP 800-53]
Question 2
During a routine compliance check, a corporate auditor notices that junior marketing staff have
read/write access to the engineering source code repositories. The auditor mandates a security
model where employees are granted only the exact permissions needed to execute their specific
daily tasks. Which principle is being enforced?
A) Role-oriented permission models (RBAC)
B) System-enforced access classifications (MAC)
C) The doctrine of minimal necessary access (Least Privilege)
D) Division of critical responsibilities (Separation of Duties)
E) Assume-breach network architecture (Zero Trust)
Answer: C
Rationale:
Lead: The principle of least privilege dictates granting users the bare minimum access rights
required to perform their authorized functions and nothing more.
Discriminator: The mandate to grant "only the exact permissions needed to execute their
specific daily tasks" is the textbook definition of least privilege.
Distractor: RBAC (A) is a method to implement access control, but the underlying security
doctrine being violated and corrected is least privilege.
High-Yield Point: Strictly enforcing least privilege drastically limits the potential blast radius if a
user's account is ever compromised. [CISA Zero Trust Maturity Model 2024]
Question 3
, A network operations center (NOC) detects an overwhelming surge in inbound network traffic to
their primary e-commerce gateway. The malicious traffic is composed of fragmented UDP packets
originating from thousands of distinct, globally distributed IP addresses. What is the most likely
classification for this event?
A) Coordinated bandwidth exhaustion (DDoS)
B) Database query manipulation (SQL Injection)
C) Malicious client-side script injection (XSS)
D) On-path traffic interception (MitM)
E) Memory allocation exploitation (Buffer Overflow)
Answer: A
Rationale:
Lead: A Distributed Denial of Service (DDoS) attack leverages multiple compromised systems
(a botnet) to flood a target with superfluous traffic, disrupting legitimate service.
Discriminator: The hallmark of this attack is the combination of "thousands of distinct, globally
distributed IP addresses" and an "overwhelming surge" of traffic aimed at exhaustion.
Distractor: Buffer overflow (E) is an application-layer attack targeting memory space, not a
volumetric network-layer flood.
Clinical Pearl: Modern volumetric DDoS attacks are typically mitigated using cloud-based
scrubbing centers and Anycast IP routing. [CompTIA Security+ SY0-701 Objectives]
Question 4
A government agency is restructuring its cybersecurity posture to align with the latest NIST
Cybersecurity Framework (CSF) 2.0 guidelines. The steering committee is establishing a new
foundational pillar that emphasizes organizational risk strategy, supply chain oversight, and policy
management. Which newly introduced CSF 2.0 core function does this represent?
A) Shielding assets (Protect)
B) Reacting to breaches (Respond)
C) Strategic risk oversight (Govern)
D) Asset and risk visibility (Identify)
E) Restoring operations (Recover)
Answer: C
Rationale:
Verified Answers with Rationales
Series:
CrashCourses Professional Study Series
Author:
Dr Z. Moomba, MBChB, MRCPsych | BethelWellness Ltd
Exam Target:
CompTIA Security+
Year:
2025/2026
Format:
60 Questions with Verified Answers and Rationales
>
Author's Note:
This document is an original work produced for the CrashCourses Professional Study Series.
Clinical questions and professional scenarios were composed by Dr Z. Moomba based on current
exam objectives, published guidelines, and evidence-based sources (2024–2025). All patient
names, ages, and case details are fictional. Any resemblance to existing published Q&A banks is
coincidental. For personal study use only — not for reproduction or redistribution.
PART 1: CORE PRINCIPLES & FOUNDATIONS
Question 1
A database administrator at a regional clinic is deploying a new patient management system. Their
primary directive is to guarantee that medical records remain completely unmodified by malicious
actors or unauthorized staff. Which fundamental security concept is being prioritized here?
A) The prevention of unauthorized data access (Confidentiality)
B) The assurance of data accuracy and unalterability (Integrity)
C) The reliable accessibility of systems (Availability)
D) The inability to deny a transaction (Non-repudiation)
E) The verification of user identity (Authentication)
,Answer: B
Rationale:
Lead: Integrity is the core principle that guarantees information has not been improperly
modified, corrupted, or destroyed.
Discriminator: The scenario explicitly focuses on ensuring records remain "completely
unmodified," which directly aligns with the integrity component of the CIA triad.
Distractor: Confidentiality (A) is tempting because it involves unauthorized actors, but it
pertains to unauthorized viewing, not unauthorized modification.
Examiner Insight: Cryptographic hash functions (such as SHA-256) are standard mechanisms
deployed to mathematically prove data integrity. [NIST SP 800-53]
Question 2
During a routine compliance check, a corporate auditor notices that junior marketing staff have
read/write access to the engineering source code repositories. The auditor mandates a security
model where employees are granted only the exact permissions needed to execute their specific
daily tasks. Which principle is being enforced?
A) Role-oriented permission models (RBAC)
B) System-enforced access classifications (MAC)
C) The doctrine of minimal necessary access (Least Privilege)
D) Division of critical responsibilities (Separation of Duties)
E) Assume-breach network architecture (Zero Trust)
Answer: C
Rationale:
Lead: The principle of least privilege dictates granting users the bare minimum access rights
required to perform their authorized functions and nothing more.
Discriminator: The mandate to grant "only the exact permissions needed to execute their
specific daily tasks" is the textbook definition of least privilege.
Distractor: RBAC (A) is a method to implement access control, but the underlying security
doctrine being violated and corrected is least privilege.
High-Yield Point: Strictly enforcing least privilege drastically limits the potential blast radius if a
user's account is ever compromised. [CISA Zero Trust Maturity Model 2024]
Question 3
, A network operations center (NOC) detects an overwhelming surge in inbound network traffic to
their primary e-commerce gateway. The malicious traffic is composed of fragmented UDP packets
originating from thousands of distinct, globally distributed IP addresses. What is the most likely
classification for this event?
A) Coordinated bandwidth exhaustion (DDoS)
B) Database query manipulation (SQL Injection)
C) Malicious client-side script injection (XSS)
D) On-path traffic interception (MitM)
E) Memory allocation exploitation (Buffer Overflow)
Answer: A
Rationale:
Lead: A Distributed Denial of Service (DDoS) attack leverages multiple compromised systems
(a botnet) to flood a target with superfluous traffic, disrupting legitimate service.
Discriminator: The hallmark of this attack is the combination of "thousands of distinct, globally
distributed IP addresses" and an "overwhelming surge" of traffic aimed at exhaustion.
Distractor: Buffer overflow (E) is an application-layer attack targeting memory space, not a
volumetric network-layer flood.
Clinical Pearl: Modern volumetric DDoS attacks are typically mitigated using cloud-based
scrubbing centers and Anycast IP routing. [CompTIA Security+ SY0-701 Objectives]
Question 4
A government agency is restructuring its cybersecurity posture to align with the latest NIST
Cybersecurity Framework (CSF) 2.0 guidelines. The steering committee is establishing a new
foundational pillar that emphasizes organizational risk strategy, supply chain oversight, and policy
management. Which newly introduced CSF 2.0 core function does this represent?
A) Shielding assets (Protect)
B) Reacting to breaches (Respond)
C) Strategic risk oversight (Govern)
D) Asset and risk visibility (Identify)
E) Restoring operations (Recover)
Answer: C
Rationale:
