CompTIA Security+ (SY0-701) 2026 260
Multiple-Choice Questions with
Rationales Performance-Based Question (PBQ)
Styles Included Table of Contents | Quiz Format |
Rationales | High-Yield Focus
TABLE OF CONTENTS
1. General Security Concepts (Questions 1–40)
2. Threats, Vulnerabilities & Mitigations (Questions 41–90)
3. Security Architecture (Questions 91–130)
4. Security Operations (Questions 131–180)
5. Security Program Management & Governance (Questions 181–
220)
6. PBQ-Style & Mixed Review (Questions 221–260)
7.
GENERAL SECURITY CONCEPTS (Questions 1–40)
Question 1 Which of the following best describes the concept of "defense
in depth"?
A. A single, powerful security control that prevents all attacks B. Multiple
layers of security controls throughout an IT environment C. Focusing
security efforts only on the perimeter firewall D. Using only physical
security measures
Correct Answer: B Rationale: Defense in depth uses layered security
(physical, technical, administrative) so that if one layer fails, others
remain. A single control (A) is not defense in depth.
,Question 2 (Select all that apply) Which of the following are examples of
the "least privilege" principle? (Select all that apply)
A. A user is given only the permissions necessary to perform their job B.
A database administrator has full access to all databases C. A temporary
contractor's account expires after 30 days D. A help desk technician can
reset passwords but cannot modify user roles E. All employees have
administrative access to their workstations
Correct Answers: A, C, D Rationale: Least privilege means granting
only necessary permissions. Contractor account expiration (C) is time-
based least privilege. Full admin (B) and all employees admin (E) violate
least privilege.
Question 3 A company wants to ensure that no single person has
complete control over a financial transaction. Which security concept is
being applied?
A. Separation of duties B. Job rotation C. Mandatory vacation D.
Privileged access management
Correct Answer: A Rationale: Separation of duties requires multiple
people to complete a critical task, reducing fraud risk. Job rotation (B)
and mandatory vacation (C) are deterrents, not the primary control.
Question 4 What is the primary purpose of a security policy?
A. To provide technical instructions for configuring firewalls B. To
document management's security requirements and expectations C. To
replace all other security controls D. To be reviewed once and never
updated
,Correct Answer: B Rationale: Security policies are high-level
documents that define management's intent. Technical instructions (A)
are procedures or standards.
Question 5 (Select all that apply) Which of the following are principles
of the CIA triad? (Select all that apply)
A. Confidentiality B. Integrity C. Availability D. Authentication E.
Authorization
Correct Answers: A, B, C Rationale: CIA triad: Confidentiality
(secrecy), Integrity (accuracy, trustworthiness), Availability (access when
needed). Authentication (D) and authorization (E) are related but not part
of CIA.
Question 6 A security breach results in customer credit card information
being stolen. Which element of the CIA triad has been most directly
violated?
A. Confidentiality B. Integrity C. Availability D. Non-repudiation
Correct Answer: A Rationale: Confidentiality ensures data is not
accessed by unauthorized parties. Integrity (B) would be altering data.
Availability (C) would be data being inaccessible.
Question 7 A database administrator accidentally deletes a critical table.
Which element of the CIA triad has been violated?
A. Confidentiality B. Integrity C. Availability D. Both B and C
Correct Answer: D Rationale: Data integrity is violated (data is no
longer accurate/complete) and availability is violated (data is not
accessible). Confidentiality (A) is not the primary violation.
, Question 8 What is non-repudiation in the context of information
security?
A. Ensuring that a user cannot deny performing an action B. Preventing
unauthorized access to data C. Ensuring data is available when needed D.
Encrypting data at rest
Correct Answer: A Rationale: Non-repudiation uses digital signatures
and audit logs to prove an action occurred. It prevents a user from
denying their actions.
Question 9 (Select all that apply) Which of the following technologies
provide non-repudiation? (Select all that apply)
A. Digital signatures B. Audit logs C. Symmetric encryption D. Hashing
(without key) E. Biometric authentication logs
Correct Answers: A, B, E Rationale: Digital signatures (A) provide
proof of origin. Audit logs (B) and biometric logs (E) provide evidence.
Symmetric encryption (C) does not provide non-repudiation (shared
secret). Hashing (D) without a key does not prove identity.
Question 10 A company implements a policy that forces users to change
their passwords every 60 days. This is an example of:
A. Technical control B. Administrative control C. Physical control D.
Detective control
Correct Answer: B Rationale: Administrative controls are policies and
procedures. Technical controls (A) are hardware/software (firewalls,
encryption). Physical controls (C) are locks, guards, fences.
Question 11 A fingerprint scanner used to control access to a data center
is an example of:
Multiple-Choice Questions with
Rationales Performance-Based Question (PBQ)
Styles Included Table of Contents | Quiz Format |
Rationales | High-Yield Focus
TABLE OF CONTENTS
1. General Security Concepts (Questions 1–40)
2. Threats, Vulnerabilities & Mitigations (Questions 41–90)
3. Security Architecture (Questions 91–130)
4. Security Operations (Questions 131–180)
5. Security Program Management & Governance (Questions 181–
220)
6. PBQ-Style & Mixed Review (Questions 221–260)
7.
GENERAL SECURITY CONCEPTS (Questions 1–40)
Question 1 Which of the following best describes the concept of "defense
in depth"?
A. A single, powerful security control that prevents all attacks B. Multiple
layers of security controls throughout an IT environment C. Focusing
security efforts only on the perimeter firewall D. Using only physical
security measures
Correct Answer: B Rationale: Defense in depth uses layered security
(physical, technical, administrative) so that if one layer fails, others
remain. A single control (A) is not defense in depth.
,Question 2 (Select all that apply) Which of the following are examples of
the "least privilege" principle? (Select all that apply)
A. A user is given only the permissions necessary to perform their job B.
A database administrator has full access to all databases C. A temporary
contractor's account expires after 30 days D. A help desk technician can
reset passwords but cannot modify user roles E. All employees have
administrative access to their workstations
Correct Answers: A, C, D Rationale: Least privilege means granting
only necessary permissions. Contractor account expiration (C) is time-
based least privilege. Full admin (B) and all employees admin (E) violate
least privilege.
Question 3 A company wants to ensure that no single person has
complete control over a financial transaction. Which security concept is
being applied?
A. Separation of duties B. Job rotation C. Mandatory vacation D.
Privileged access management
Correct Answer: A Rationale: Separation of duties requires multiple
people to complete a critical task, reducing fraud risk. Job rotation (B)
and mandatory vacation (C) are deterrents, not the primary control.
Question 4 What is the primary purpose of a security policy?
A. To provide technical instructions for configuring firewalls B. To
document management's security requirements and expectations C. To
replace all other security controls D. To be reviewed once and never
updated
,Correct Answer: B Rationale: Security policies are high-level
documents that define management's intent. Technical instructions (A)
are procedures or standards.
Question 5 (Select all that apply) Which of the following are principles
of the CIA triad? (Select all that apply)
A. Confidentiality B. Integrity C. Availability D. Authentication E.
Authorization
Correct Answers: A, B, C Rationale: CIA triad: Confidentiality
(secrecy), Integrity (accuracy, trustworthiness), Availability (access when
needed). Authentication (D) and authorization (E) are related but not part
of CIA.
Question 6 A security breach results in customer credit card information
being stolen. Which element of the CIA triad has been most directly
violated?
A. Confidentiality B. Integrity C. Availability D. Non-repudiation
Correct Answer: A Rationale: Confidentiality ensures data is not
accessed by unauthorized parties. Integrity (B) would be altering data.
Availability (C) would be data being inaccessible.
Question 7 A database administrator accidentally deletes a critical table.
Which element of the CIA triad has been violated?
A. Confidentiality B. Integrity C. Availability D. Both B and C
Correct Answer: D Rationale: Data integrity is violated (data is no
longer accurate/complete) and availability is violated (data is not
accessible). Confidentiality (A) is not the primary violation.
, Question 8 What is non-repudiation in the context of information
security?
A. Ensuring that a user cannot deny performing an action B. Preventing
unauthorized access to data C. Ensuring data is available when needed D.
Encrypting data at rest
Correct Answer: A Rationale: Non-repudiation uses digital signatures
and audit logs to prove an action occurred. It prevents a user from
denying their actions.
Question 9 (Select all that apply) Which of the following technologies
provide non-repudiation? (Select all that apply)
A. Digital signatures B. Audit logs C. Symmetric encryption D. Hashing
(without key) E. Biometric authentication logs
Correct Answers: A, B, E Rationale: Digital signatures (A) provide
proof of origin. Audit logs (B) and biometric logs (E) provide evidence.
Symmetric encryption (C) does not provide non-repudiation (shared
secret). Hashing (D) without a key does not prove identity.
Question 10 A company implements a policy that forces users to change
their passwords every 60 days. This is an example of:
A. Technical control B. Administrative control C. Physical control D.
Detective control
Correct Answer: B Rationale: Administrative controls are policies and
procedures. Technical controls (A) are hardware/software (firewalls,
encryption). Physical controls (C) are locks, guards, fences.
Question 11 A fingerprint scanner used to control access to a data center
is an example of:
