CompTIA Security+
SY0-701
Threats, Cryptography, Identity, Risk Management & Compliance
Exam Code: SY0-701 | 60 Questions & Verified Answers
Covers All Official Exam Objectives
Domain 1: General Security Concepts
Security Controls & Frameworks
Q1. Which of the following is an example of a PREVENTIVE security control?
A. Security camera
B. Intrusion Detection System (IDS)
C. Firewall with access control rules
D. Audit log review
Answer: C. Firewall with access control rules
Preventive controls stop incidents from happening: firewalls, locks, access controls, encryption.
Detective controls identify incidents: IDS, cameras, log analysis, audit trails.
Corrective controls restore systems after an incident: backups, patch management.
Deterrent controls discourage attacks: warning banners, visible security cameras.
Q2. What is the difference between authentication, authorization, and accounting (AAA)?
A. They are three names for the same process
B. Authentication verifies identity; authorization determines access rights; accounting tracks
activity
C. Authorization verifies identity; authentication determines access rights
D. Accounting prevents unauthorized access
Answer: B. Authentication verifies identity; authorization determines access rights;
accounting tracks activity
Authentication: who are you? (username/password, biometrics, smart card).
Authorization: what are you allowed to do? (ACLs, role-based access control).
Accounting: what did you do? (audit logs, session logs, RADIUS accounting).
RADIUS and TACACS+ are common AAA server protocols.
,Q3. Which type of access control assigns permissions based on a user's job role rather than
individual identity?
A. DAC (Discretionary Access Control)
B. MAC (Mandatory Access Control)
C. RBAC (Role-Based Access Control)
D. ABAC (Attribute-Based Access Control)
Answer: C. RBAC (Role-Based Access Control)
RBAC assigns permissions to roles (e.g., 'HR Manager'), then assigns users to roles.
DAC: data owner decides who gets access (most flexible, least secure).
MAC: access based on security labels (used in government/military — most restrictive).
ABAC: access based on attributes (user department, time of day, device type) — most flexible.
Q4. What is a zero trust security model?
A. Trust all users inside the network perimeter
B. Never trust, always verify — every access request is authenticated and authorized
regardless of location
C. Only trust devices with certificates
D. Use zero passwords for simplicity
Answer: B. Never trust, always verify — every access request is authenticated and
authorized regardless of location
Zero trust assumes no implicit trust — internal or external — and requires verification of every user,
device, and request.
Key principles: verify explicitly, use least privilege access, assume breach.
Contrast with traditional perimeter security that trusted everything inside the network.
Q5. Which security concept ensures that a user cannot deny performing an action they actually
performed?
A. Confidentiality
B. Integrity
C. Non-repudiation
D. Availability
Answer: C. Non-repudiation
Non-repudiation ensures users cannot deny their actions — implemented through digital signatures,
audit logs, and certificates.
Example: a digital signature on an email proves the sender sent it and cannot deny it.
Supports legal admissibility of digital evidence.
Domain 2: Threats, Vulnerabilities & Mitigations
Attack Types & Social Engineering
, Q6. A user receives a text message claiming to be from their bank asking them to verify their
account by clicking a link. What type of attack is this?
A. Vishing
B. Phishing
C. Smishing
D. Whaling
Answer: C. Smishing
Smishing (SMS phishing) uses text messages to trick victims into clicking malicious links or
revealing credentials.
Vishing: voice calls. Phishing: email. Whaling: phishing targeting senior executives.
Spear phishing: highly targeted phishing using personalized information about the victim.
Q7. What is a watering hole attack?
A. Flooding a server with traffic
B. Compromising a website frequently visited by the intended target group
C. Intercepting network traffic at a hub
D. Attacking water utility SCADA systems
Answer: B. Compromising a website frequently visited by the intended target group
In a watering hole attack, attackers compromise a website known to be visited by their targets.
When the targets visit the site, they are infected with malware.
Name comes from predators waiting at watering holes for prey — the attacker waits for targets to
come to them.
Q8. What is the difference between a vulnerability, a threat, and a risk?
A. They are all the same
B. A threat exploits a vulnerability; a risk is the likelihood and impact of a threat exploiting a
vulnerability
C. A vulnerability is a confirmed attack; a threat is potential
D. Risk is only financial
Answer: B. A threat exploits a vulnerability; a risk is the likelihood and impact of a threat
exploiting a vulnerability
Vulnerability: a weakness in a system (unpatched software, weak password policy).
Threat: something that can exploit a vulnerability (hacker, malware, natural disaster).
Risk = Threat × Vulnerability × Impact. Risk is managed through controls.
Example: unpatched web server (vulnerability) + attackers (threat) = risk of compromise.
Q9. What type of malware disguises itself as legitimate software but performs malicious actions
when executed?
A. Worm
B. Trojan horse
C. Ransomware
D. Rootkit
SY0-701
Threats, Cryptography, Identity, Risk Management & Compliance
Exam Code: SY0-701 | 60 Questions & Verified Answers
Covers All Official Exam Objectives
Domain 1: General Security Concepts
Security Controls & Frameworks
Q1. Which of the following is an example of a PREVENTIVE security control?
A. Security camera
B. Intrusion Detection System (IDS)
C. Firewall with access control rules
D. Audit log review
Answer: C. Firewall with access control rules
Preventive controls stop incidents from happening: firewalls, locks, access controls, encryption.
Detective controls identify incidents: IDS, cameras, log analysis, audit trails.
Corrective controls restore systems after an incident: backups, patch management.
Deterrent controls discourage attacks: warning banners, visible security cameras.
Q2. What is the difference between authentication, authorization, and accounting (AAA)?
A. They are three names for the same process
B. Authentication verifies identity; authorization determines access rights; accounting tracks
activity
C. Authorization verifies identity; authentication determines access rights
D. Accounting prevents unauthorized access
Answer: B. Authentication verifies identity; authorization determines access rights;
accounting tracks activity
Authentication: who are you? (username/password, biometrics, smart card).
Authorization: what are you allowed to do? (ACLs, role-based access control).
Accounting: what did you do? (audit logs, session logs, RADIUS accounting).
RADIUS and TACACS+ are common AAA server protocols.
,Q3. Which type of access control assigns permissions based on a user's job role rather than
individual identity?
A. DAC (Discretionary Access Control)
B. MAC (Mandatory Access Control)
C. RBAC (Role-Based Access Control)
D. ABAC (Attribute-Based Access Control)
Answer: C. RBAC (Role-Based Access Control)
RBAC assigns permissions to roles (e.g., 'HR Manager'), then assigns users to roles.
DAC: data owner decides who gets access (most flexible, least secure).
MAC: access based on security labels (used in government/military — most restrictive).
ABAC: access based on attributes (user department, time of day, device type) — most flexible.
Q4. What is a zero trust security model?
A. Trust all users inside the network perimeter
B. Never trust, always verify — every access request is authenticated and authorized
regardless of location
C. Only trust devices with certificates
D. Use zero passwords for simplicity
Answer: B. Never trust, always verify — every access request is authenticated and
authorized regardless of location
Zero trust assumes no implicit trust — internal or external — and requires verification of every user,
device, and request.
Key principles: verify explicitly, use least privilege access, assume breach.
Contrast with traditional perimeter security that trusted everything inside the network.
Q5. Which security concept ensures that a user cannot deny performing an action they actually
performed?
A. Confidentiality
B. Integrity
C. Non-repudiation
D. Availability
Answer: C. Non-repudiation
Non-repudiation ensures users cannot deny their actions — implemented through digital signatures,
audit logs, and certificates.
Example: a digital signature on an email proves the sender sent it and cannot deny it.
Supports legal admissibility of digital evidence.
Domain 2: Threats, Vulnerabilities & Mitigations
Attack Types & Social Engineering
, Q6. A user receives a text message claiming to be from their bank asking them to verify their
account by clicking a link. What type of attack is this?
A. Vishing
B. Phishing
C. Smishing
D. Whaling
Answer: C. Smishing
Smishing (SMS phishing) uses text messages to trick victims into clicking malicious links or
revealing credentials.
Vishing: voice calls. Phishing: email. Whaling: phishing targeting senior executives.
Spear phishing: highly targeted phishing using personalized information about the victim.
Q7. What is a watering hole attack?
A. Flooding a server with traffic
B. Compromising a website frequently visited by the intended target group
C. Intercepting network traffic at a hub
D. Attacking water utility SCADA systems
Answer: B. Compromising a website frequently visited by the intended target group
In a watering hole attack, attackers compromise a website known to be visited by their targets.
When the targets visit the site, they are infected with malware.
Name comes from predators waiting at watering holes for prey — the attacker waits for targets to
come to them.
Q8. What is the difference between a vulnerability, a threat, and a risk?
A. They are all the same
B. A threat exploits a vulnerability; a risk is the likelihood and impact of a threat exploiting a
vulnerability
C. A vulnerability is a confirmed attack; a threat is potential
D. Risk is only financial
Answer: B. A threat exploits a vulnerability; a risk is the likelihood and impact of a threat
exploiting a vulnerability
Vulnerability: a weakness in a system (unpatched software, weak password policy).
Threat: something that can exploit a vulnerability (hacker, malware, natural disaster).
Risk = Threat × Vulnerability × Impact. Risk is managed through controls.
Example: unpatched web server (vulnerability) + attackers (threat) = risk of compromise.
Q9. What type of malware disguises itself as legitimate software but performs malicious actions
when executed?
A. Worm
B. Trojan horse
C. Ransomware
D. Rootkit
