CompTIA Security+ SY0-701 Certification Exam Practice
Questions (2026 Edition)
Original Practice Questions with Answers and Detailed
Rationales
Domain 1: General Security Concepts (Questions 1-16)
An organization implements a policy requiring all employees to use complex
passwords that are changed every 90 days. Which security principle is this policy
primarily supporting?
A) Confidentiality
B) Integrity
C) Availability
D) Non-repudiation
Answer: A) Confidentiality
Rationale: A) CORRECT: Complex password policies protect confidentiality by
ensuring only authorized users can access sensitive data. B) Incorrect: Integrity
focuses on preventing unauthorized modification of data, not access control. C)
Incorrect: Availability ensures systems and data are accessible when needed;
password policies don't directly address uptime. D) Incorrect: Non-repudiation
provides proof of action origin (e.g., digital signatures), not access restriction.
Which of the following BEST describes the concept of "least privilege"?
A) Users should have the minimum levels of access necessary to perform their job
functions
B) All users should have administrative access to simplify IT support
C) Privileges should be granted based on seniority within the organization
D) Users should share accounts to reduce licensing costs
,Answer: A) Users should have the minimum levels of access necessary to perform
their job functions
Rationale: A) CORRECT: Least privilege limits user access rights to only what is
essential for their role, reducing attack surface. B) Incorrect: Granting administrative
access to all users violates security best practices and increases risk. C) Incorrect:
Access should be based on job requirements, not tenure or seniority. D) Incorrect:
Shared accounts violate accountability principles and make auditing impossible.
A security analyst is reviewing logs and notices multiple failed login attempts from a
single IP address followed by a successful login. Which type of attack is MOST likely
occurring?
A) Phishing
B) Brute force
C) Man-in-the-middle
D) SQL injection
Answer: B) Brute force
Rationale: A) Incorrect: Phishing involves tricking users into revealing credentials via
deceptive communications, not automated login attempts. B) CORRECT: Brute force
attacks involve repeated login attempts to guess credentials, matching the pattern of
multiple failures followed by success. C) Incorrect: Man-in-the-middle attacks
intercept communications between two parties, not direct login attempts. D)
Incorrect: SQL injection targets database queries through application input fields, not
authentication systems directly.
Which of the following is a characteristic of symmetric encryption?
A) Uses a public and private key pair
B) Requires a secure channel for key exchange
C) Is slower than asymmetric encryption
D) Provides non-repudiation by default
Answer: B) Requires a secure channel for key exchange
Rationale: A) Incorrect: Public/private key pairs are used in asymmetric encryption,
not symmetric. B) CORRECT: Symmetric encryption uses the same key for
,encryption and decryption, requiring secure key exchange to prevent compromise. C)
Incorrect: Symmetric encryption is generally faster than asymmetric encryption due
to simpler algorithms. D) Incorrect: Non-repudiation requires asymmetric
cryptography (digital signatures); symmetric encryption alone cannot provide it.
An organization wants to ensure that data cannot be altered during transmission.
Which security control should they implement?
A) Encryption
B) Hashing
C) Digital signatures
D) Access controls
Answer: B) Hashing
Rationale: A) Incorrect: Encryption protects confidentiality but doesn't inherently
verify integrity without additional mechanisms. B) CORRECT: Hashing generates a
unique fixed-size value for data; any alteration changes the hash, allowing detection
of tampering. C) Incorrect: Digital signatures provide integrity AND
authentication/non-repudiation but are more complex; hashing alone suffices for
integrity verification. D) Incorrect: Access controls restrict who can access data but
don't verify if data was altered in transit.
Which of the following BEST defines "risk appetite"?
A) The total number of vulnerabilities in an organization's infrastructure
B) The amount of risk an organization is willing to accept in pursuit of its objectives
C) The cost of implementing security controls
D) The likelihood of a threat actor targeting the organization
Answer: B) The amount of risk an organization is willing to accept in pursuit of its
objectives
Rationale: A) Incorrect: This describes vulnerability count, not risk tolerance. B)
CORRECT: Risk appetite is the level of risk leadership accepts to achieve business
goals, guiding security investment decisions. C) Incorrect: This relates to control
implementation costs, not organizational risk tolerance. D) Incorrect: This describes
threat likelihood, a component of risk assessment, not appetite.
, A company implements multi-factor authentication (MFA) for all remote access.
Which type of control is MFA?
A) Preventive
B) Detective
C) Corrective
D) Compensating
Answer: A) Preventive
Rationale: A) CORRECT: MFA prevents unauthorized access by requiring multiple
verification factors before granting entry. B) Incorrect: Detective controls identify
incidents after they occur (e.g., IDS, logging); MFA stops breaches before access is
granted. C) Incorrect: Corrective controls restore systems after an incident (e.g.,
backups); MFA operates pre-incident. D) Incorrect: Compensating controls provide
alternative protection when primary controls aren't feasible; MFA is a primary
preventive control.
Which of the following is an example of a physical security control?
A) Firewall rules
B) Biometric door locks
C) Encryption protocols
D) Security awareness training
Answer: B) Biometric door locks
Rationale: A) Incorrect: Firewall rules are technical/logical controls for network
traffic. B) CORRECT: Biometric door locks are physical controls that restrict physical
access to facilities or rooms. C) Incorrect: Encryption protocols are technical
controls protecting data confidentiality. D) Incorrect: Security awareness training is
an administrative control influencing human behavior.
What is the PRIMARY purpose of a security baseline?
A) To provide a minimum standard for secure configuration of systems
B) To document all security incidents for compliance reporting
C) To calculate the financial impact of security breaches
Questions (2026 Edition)
Original Practice Questions with Answers and Detailed
Rationales
Domain 1: General Security Concepts (Questions 1-16)
An organization implements a policy requiring all employees to use complex
passwords that are changed every 90 days. Which security principle is this policy
primarily supporting?
A) Confidentiality
B) Integrity
C) Availability
D) Non-repudiation
Answer: A) Confidentiality
Rationale: A) CORRECT: Complex password policies protect confidentiality by
ensuring only authorized users can access sensitive data. B) Incorrect: Integrity
focuses on preventing unauthorized modification of data, not access control. C)
Incorrect: Availability ensures systems and data are accessible when needed;
password policies don't directly address uptime. D) Incorrect: Non-repudiation
provides proof of action origin (e.g., digital signatures), not access restriction.
Which of the following BEST describes the concept of "least privilege"?
A) Users should have the minimum levels of access necessary to perform their job
functions
B) All users should have administrative access to simplify IT support
C) Privileges should be granted based on seniority within the organization
D) Users should share accounts to reduce licensing costs
,Answer: A) Users should have the minimum levels of access necessary to perform
their job functions
Rationale: A) CORRECT: Least privilege limits user access rights to only what is
essential for their role, reducing attack surface. B) Incorrect: Granting administrative
access to all users violates security best practices and increases risk. C) Incorrect:
Access should be based on job requirements, not tenure or seniority. D) Incorrect:
Shared accounts violate accountability principles and make auditing impossible.
A security analyst is reviewing logs and notices multiple failed login attempts from a
single IP address followed by a successful login. Which type of attack is MOST likely
occurring?
A) Phishing
B) Brute force
C) Man-in-the-middle
D) SQL injection
Answer: B) Brute force
Rationale: A) Incorrect: Phishing involves tricking users into revealing credentials via
deceptive communications, not automated login attempts. B) CORRECT: Brute force
attacks involve repeated login attempts to guess credentials, matching the pattern of
multiple failures followed by success. C) Incorrect: Man-in-the-middle attacks
intercept communications between two parties, not direct login attempts. D)
Incorrect: SQL injection targets database queries through application input fields, not
authentication systems directly.
Which of the following is a characteristic of symmetric encryption?
A) Uses a public and private key pair
B) Requires a secure channel for key exchange
C) Is slower than asymmetric encryption
D) Provides non-repudiation by default
Answer: B) Requires a secure channel for key exchange
Rationale: A) Incorrect: Public/private key pairs are used in asymmetric encryption,
not symmetric. B) CORRECT: Symmetric encryption uses the same key for
,encryption and decryption, requiring secure key exchange to prevent compromise. C)
Incorrect: Symmetric encryption is generally faster than asymmetric encryption due
to simpler algorithms. D) Incorrect: Non-repudiation requires asymmetric
cryptography (digital signatures); symmetric encryption alone cannot provide it.
An organization wants to ensure that data cannot be altered during transmission.
Which security control should they implement?
A) Encryption
B) Hashing
C) Digital signatures
D) Access controls
Answer: B) Hashing
Rationale: A) Incorrect: Encryption protects confidentiality but doesn't inherently
verify integrity without additional mechanisms. B) CORRECT: Hashing generates a
unique fixed-size value for data; any alteration changes the hash, allowing detection
of tampering. C) Incorrect: Digital signatures provide integrity AND
authentication/non-repudiation but are more complex; hashing alone suffices for
integrity verification. D) Incorrect: Access controls restrict who can access data but
don't verify if data was altered in transit.
Which of the following BEST defines "risk appetite"?
A) The total number of vulnerabilities in an organization's infrastructure
B) The amount of risk an organization is willing to accept in pursuit of its objectives
C) The cost of implementing security controls
D) The likelihood of a threat actor targeting the organization
Answer: B) The amount of risk an organization is willing to accept in pursuit of its
objectives
Rationale: A) Incorrect: This describes vulnerability count, not risk tolerance. B)
CORRECT: Risk appetite is the level of risk leadership accepts to achieve business
goals, guiding security investment decisions. C) Incorrect: This relates to control
implementation costs, not organizational risk tolerance. D) Incorrect: This describes
threat likelihood, a component of risk assessment, not appetite.
, A company implements multi-factor authentication (MFA) for all remote access.
Which type of control is MFA?
A) Preventive
B) Detective
C) Corrective
D) Compensating
Answer: A) Preventive
Rationale: A) CORRECT: MFA prevents unauthorized access by requiring multiple
verification factors before granting entry. B) Incorrect: Detective controls identify
incidents after they occur (e.g., IDS, logging); MFA stops breaches before access is
granted. C) Incorrect: Corrective controls restore systems after an incident (e.g.,
backups); MFA operates pre-incident. D) Incorrect: Compensating controls provide
alternative protection when primary controls aren't feasible; MFA is a primary
preventive control.
Which of the following is an example of a physical security control?
A) Firewall rules
B) Biometric door locks
C) Encryption protocols
D) Security awareness training
Answer: B) Biometric door locks
Rationale: A) Incorrect: Firewall rules are technical/logical controls for network
traffic. B) CORRECT: Biometric door locks are physical controls that restrict physical
access to facilities or rooms. C) Incorrect: Encryption protocols are technical
controls protecting data confidentiality. D) Incorrect: Security awareness training is
an administrative control influencing human behavior.
What is the PRIMARY purpose of a security baseline?
A) To provide a minimum standard for secure configuration of systems
B) To document all security incidents for compliance reporting
C) To calculate the financial impact of security breaches
