CompTIA Security+ SY0-701 Practice Exam
2026/2027 – Verified Q&As with Detailed
Rationales (Test Bank Bundle - 112
Questions)
---
**QUESTION 1:**
A security analyst observes repeated failed login attempts for a user account, followed by a successful
login from an unusual geographic location. Which type of attack is most likely occurring?
A) Brute-force attack
B) Password spraying
C) Credential stuffing
D) Session hijacking
> 🎯 **CORRECT ANSWER:** C) Credential stuffing
> 💡 **CLINICAL RATIONALE:** Repeated fails then success from new location indicates credential
stuffing. Brute-force often locks account. Spraying uses few passwords on many accounts.
---
**QUESTION 2:**
Which cryptographic algorithm provides the strongest confidentiality for data at rest?
A) AES-256
B) RC4
C) DES
D) 3DES
> 🎯 **CORRECT ANSWER:** A) AES-256
> 💡 **CLINICAL RATIONALE:** AES-256 is strongest symmetric. RC4 insecure. DES obsolete. 3DES
slower/weaker.
,---
**QUESTION 3:**
A company implements a policy requiring users to authenticate with a password and a one-time code
from a mobile app. This is an example of:
A) Single-factor authentication
B) Two-factor authentication
C) Multi-factor authentication
D) Biometric authentication
> 🎯 **CORRECT ANSWER:** B) Two-factor authentication
> 💡 **CLINICAL RATIONALE:** Password (something you know) + OTP (something you have) = 2FA.
MFA requires 3+ factors.
---
**QUESTION 4:**
Which of the following is a primary benefit of implementing a zero-trust security model?
A) Eliminates all insider threats
B) Assumes no implicit trust, even inside the network
C) Reduces network latency
D) Simplifies firewall rules
> 🎯 **CORRECT ANSWER:** B) Assumes no implicit trust, even inside the network
> 💡 **CLINICAL RATIONALE:** Zero-trust verifies every request; does not fully eliminate threats or
reduce latency.
---
**QUESTION 5:**
A system administrator needs to ensure integrity of log files. Which hashing algorithm is most
appropriate?
A) SHA-256
B) MD5
,C) RIPEMD-160
D) CRC32
> 🎯 **CORRECT ANSWER:** A) SHA-256
> 💡 **CLINICAL RATIONALE:** SHA-256 provides collision resistance. MD5/CRC32 are insecure.
RIPEMD-160 less common.
---
**QUESTION 6:**
During a penetration test, an attacker uses a SQL injection to extract database credentials. Which
mitigation is most effective against this attack?
A) Input validation and parameterized queries
B) Web application firewall only
C) Disabling database logs
D) Enforcing strong passwords
> 🎯 **CORRECT ANSWER:** A) Input validation and parameterized queries
> 💡 **CLINICAL RATIONALE:** Parameterized queries prevent SQLi. WAF helps but not sufficient alone.
---
**QUESTION 7:**
Which type of malware is designed to spread autonomously across networks without user interaction?
A) Trojan
B) Worm
C) Spyware
D) Ransomware
> 🎯 **CORRECT ANSWER:** B) Worm
> 💡 **CLINICAL RATIONALE:** Worms self-propagate. Trojans need user action. Spyware steals data.
Ransomware encrypts.
---
, **QUESTION 8:**
A security team wants to detect anomalies in network traffic. Which tool should they use?
A) SIEM
B) NIDS
C) Antivirus
D) Firewall
> 🎯 **CORRECT ANSWER:** B) NIDS
> 💡 **CLINICAL RATIONALE:** NIDS detects anomalies. SIEM aggregates logs. Firewall blocks. AV
detects malware.
---
**QUESTION 9:**
A user receives an email from a bank asking to verify their password via a link. This is best described as:
A) Phishing
B) Spear phishing
C) Whaling
D) Vishing
> 🎯 **CORRECT ANSWER:** A) Phishing
> 💡 **CLINICAL RATIONALE:** Mass email to verify credentials is phishing. Spear targets specific.
Whaling targets executives. Vishing is voice.
---
**QUESTION 10:**
Which cryptographic concept allows a user to prove they possess a private key without revealing it?
A) Digital signature
B) Symmetric encryption
C) Hash-based message authentication
D) Steganography
> 🎯 **CORRECT ANSWER:** A) Digital signature
2026/2027 – Verified Q&As with Detailed
Rationales (Test Bank Bundle - 112
Questions)
---
**QUESTION 1:**
A security analyst observes repeated failed login attempts for a user account, followed by a successful
login from an unusual geographic location. Which type of attack is most likely occurring?
A) Brute-force attack
B) Password spraying
C) Credential stuffing
D) Session hijacking
> 🎯 **CORRECT ANSWER:** C) Credential stuffing
> 💡 **CLINICAL RATIONALE:** Repeated fails then success from new location indicates credential
stuffing. Brute-force often locks account. Spraying uses few passwords on many accounts.
---
**QUESTION 2:**
Which cryptographic algorithm provides the strongest confidentiality for data at rest?
A) AES-256
B) RC4
C) DES
D) 3DES
> 🎯 **CORRECT ANSWER:** A) AES-256
> 💡 **CLINICAL RATIONALE:** AES-256 is strongest symmetric. RC4 insecure. DES obsolete. 3DES
slower/weaker.
,---
**QUESTION 3:**
A company implements a policy requiring users to authenticate with a password and a one-time code
from a mobile app. This is an example of:
A) Single-factor authentication
B) Two-factor authentication
C) Multi-factor authentication
D) Biometric authentication
> 🎯 **CORRECT ANSWER:** B) Two-factor authentication
> 💡 **CLINICAL RATIONALE:** Password (something you know) + OTP (something you have) = 2FA.
MFA requires 3+ factors.
---
**QUESTION 4:**
Which of the following is a primary benefit of implementing a zero-trust security model?
A) Eliminates all insider threats
B) Assumes no implicit trust, even inside the network
C) Reduces network latency
D) Simplifies firewall rules
> 🎯 **CORRECT ANSWER:** B) Assumes no implicit trust, even inside the network
> 💡 **CLINICAL RATIONALE:** Zero-trust verifies every request; does not fully eliminate threats or
reduce latency.
---
**QUESTION 5:**
A system administrator needs to ensure integrity of log files. Which hashing algorithm is most
appropriate?
A) SHA-256
B) MD5
,C) RIPEMD-160
D) CRC32
> 🎯 **CORRECT ANSWER:** A) SHA-256
> 💡 **CLINICAL RATIONALE:** SHA-256 provides collision resistance. MD5/CRC32 are insecure.
RIPEMD-160 less common.
---
**QUESTION 6:**
During a penetration test, an attacker uses a SQL injection to extract database credentials. Which
mitigation is most effective against this attack?
A) Input validation and parameterized queries
B) Web application firewall only
C) Disabling database logs
D) Enforcing strong passwords
> 🎯 **CORRECT ANSWER:** A) Input validation and parameterized queries
> 💡 **CLINICAL RATIONALE:** Parameterized queries prevent SQLi. WAF helps but not sufficient alone.
---
**QUESTION 7:**
Which type of malware is designed to spread autonomously across networks without user interaction?
A) Trojan
B) Worm
C) Spyware
D) Ransomware
> 🎯 **CORRECT ANSWER:** B) Worm
> 💡 **CLINICAL RATIONALE:** Worms self-propagate. Trojans need user action. Spyware steals data.
Ransomware encrypts.
---
, **QUESTION 8:**
A security team wants to detect anomalies in network traffic. Which tool should they use?
A) SIEM
B) NIDS
C) Antivirus
D) Firewall
> 🎯 **CORRECT ANSWER:** B) NIDS
> 💡 **CLINICAL RATIONALE:** NIDS detects anomalies. SIEM aggregates logs. Firewall blocks. AV
detects malware.
---
**QUESTION 9:**
A user receives an email from a bank asking to verify their password via a link. This is best described as:
A) Phishing
B) Spear phishing
C) Whaling
D) Vishing
> 🎯 **CORRECT ANSWER:** A) Phishing
> 💡 **CLINICAL RATIONALE:** Mass email to verify credentials is phishing. Spear targets specific.
Whaling targets executives. Vishing is voice.
---
**QUESTION 10:**
Which cryptographic concept allows a user to prove they possess a private key without revealing it?
A) Digital signature
B) Symmetric encryption
C) Hash-based message authentication
D) Steganography
> 🎯 **CORRECT ANSWER:** A) Digital signature
