1
CompTIA Security+ (SY0-701) Advanced
Practice Examination: Comprehensive 150-
Question Bank Covering General Security
Concepts,Threats/Vulnerabilities/Mitigatio
ns, Security Architecture, Security
Operations, and Security Program
Management with Detailed Rationales for
Cybersecurity Professionals a well detailed
one written and graded A+
upgraded
Domain 1: General Security Concepts (12%)
Question 1
A security architect is designing a new zero trust architecture for a financial services
organization. Which of the following principles is the foundational requirement of a zero trust
implementation?
, 2
A) All internal traffic is trusted by default
B) Users are authenticated once and granted persistent access
C) Every access request is continuously verified regardless of network location
D) External traffic requires multi-factor authentication but internal traffic does not
-” detailed answer 100 % correct :-”C
Rationale: Zero trust architecture eliminates implicit trust and requires continuous verification
for every access request, regardless of whether the request originates from inside or outside
the network perimeter. The core principle is "never trust, always verify".
Question 2
Which of the following security controls is preventative in nature and decreases the likelihood
of a cybersecurity breach?
A) Security information and event management (SIEM) alerts
B) Intrusion detection system (IDS)
C) Firewall rules restricting unauthorized traffic
D) Data backup and recovery procedures
-” detailed answer 100 % correct :-”C
Rationale: Firewall rules that restrict unauthorized traffic are preventative controls—they
actively block threats before they can cause harm. Detective controls (IDS, SIEM alerts) identify
issues after they occur, while corrective controls (backups) remediate damage.
Question 3
An organization is implementing a defense-in-depth strategy. Which of the following BEST
describes this approach?
A) Installing a single, comprehensive security solution
B) Layering multiple security controls so that if one fails, others remain effective
C) Focusing exclusively on perimeter security
D) Relying solely on encryption for data protection
-” detailed answer 100 % correct :-”B
Rationale: Defense-in-depth uses multiple layers of security controls so that if one layer fails,
others continue to provide protection. This layered approach ensures redundancy and resilience
against various attack vectors.
, 3
Question 4
A security administrator is configuring access controls and wants to ensure that the principle of
least privilege is enforced. Which of the following actions aligns with this principle?
A) Granting all users administrative privileges to simplify management
B) Assigning users only the permissions necessary to perform their job functions
C) Providing blanket access to all network resources
D) Allowing users to request any permission at any time
-” detailed answer 100 % correct :-”B
Rationale: The principle of least privilege dictates that users should be granted only the
minimum permissions required to perform their duties. This reduces the attack surface and
limits potential damage from compromised accounts.
Question 5
Which of the following scenarios BEST demonstrates the principle of confidentiality?
A) Ensuring that data is available when needed
B) Encrypting sensitive customer data so only authorized parties can read it
C) Maintaining backup copies of critical files
D) Logging all user access to sensitive systems
-” detailed answer 100 % correct :-”B
Rationale: Confidentiality ensures that data is accessible only to authorized individuals.
Encryption is a primary mechanism for maintaining confidentiality by making data unreadable
to unauthorized parties.
Question 6
A company is implementing a compensating control to address a security gap. Which of the
following is an example of a compensating control?
A) Installing an intrusion prevention system (IPS) instead of a firewall
B) Implementing additional manual reviews because an automated control cannot be deployed
C) Removing the vulnerable system entirely
D) Accepting the risk without any action
, 4
-” detailed answer 100 % correct :-”B
Rationale: A compensating control is an alternative measure used when the primary control
cannot be implemented. Manual reviews serve as a compensating control when automated
solutions are not feasible.
Question 7
Which of the following security control categories involves policies, procedures, and guidelines
that guide security decisions?
A) Technical controls
B) Physical controls
C) Managerial controls
D) Operational controls
-” detailed answer 100 % correct :-”C
Rationale: Managerial controls address security design and implementation through policies,
procedures, and guidelines. They establish the framework for security governance and decision-
making.
Question 8
A security analyst is reviewing the CIA triad. Which component is primarily concerned with
ensuring that data is accurate and trustworthy?
A) Confidentiality
B) Integrity
C) Availability
D) Authentication
-” detailed answer 100 % correct :-”B
Rationale: Integrity ensures that data is accurate, complete, and has not been tampered with.
This is typically achieved through hashing, digital signatures, and access controls.
Question 9
What is the primary purpose of non-repudiation in a security context?
CompTIA Security+ (SY0-701) Advanced
Practice Examination: Comprehensive 150-
Question Bank Covering General Security
Concepts,Threats/Vulnerabilities/Mitigatio
ns, Security Architecture, Security
Operations, and Security Program
Management with Detailed Rationales for
Cybersecurity Professionals a well detailed
one written and graded A+
upgraded
Domain 1: General Security Concepts (12%)
Question 1
A security architect is designing a new zero trust architecture for a financial services
organization. Which of the following principles is the foundational requirement of a zero trust
implementation?
, 2
A) All internal traffic is trusted by default
B) Users are authenticated once and granted persistent access
C) Every access request is continuously verified regardless of network location
D) External traffic requires multi-factor authentication but internal traffic does not
-” detailed answer 100 % correct :-”C
Rationale: Zero trust architecture eliminates implicit trust and requires continuous verification
for every access request, regardless of whether the request originates from inside or outside
the network perimeter. The core principle is "never trust, always verify".
Question 2
Which of the following security controls is preventative in nature and decreases the likelihood
of a cybersecurity breach?
A) Security information and event management (SIEM) alerts
B) Intrusion detection system (IDS)
C) Firewall rules restricting unauthorized traffic
D) Data backup and recovery procedures
-” detailed answer 100 % correct :-”C
Rationale: Firewall rules that restrict unauthorized traffic are preventative controls—they
actively block threats before they can cause harm. Detective controls (IDS, SIEM alerts) identify
issues after they occur, while corrective controls (backups) remediate damage.
Question 3
An organization is implementing a defense-in-depth strategy. Which of the following BEST
describes this approach?
A) Installing a single, comprehensive security solution
B) Layering multiple security controls so that if one fails, others remain effective
C) Focusing exclusively on perimeter security
D) Relying solely on encryption for data protection
-” detailed answer 100 % correct :-”B
Rationale: Defense-in-depth uses multiple layers of security controls so that if one layer fails,
others continue to provide protection. This layered approach ensures redundancy and resilience
against various attack vectors.
, 3
Question 4
A security administrator is configuring access controls and wants to ensure that the principle of
least privilege is enforced. Which of the following actions aligns with this principle?
A) Granting all users administrative privileges to simplify management
B) Assigning users only the permissions necessary to perform their job functions
C) Providing blanket access to all network resources
D) Allowing users to request any permission at any time
-” detailed answer 100 % correct :-”B
Rationale: The principle of least privilege dictates that users should be granted only the
minimum permissions required to perform their duties. This reduces the attack surface and
limits potential damage from compromised accounts.
Question 5
Which of the following scenarios BEST demonstrates the principle of confidentiality?
A) Ensuring that data is available when needed
B) Encrypting sensitive customer data so only authorized parties can read it
C) Maintaining backup copies of critical files
D) Logging all user access to sensitive systems
-” detailed answer 100 % correct :-”B
Rationale: Confidentiality ensures that data is accessible only to authorized individuals.
Encryption is a primary mechanism for maintaining confidentiality by making data unreadable
to unauthorized parties.
Question 6
A company is implementing a compensating control to address a security gap. Which of the
following is an example of a compensating control?
A) Installing an intrusion prevention system (IPS) instead of a firewall
B) Implementing additional manual reviews because an automated control cannot be deployed
C) Removing the vulnerable system entirely
D) Accepting the risk without any action
, 4
-” detailed answer 100 % correct :-”B
Rationale: A compensating control is an alternative measure used when the primary control
cannot be implemented. Manual reviews serve as a compensating control when automated
solutions are not feasible.
Question 7
Which of the following security control categories involves policies, procedures, and guidelines
that guide security decisions?
A) Technical controls
B) Physical controls
C) Managerial controls
D) Operational controls
-” detailed answer 100 % correct :-”C
Rationale: Managerial controls address security design and implementation through policies,
procedures, and guidelines. They establish the framework for security governance and decision-
making.
Question 8
A security analyst is reviewing the CIA triad. Which component is primarily concerned with
ensuring that data is accurate and trustworthy?
A) Confidentiality
B) Integrity
C) Availability
D) Authentication
-” detailed answer 100 % correct :-”B
Rationale: Integrity ensures that data is accurate, complete, and has not been tampered with.
This is typically achieved through hashing, digital signatures, and access controls.
Question 9
What is the primary purpose of non-repudiation in a security context?
