Exam Format: Multiple Choice
Total Questions: 150
Target Audience: CompTIA Security+ SY0-701 Exam Candidates
Passing Score: 750 (on a scale of 100-900)
Instructions: Choose the single best answer for each question. All rationales are
provided in italics to reinforce key concepts.
SECTION 1: GENERAL SECURITY CONCEPTS (Questions 1-30)
1. A security administrator is implementing a defense-in-depth strategy for a
financial institution. Which of the following BEST describes the fundamental
principle of this approach?
A) Installing a single comprehensive security solution to cover all threats
B) Using multiple layers of security controls so that if one fails, others remain effective
C) Focusing exclusively on perimeter security to block all external threats
D) Relying solely on encryption for all data protection needs
Answer: B
Rationale: Defense-in-depth uses multiple layers of security controls so that if one layer
fails, others continue to provide protection. This layered approach ensures redundancy and
resilience against various attack vectors .
2. A company wants to ensure that even if a user's password is compromised, an
attacker cannot access the corporate VPN without a second form of verification.
Which of the following is the BEST solution?
A) Single sign-on (SSO)
B) Mandatory Access Control (MAC)
C) Multifactor authentication (MFA)
D) Role-based access control (RBAC)
,Answer: C
Rationale: MFA requires two or more verification factors (e.g., password and a push
notification to a phone), significantly reducing the risk of account takeover even if one
factor is compromised .
3. A security analyst is conducting a penetration test and has gained access to a
system. They want to maintain access for further exploration. Which of the
following actions BEST represents this phase?
A) Scanning
B) Gaining access
C) Privilege escalation
D) Persistence
Answer: D
Rationale: Persistence involves creating backdoors or other methods to ensure continued
access to a compromised system, even after a reboot or password change. This is a key
phase after initial exploitation .
4. A network administrator is configuring a firewall to allow only traffic that is
explicitly permitted. This principle is BEST described as:
A) Implicit deny
B) Implicit allow
C) Least privilege
D) Defense in depth
Answer: A
Rationale: Implicit deny is a security principle where all traffic is blocked by default, and
only explicitly permitted traffic is allowed through. This is a fundamental concept in
firewall configuration.
5. Which of the following authentication factors is an example of "something you
have"?
, A) Password
B) Fingerprint scan
C) Smart card
D) PIN
Answer: C
Rationale: Smart cards are physical tokens that represent "something you have" as an
authentication factor. Passwords and PINs are "something you know," while fingerprints
are "something you are."
SECTION 2: THREATS, VULNERABILITIES, & MITIGATIONS
(Questions 31-70)
6. An organization experiences a widespread ransomware attack that encrypts
critical servers. The incident response team restores the servers from backups.
Which incident response phase does this represent?
A) Preparation
B) Detection and analysis
C) Containment, eradication, and recovery
D) Post-incident activity
Answer: C
Rationale: Restoring servers from backups is part of the recovery phase within
containment, eradication, and recovery. This phase aims to restore systems to normal
operation after an incident .
7. A user receives an email that appears to be from their bank, asking them to click
a link and verify their account details. The link leads to a fake website designed to
steal credentials. This type of attack is BEST described as:
A) Phishing
B) Spear phishing
C) Whaling
D) Vishing
Total Questions: 150
Target Audience: CompTIA Security+ SY0-701 Exam Candidates
Passing Score: 750 (on a scale of 100-900)
Instructions: Choose the single best answer for each question. All rationales are
provided in italics to reinforce key concepts.
SECTION 1: GENERAL SECURITY CONCEPTS (Questions 1-30)
1. A security administrator is implementing a defense-in-depth strategy for a
financial institution. Which of the following BEST describes the fundamental
principle of this approach?
A) Installing a single comprehensive security solution to cover all threats
B) Using multiple layers of security controls so that if one fails, others remain effective
C) Focusing exclusively on perimeter security to block all external threats
D) Relying solely on encryption for all data protection needs
Answer: B
Rationale: Defense-in-depth uses multiple layers of security controls so that if one layer
fails, others continue to provide protection. This layered approach ensures redundancy and
resilience against various attack vectors .
2. A company wants to ensure that even if a user's password is compromised, an
attacker cannot access the corporate VPN without a second form of verification.
Which of the following is the BEST solution?
A) Single sign-on (SSO)
B) Mandatory Access Control (MAC)
C) Multifactor authentication (MFA)
D) Role-based access control (RBAC)
,Answer: C
Rationale: MFA requires two or more verification factors (e.g., password and a push
notification to a phone), significantly reducing the risk of account takeover even if one
factor is compromised .
3. A security analyst is conducting a penetration test and has gained access to a
system. They want to maintain access for further exploration. Which of the
following actions BEST represents this phase?
A) Scanning
B) Gaining access
C) Privilege escalation
D) Persistence
Answer: D
Rationale: Persistence involves creating backdoors or other methods to ensure continued
access to a compromised system, even after a reboot or password change. This is a key
phase after initial exploitation .
4. A network administrator is configuring a firewall to allow only traffic that is
explicitly permitted. This principle is BEST described as:
A) Implicit deny
B) Implicit allow
C) Least privilege
D) Defense in depth
Answer: A
Rationale: Implicit deny is a security principle where all traffic is blocked by default, and
only explicitly permitted traffic is allowed through. This is a fundamental concept in
firewall configuration.
5. Which of the following authentication factors is an example of "something you
have"?
, A) Password
B) Fingerprint scan
C) Smart card
D) PIN
Answer: C
Rationale: Smart cards are physical tokens that represent "something you have" as an
authentication factor. Passwords and PINs are "something you know," while fingerprints
are "something you are."
SECTION 2: THREATS, VULNERABILITIES, & MITIGATIONS
(Questions 31-70)
6. An organization experiences a widespread ransomware attack that encrypts
critical servers. The incident response team restores the servers from backups.
Which incident response phase does this represent?
A) Preparation
B) Detection and analysis
C) Containment, eradication, and recovery
D) Post-incident activity
Answer: C
Rationale: Restoring servers from backups is part of the recovery phase within
containment, eradication, and recovery. This phase aims to restore systems to normal
operation after an incident .
7. A user receives an email that appears to be from their bank, asking them to click
a link and verify their account details. The link leads to a fake website designed to
steal credentials. This type of attack is BEST described as:
A) Phishing
B) Spear phishing
C) Whaling
D) Vishing
