CompTIA Security+ (SY0-701) Exam | 2025/2026
Edition Real Exam Questions and Verified Answers |
Multiple-Choice & Performance-Based | 100%
Correct | Graded A+
Introduction
This resource contains 100 verified exam questions with correct answers for the
CompTIA Security+ (SY0-701) exam, updated for the 2025/2026 certification
period. Security+ verifies the baseline skills necessary to perform core security
functions, including risk management, threat analysis, architecture, and operations,
essential for an IT security career.
Topics Covered
• General Security Concepts (12%): Core security principles and
frameworks
• Threats, Vulnerabilities, and Mitigations (22%): Identifying and
addressing threats
• Security Architecture (18%): Designing secure systems and networks
• Security Operations (28%): Managing security processes and tools
• Security Program Management and Oversight (20%): Governance, risk,
and compliance
DOMAIN 1: GENERAL SECURITY CONCEPTS (12%)
Q1: What is the primary goal of confidentiality in the CIA triad?
A. Ensure data availability
B. Protect data from unauthorized access
,C. Verify data accuracy
D. Monitor network traffic
Correct Answer: B
Rationale: Confidentiality ensures that data is accessible only to authorized users
and prevents unauthorized access or disclosure. Availability ensures data is
accessible when needed. Integrity verifies data accuracy and trustworthiness.
Monitoring network traffic is an operational activity, not a CIA goal.
VERIFIED ✓ SY0-701 Domain 1.0
Q2: Which principle minimizes user access rights to only what is necessary for
their job function?
A. Separation of duties
B. Least privilege
C. Defense in depth
D. Zero trust
Correct Answer: B
Rationale: Least privilege is the security principle that grants users only the
minimum levels of access—or permissions—needed to perform their job functions.
Separation of duties divides critical functions among multiple people. Defense in
depth uses multiple layers of security. Zero trust assumes no implicit trust.
VERIFIED ✓ SY0-701 Domain 1.0
Q3: A systems administrator wants to make it difficult or impossible to deny
that someone has performed an action. What is the administrator trying to
accomplish?
A. Non-repudiation
B. Adaptive identity
C. Security zones
D. Deception and disruption
Correct Answer: A
Rationale: Non-repudiation ensures that an individual cannot deny having
,performed a particular action, typically through digital signatures and logging.
Adaptive identity adjusts authentication requirements based on risk. Security zones
segment networks. Deception and disruption are active defense techniques.
VERIFIED ✓ SY0-701 Domain 1.0
Q4: Which of the following is an example of a physical security control?
A. Firewall
B. Encryption
C. Security guard
D. Antivirus software
Correct Answer: C
Rationale: Physical security controls are tangible measures that prevent physical
access to facilities or assets. Security guards, fences, locks, and biometric access
controls are physical controls. Firewalls and antivirus are technical controls.
Encryption is a cryptographic control.
VERIFIED ✓ SY0-701 Domain 1.0
Q5: What is the difference between authentication and authorization?
A. Authentication determines permissions; authorization verifies identity
B. Authentication verifies identity; authorization determines permissions
C. Both terms mean the same thing
D. Authentication is for users; authorization is for systems
Correct Answer: B
Rationale: Authentication verifies WHO you are (identity), while authorization
determines WHAT you are allowed to do (permissions). Authentication comes
first, followed by authorization. Accounting tracks what was done (the third "A").
VERIFIED ✓ SY0-701 Domain 1.0
Q6: Which type of control decreases the likelihood of a cybersecurity breach
from occurring?
, A. Corrective
B. Transfer
C. Detective
D. Preventive
Correct Answer: D
Rationale: Preventive controls are designed to stop security incidents before they
occur. Firewalls, access controls, and encryption are preventive. Detective controls
identify incidents after they occur. Corrective controls restore systems after an
incident. Transfer controls shift risk to a third party.
VERIFIED ✓ SY0-701 Domain 1.0
Q7: Which framework provides a structured approach for managing security
and risk in an organization?
A. OSI model
B. NIST Cybersecurity Framework
C. TCP/IP model
D. Agile methodology
Correct Answer: B
Rationale: The NIST Cybersecurity Framework provides a structured approach for
managing and reducing cybersecurity risk through Identify, Protect, Detect,
Respond, and Recover functions. OSI and TCP/IP are networking models. Agile is
a software development methodology.
VERIFIED ✓ SY0-701 Domain 1.0
Q8: What is the primary purpose of a security policy?
A. To generate revenue
B. To establish rules and expectations for security behavior
C. To replace technical security controls
D. To provide legal defense only
Correct Answer: B
Rationale: Security policies establish the rules, expectations, and guidelines for
Edition Real Exam Questions and Verified Answers |
Multiple-Choice & Performance-Based | 100%
Correct | Graded A+
Introduction
This resource contains 100 verified exam questions with correct answers for the
CompTIA Security+ (SY0-701) exam, updated for the 2025/2026 certification
period. Security+ verifies the baseline skills necessary to perform core security
functions, including risk management, threat analysis, architecture, and operations,
essential for an IT security career.
Topics Covered
• General Security Concepts (12%): Core security principles and
frameworks
• Threats, Vulnerabilities, and Mitigations (22%): Identifying and
addressing threats
• Security Architecture (18%): Designing secure systems and networks
• Security Operations (28%): Managing security processes and tools
• Security Program Management and Oversight (20%): Governance, risk,
and compliance
DOMAIN 1: GENERAL SECURITY CONCEPTS (12%)
Q1: What is the primary goal of confidentiality in the CIA triad?
A. Ensure data availability
B. Protect data from unauthorized access
,C. Verify data accuracy
D. Monitor network traffic
Correct Answer: B
Rationale: Confidentiality ensures that data is accessible only to authorized users
and prevents unauthorized access or disclosure. Availability ensures data is
accessible when needed. Integrity verifies data accuracy and trustworthiness.
Monitoring network traffic is an operational activity, not a CIA goal.
VERIFIED ✓ SY0-701 Domain 1.0
Q2: Which principle minimizes user access rights to only what is necessary for
their job function?
A. Separation of duties
B. Least privilege
C. Defense in depth
D. Zero trust
Correct Answer: B
Rationale: Least privilege is the security principle that grants users only the
minimum levels of access—or permissions—needed to perform their job functions.
Separation of duties divides critical functions among multiple people. Defense in
depth uses multiple layers of security. Zero trust assumes no implicit trust.
VERIFIED ✓ SY0-701 Domain 1.0
Q3: A systems administrator wants to make it difficult or impossible to deny
that someone has performed an action. What is the administrator trying to
accomplish?
A. Non-repudiation
B. Adaptive identity
C. Security zones
D. Deception and disruption
Correct Answer: A
Rationale: Non-repudiation ensures that an individual cannot deny having
,performed a particular action, typically through digital signatures and logging.
Adaptive identity adjusts authentication requirements based on risk. Security zones
segment networks. Deception and disruption are active defense techniques.
VERIFIED ✓ SY0-701 Domain 1.0
Q4: Which of the following is an example of a physical security control?
A. Firewall
B. Encryption
C. Security guard
D. Antivirus software
Correct Answer: C
Rationale: Physical security controls are tangible measures that prevent physical
access to facilities or assets. Security guards, fences, locks, and biometric access
controls are physical controls. Firewalls and antivirus are technical controls.
Encryption is a cryptographic control.
VERIFIED ✓ SY0-701 Domain 1.0
Q5: What is the difference between authentication and authorization?
A. Authentication determines permissions; authorization verifies identity
B. Authentication verifies identity; authorization determines permissions
C. Both terms mean the same thing
D. Authentication is for users; authorization is for systems
Correct Answer: B
Rationale: Authentication verifies WHO you are (identity), while authorization
determines WHAT you are allowed to do (permissions). Authentication comes
first, followed by authorization. Accounting tracks what was done (the third "A").
VERIFIED ✓ SY0-701 Domain 1.0
Q6: Which type of control decreases the likelihood of a cybersecurity breach
from occurring?
, A. Corrective
B. Transfer
C. Detective
D. Preventive
Correct Answer: D
Rationale: Preventive controls are designed to stop security incidents before they
occur. Firewalls, access controls, and encryption are preventive. Detective controls
identify incidents after they occur. Corrective controls restore systems after an
incident. Transfer controls shift risk to a third party.
VERIFIED ✓ SY0-701 Domain 1.0
Q7: Which framework provides a structured approach for managing security
and risk in an organization?
A. OSI model
B. NIST Cybersecurity Framework
C. TCP/IP model
D. Agile methodology
Correct Answer: B
Rationale: The NIST Cybersecurity Framework provides a structured approach for
managing and reducing cybersecurity risk through Identify, Protect, Detect,
Respond, and Recover functions. OSI and TCP/IP are networking models. Agile is
a software development methodology.
VERIFIED ✓ SY0-701 Domain 1.0
Q8: What is the primary purpose of a security policy?
A. To generate revenue
B. To establish rules and expectations for security behavior
C. To replace technical security controls
D. To provide legal defense only
Correct Answer: B
Rationale: Security policies establish the rules, expectations, and guidelines for
