CompTIA Security+ SY0-701 Certification Exam
Practice Questions 2026-2027
Question 1
A systems administrator has been asked to implement a solution that will make it
difficult or impossible for users to deny having performed a specific action. Which of the
following is the administrator trying to accomplish?
A. Confidentiality
B. Integrity
C. Non-repudiation
D. Availability
*Correct Answer: C. Non-repudiation. *
Rationale: Non-repudiation ensures that an individual cannot deny having performed a
specific action. This is typically achieved through digital signatures and comprehensive
audit logs .
Question 2
A security analyst is creating an inbound firewall rule to block a malicious IP address
(10.1.4.9) from accessing the organization's network. Which of the following rules
correctly fulfills this request?
A. access-list inbound deny ip source 0.0.0.0/0 destination 10.1.4.9/32
B. access-list inbound deny ip source 10.1.4.9/32 destination 0.0.0.0/0
C. access-list inbound permit ip source 10.1.4.9/32 destination 0.0.0.0/0
D. access-list inbound permit ip source 0.0.0.0/0 destination 10.1.4.9/32
*Correct Answer: B. access-list inbound deny ip source 10.1.4.9/32 destination
0.0.0.0/0. *
,Rationale: An inbound rule should block traffic originating from the malicious source IP
(10.1.4.9/32) to any destination (0.0.0.0/0) on the network. The "deny" action is required
with the attacker's IP as the source .
Question 3
Which of the following threat actors is the most likely to use common hacking tools
found on the internet to attempt to remotely compromise an organization's web server?
A. Organized crime
B. Insider threat
C. Unskilled attacker (script kiddie)
D. Nation-state actor
*Correct Answer: C. Unskilled attacker (script kiddie). *
Rationale: Script kiddies or unskilled attackers typically use readily available tools and
exploit known vulnerabilities, lacking the sophistication to develop custom exploits .
Question 4
An organization is expanding its threat surface program and is inviting external security
researchers to test the company's internet-facing application in exchange for
compensation. Which of the following best describes this program?
A. Open-source intelligence
B. Bug bounty
C. Red team
D. Penetration testing
*Correct Answer: B. Bug bounty. *
Rationale: A bug bounty program invites external security researchers to find and report
vulnerabilities in exchange for monetary compensation, effectively crowdsourcing security
testing .
,Question 5
Which of the following is the correct final step of the incident response process?
A. Containment
B. Eradication
C. Recovery
D. Lessons learned
*Correct Answer: D. Lessons learned. *
Rationale: The incident response lifecycle includes detection, containment, eradication, and
recovery, but the final step is "lessons learned" where the organization reviews the incident
to improve future response .
Question 6
Which of the following provides the details about the terms and scope of a test with a
third-party penetration tester?
A. Rules of engagement
B. Supply chain analysis
C. Right to audit clause
D. Due diligence
*Correct Answer: A. Rules of engagement. *
Rationale: Rules of engagement define the scope, boundaries, and specific terms of a
penetration test, including what systems can be tested, testing methods, and
communication protocols .
Question 7
An organization is leveraging a VPN between its headquarters and a branch location.
What type of data is the VPN primarily protecting?
A. Data in use
B. Data in transit
, C. Geographic restrictions
D. Data sovereignty
*Correct Answer: B. Data in transit. *
Rationale: A VPN encrypts data as it travels across networks, protecting data in transit
(data moving between locations) from interception by unauthorized parties .
Question 8
Which of the following would be the most helpful in restoring data in the event of a
ransomware infection?
A. Load balancing
B. Geographic dispersion
C. Encryption
D. Backups
*Correct Answer: D. Backups. *
Rationale: Regular, tested backups are the most effective defense against ransomware,
allowing organizations to restore encrypted data without paying the ransom .
Question 9
A user is contacted by a person claiming to be an executive vice president urgently
requesting that their password be reset and threatening to contact their supervisor.
Which principles of human manipulation were attempted? (Choose all that apply)
A. Authority, Trust, Scarcity
B. Authority, Intimidation, Urgency
C. Fright, Trust, Scarcity
D. Intimidation, Scarcity, Urgency
*Correct Answer: B. Authority, Intimidation, Urgency. *
Practice Questions 2026-2027
Question 1
A systems administrator has been asked to implement a solution that will make it
difficult or impossible for users to deny having performed a specific action. Which of the
following is the administrator trying to accomplish?
A. Confidentiality
B. Integrity
C. Non-repudiation
D. Availability
*Correct Answer: C. Non-repudiation. *
Rationale: Non-repudiation ensures that an individual cannot deny having performed a
specific action. This is typically achieved through digital signatures and comprehensive
audit logs .
Question 2
A security analyst is creating an inbound firewall rule to block a malicious IP address
(10.1.4.9) from accessing the organization's network. Which of the following rules
correctly fulfills this request?
A. access-list inbound deny ip source 0.0.0.0/0 destination 10.1.4.9/32
B. access-list inbound deny ip source 10.1.4.9/32 destination 0.0.0.0/0
C. access-list inbound permit ip source 10.1.4.9/32 destination 0.0.0.0/0
D. access-list inbound permit ip source 0.0.0.0/0 destination 10.1.4.9/32
*Correct Answer: B. access-list inbound deny ip source 10.1.4.9/32 destination
0.0.0.0/0. *
,Rationale: An inbound rule should block traffic originating from the malicious source IP
(10.1.4.9/32) to any destination (0.0.0.0/0) on the network. The "deny" action is required
with the attacker's IP as the source .
Question 3
Which of the following threat actors is the most likely to use common hacking tools
found on the internet to attempt to remotely compromise an organization's web server?
A. Organized crime
B. Insider threat
C. Unskilled attacker (script kiddie)
D. Nation-state actor
*Correct Answer: C. Unskilled attacker (script kiddie). *
Rationale: Script kiddies or unskilled attackers typically use readily available tools and
exploit known vulnerabilities, lacking the sophistication to develop custom exploits .
Question 4
An organization is expanding its threat surface program and is inviting external security
researchers to test the company's internet-facing application in exchange for
compensation. Which of the following best describes this program?
A. Open-source intelligence
B. Bug bounty
C. Red team
D. Penetration testing
*Correct Answer: B. Bug bounty. *
Rationale: A bug bounty program invites external security researchers to find and report
vulnerabilities in exchange for monetary compensation, effectively crowdsourcing security
testing .
,Question 5
Which of the following is the correct final step of the incident response process?
A. Containment
B. Eradication
C. Recovery
D. Lessons learned
*Correct Answer: D. Lessons learned. *
Rationale: The incident response lifecycle includes detection, containment, eradication, and
recovery, but the final step is "lessons learned" where the organization reviews the incident
to improve future response .
Question 6
Which of the following provides the details about the terms and scope of a test with a
third-party penetration tester?
A. Rules of engagement
B. Supply chain analysis
C. Right to audit clause
D. Due diligence
*Correct Answer: A. Rules of engagement. *
Rationale: Rules of engagement define the scope, boundaries, and specific terms of a
penetration test, including what systems can be tested, testing methods, and
communication protocols .
Question 7
An organization is leveraging a VPN between its headquarters and a branch location.
What type of data is the VPN primarily protecting?
A. Data in use
B. Data in transit
, C. Geographic restrictions
D. Data sovereignty
*Correct Answer: B. Data in transit. *
Rationale: A VPN encrypts data as it travels across networks, protecting data in transit
(data moving between locations) from interception by unauthorized parties .
Question 8
Which of the following would be the most helpful in restoring data in the event of a
ransomware infection?
A. Load balancing
B. Geographic dispersion
C. Encryption
D. Backups
*Correct Answer: D. Backups. *
Rationale: Regular, tested backups are the most effective defense against ransomware,
allowing organizations to restore encrypted data without paying the ransom .
Question 9
A user is contacted by a person claiming to be an executive vice president urgently
requesting that their password be reset and threatening to contact their supervisor.
Which principles of human manipulation were attempted? (Choose all that apply)
A. Authority, Trust, Scarcity
B. Authority, Intimidation, Urgency
C. Fright, Trust, Scarcity
D. Intimidation, Scarcity, Urgency
*Correct Answer: B. Authority, Intimidation, Urgency. *
