COMPTIA SECURITY+ SY0-701 PRACTICE
EXAMINATION – STUDY GUIDE | LATEST UPDATE
2026/2027 | ACTUAL EXAM | PRACTICE QUESTIONS
AND ANSWERS | EXAM REVIEW | 100% CORRECT
ANSWERS | VERIFIED SOLUTIONS
This comprehensive practice examination is designed for candidates preparing for
the CompTIA Security+ SY0-701 certification. It thoroughly covers the five Security+
domains: General Security Concepts; Threats, Vulnerabilities, and Mitigations;
Security Architecture; Security Operations; and Security Program Management
and Oversight. The 100 advanced multiple-choice questions reflect the depth and
style of the actual certification exam, integrating technical knowledge,
scenario-based analysis, and industry best practices. Each question is accompanied
by a detailed rationale that explains why the correct answer is best and why the
alternatives are incorrect. Use this study guide to assess your readiness, identify
knowledge gaps, and build confidence for the Security+ SY0-701 examination.
These questions are original practice items and are not from the actual exam.
Table of Contents
1. Security Fundamentals and Concepts
2. Threat Actors and Attack Vectors
3. Malware and Malicious Activity
4. Network Security and Architecture
5. Cloud and Virtualization Security
6. Identity and Access Management
7. Cryptography and Public Key Infrastructure
8. Endpoint and Application Security
9. Incident Response and Security Operations
10. Governance, Risk, and Compliance
, 1. A security analyst is reviewing firewall logs and notices multiple connection
attempts from an external IP address to port 3389 on several internal hosts.
Which type of attack is most likely occurring?
A) SQL injection
B) RDP brute-force attempt
C) DNS zone transfer
D) ARP spoofing
Correct Answer: B
Port 3389 is the default port for Remote Desktop Protocol (RDP). Repeated
connection attempts to RDP on multiple hosts suggest a brute-force or
password-guessing attack against remote desktop services. SQL injection targets
web applications, DNS zone transfer uses port 53 TCP, and ARP spoofing operates
at Layer 2, not TCP port 3389.
2. A company wants to ensure that only authorized devices can connect to its
wireless network. Which combination of technologies best achieves this?
A) WPA2-PSK with a strong passphrase
B) WPA3-Enterprise with 802.1X authentication
C) Open network with MAC filtering
D) WEP with hidden SSID
Correct Answer: B
WPA3-Enterprise uses 802.1X authentication, which requires individual user or
device credentials and prevents unauthorized access. PSK (A) uses a shared
passphrase, which is less secure for large environments. MAC filtering (C) is weak
because MAC addresses can be spoofed. WEP and hidden SSIDs (D) are obsolete or
ineffective security measures.
3. A user receives an email that appears to be from the IT department, asking
them to click a link and enter their password to verify their account. The
link goes to a fake login page. Which type of social engineering attack is
this?
A) Whaling
B) Vishing
, C) Phishing
D) Shoulder surfing
Correct Answer: C
Phishing is a social engineering attack that uses deceptive emails and fake
websites to trick users into revealing credentials. Whaling targets high-level
executives specifically. Vishing uses voice calls. Shoulder surfing is observing
someone type a password. The general nature of this scenario makes phishing the
best answer.
4. An organization has had several laptops stolen from employee vehicles. To
protect sensitive data on these devices, which technology is most
appropriate?
A) Full-disk encryption
B) Screen lock passwords
C) Cable locks
D) BIOS passwords
Correct Answer: A
Full-disk encryption protects data at rest by making the entire drive unreadable
without the decryption key. Screen locks and BIOS passwords can be bypassed or
do not protect the drive data. Cable locks deter physical theft but do not protect
data if the device is stolen. Encryption is the primary control for lost or stolen
devices.
5. Which of the following is an example of a preventive control?
A) Reviewing audit logs
B) Installing a firewall
C) Restoring from backup
D) Creating an incident report
Correct Answer: B
Preventive controls are designed to stop an incident before it occurs. A firewall
blocks unauthorized traffic proactively. Reviewing logs (A) is a detective control.
, Restoring from backup (C) is a corrective control. Creating an incident report (D) is
part of response, not prevention.
6. A security administrator wants to ensure that cryptographic keys are stored
in a secure, tamper-evident hardware device. Which of the following is the
best solution?
A) Software-based key manager
B) Hardware security module (HSM)
C) Trusted Platform Module (TPM) used only for boot integrity
D) Plaintext file with restricted permissions
Correct Answer: B
An HSM is a dedicated hardware device for generating, storing, and managing
cryptographic keys with strong physical and logical protections. A software key
manager is less secure. TPM provides platform integrity and some key storage but
is not a full key management solution. Storing keys in plaintext is never acceptable.
7. An attacker is intercepting traffic between two hosts and modifying the data
before forwarding it. Which type of attack is this?
A) Man-in-the-middle
B) Denial of service
C) DNS poisoning
D) ARP cache poisoning
Correct Answer: A
A man-in-the-middle (MITM) attack involves intercepting and potentially altering
communications between two parties without their knowledge. Denial of service
disrupts availability. DNS poisoning redirects queries to malicious IP addresses.
ARP cache poisoning can enable MITM but is a specific technique, not the overall
attack described.
8. A company wants to ensure that remote employees can securely access
internal resources. Which of the following is the most secure remote access
solution?
A) Telnet
EXAMINATION – STUDY GUIDE | LATEST UPDATE
2026/2027 | ACTUAL EXAM | PRACTICE QUESTIONS
AND ANSWERS | EXAM REVIEW | 100% CORRECT
ANSWERS | VERIFIED SOLUTIONS
This comprehensive practice examination is designed for candidates preparing for
the CompTIA Security+ SY0-701 certification. It thoroughly covers the five Security+
domains: General Security Concepts; Threats, Vulnerabilities, and Mitigations;
Security Architecture; Security Operations; and Security Program Management
and Oversight. The 100 advanced multiple-choice questions reflect the depth and
style of the actual certification exam, integrating technical knowledge,
scenario-based analysis, and industry best practices. Each question is accompanied
by a detailed rationale that explains why the correct answer is best and why the
alternatives are incorrect. Use this study guide to assess your readiness, identify
knowledge gaps, and build confidence for the Security+ SY0-701 examination.
These questions are original practice items and are not from the actual exam.
Table of Contents
1. Security Fundamentals and Concepts
2. Threat Actors and Attack Vectors
3. Malware and Malicious Activity
4. Network Security and Architecture
5. Cloud and Virtualization Security
6. Identity and Access Management
7. Cryptography and Public Key Infrastructure
8. Endpoint and Application Security
9. Incident Response and Security Operations
10. Governance, Risk, and Compliance
, 1. A security analyst is reviewing firewall logs and notices multiple connection
attempts from an external IP address to port 3389 on several internal hosts.
Which type of attack is most likely occurring?
A) SQL injection
B) RDP brute-force attempt
C) DNS zone transfer
D) ARP spoofing
Correct Answer: B
Port 3389 is the default port for Remote Desktop Protocol (RDP). Repeated
connection attempts to RDP on multiple hosts suggest a brute-force or
password-guessing attack against remote desktop services. SQL injection targets
web applications, DNS zone transfer uses port 53 TCP, and ARP spoofing operates
at Layer 2, not TCP port 3389.
2. A company wants to ensure that only authorized devices can connect to its
wireless network. Which combination of technologies best achieves this?
A) WPA2-PSK with a strong passphrase
B) WPA3-Enterprise with 802.1X authentication
C) Open network with MAC filtering
D) WEP with hidden SSID
Correct Answer: B
WPA3-Enterprise uses 802.1X authentication, which requires individual user or
device credentials and prevents unauthorized access. PSK (A) uses a shared
passphrase, which is less secure for large environments. MAC filtering (C) is weak
because MAC addresses can be spoofed. WEP and hidden SSIDs (D) are obsolete or
ineffective security measures.
3. A user receives an email that appears to be from the IT department, asking
them to click a link and enter their password to verify their account. The
link goes to a fake login page. Which type of social engineering attack is
this?
A) Whaling
B) Vishing
, C) Phishing
D) Shoulder surfing
Correct Answer: C
Phishing is a social engineering attack that uses deceptive emails and fake
websites to trick users into revealing credentials. Whaling targets high-level
executives specifically. Vishing uses voice calls. Shoulder surfing is observing
someone type a password. The general nature of this scenario makes phishing the
best answer.
4. An organization has had several laptops stolen from employee vehicles. To
protect sensitive data on these devices, which technology is most
appropriate?
A) Full-disk encryption
B) Screen lock passwords
C) Cable locks
D) BIOS passwords
Correct Answer: A
Full-disk encryption protects data at rest by making the entire drive unreadable
without the decryption key. Screen locks and BIOS passwords can be bypassed or
do not protect the drive data. Cable locks deter physical theft but do not protect
data if the device is stolen. Encryption is the primary control for lost or stolen
devices.
5. Which of the following is an example of a preventive control?
A) Reviewing audit logs
B) Installing a firewall
C) Restoring from backup
D) Creating an incident report
Correct Answer: B
Preventive controls are designed to stop an incident before it occurs. A firewall
blocks unauthorized traffic proactively. Reviewing logs (A) is a detective control.
, Restoring from backup (C) is a corrective control. Creating an incident report (D) is
part of response, not prevention.
6. A security administrator wants to ensure that cryptographic keys are stored
in a secure, tamper-evident hardware device. Which of the following is the
best solution?
A) Software-based key manager
B) Hardware security module (HSM)
C) Trusted Platform Module (TPM) used only for boot integrity
D) Plaintext file with restricted permissions
Correct Answer: B
An HSM is a dedicated hardware device for generating, storing, and managing
cryptographic keys with strong physical and logical protections. A software key
manager is less secure. TPM provides platform integrity and some key storage but
is not a full key management solution. Storing keys in plaintext is never acceptable.
7. An attacker is intercepting traffic between two hosts and modifying the data
before forwarding it. Which type of attack is this?
A) Man-in-the-middle
B) Denial of service
C) DNS poisoning
D) ARP cache poisoning
Correct Answer: A
A man-in-the-middle (MITM) attack involves intercepting and potentially altering
communications between two parties without their knowledge. Denial of service
disrupts availability. DNS poisoning redirects queries to malicious IP addresses.
ARP cache poisoning can enable MITM but is a specific technique, not the overall
attack described.
8. A company wants to ensure that remote employees can securely access
internal resources. Which of the following is the most secure remote access
solution?
A) Telnet
