COMPTIA SECURITY+ SY0-701 PREMIUM CERTIFICATION
BANK | 2026/2027 EDITION | 220 CYBER THREAT &
NETWORK SECURITY SCENARIO QUESTIONS - GRADED A+
210 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
COMPTIA SECURITY+ SY0-701 PREMIUM CERTIFICATION BANK | 2026/2027 EDITION | 220 CYBER
THREAT & NETWORK SECURITY SCENARIO QUESTIONS - GRADED A+. It contains 210 carefully selected
questions that reflect the most current exam content and testing strategies. Each question is accompanied by a
correct answer and a detailed rationale that explains the underlying pathophysiology, pharmacology, or clinical
reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 210 Questions
Foundations - Application - Comptia Security Sy0-701 Certification BANK 2026/2027 Edition 220 Cyber
Threat & Network Security Scenario A Cybersecurity Network Security Comptia Security Undergraduate
YEAR 3 / Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
Comptia Security Sy0-701 1-35 Security, Analyst, Attack, Network, Engineer
Certification BANK 2026/2027
Edition 220 Cyber Threat &
Network Security Scenario A
Cybersecurity Network
Security Comptia Security
Undergraduate YEAR 3 /
Graduate
Analyst 36-70 Security, Server, Application, Configuring, Reviewing
Server 71-105 Security, Analyst, Email, Application, Network
Effective 106-140 Security, Analyst, Network, Server, Email
Email 141-175 Security, Analyst, Trust, Server, Attack
Reviewing 176-210 Security, Analyst, Server, Effective, Firewall
TOTAL 210 All questions include answers and detailed rationales
,Section A - Comptia Security Sy0-701 Certification BANK
2026/2027 Edition 220 Cyber Threat & Network Security
Scenario A Cybersecurity Network Security Comptia
Security Undergraduate YEAR 3 / Graduate
Q1.
During a threat-hunting engagement, an analyst discovers a process injecting code into a
legitimate system process. The injected code periodically queries a domain that has a
high entropy name and uses DNS over HTTPS to communicate. Which type of attack is
most likely occurring, and what is the best immediate containment step?
A. A rootkit; rebuild the system from B. A Trojan horse; isolate the system from
known-good media. the network and capture memory.
C. A polymorphic worm; apply the latest D. A fileless malware; disable the DNS over
patches and update antivirus signatures. HTTPS service and block the domain.
Correct: B - A Trojan horse; isolate the system from the network and capture memory.
Rationale:The scenario describes a Trojan horse that uses process injection and covert C2
channels. Isolation and memory capture preserve evidence and prevent lateral movement.
Rootkits typically modify kernel components, not just inject code. Fileless malware operates in
memory but often uses PowerShell or WMI, not necessarily DoH. Patching and AV updates
are not immediate containment for an active infection.
Q2.
A network administrator is configuring a new firewall rule set. The requirement is to allow
inbound HTTPS traffic to a web server, but only from the 192.168.1.0/24 subnet, and to
deny all other inbound traffic. Which rule set correctly implements this requirement?
A. Permit tcp any 192.168.1.0/24 443; Deny B. Permit tcp 192.168.1.0/24 any 443; Deny
ip any any ip any any
C. Deny ip any any; Permit tcp D. Permit tcp any any 443; Deny ip any any
192.168.1.0/24 any 443
Correct: B - Permit tcp 192.168.1.0/24 any 443; Deny ip any any
Rationale:The source is the 192.168.1.0/24 subnet, destination is the web server on port
443. The first rule permits this traffic, and the second denies all else. Option A incorrectly sets
the source as any and the destination as the subnet. Option C places the deny rule first,
which would block the permitted traffic. Option D allows all sources, violating the requirement.
Page 3
, Section A - Comptia Security Sy0-701 Certification BANK 2026/2027 Edition 220 Cyber Threat & Network Security Scenario A Cybersecurity
Network Security Comptia Security Undergraduate YEAR 3 / Graduate
Q3.
A security engineer is implementing a PKI solution for a large enterprise. Which of the
following practices best ensures the security of the certificate lifecycle?
A. Storing the root CA private key on a B. Using a single-tier CA hierarchy to
hardware security module (HSM) and using simplify management and reduce attack
a CRL with a short validity period. surface.
C. Relying on OCSP stapling to reduce the D. Issuing certificates with long validity
load on the CA and improve performance. periods to minimize the frequency of
renewals.
Correct: A - Storing the root CA private key on a hardware security module (HSM) and
using a CRL with a short validity period.
Rationale:An HSM protects the root CA private key, and a short CRL validity ensures timely
revocation. Single-tier hierarchies increase risk if the root is compromised. OCSP stapling is a
performance mechanism, not a security control for the lifecycle. Long validity periods increase
the impact of key compromise and make revocation more difficult.
Q4.
A security analyst is reviewing logs and notices that a user account has been locked out
due to multiple failed attempts, followed by a successful login from an unusual
geographic location. Which of the following is the most effective control to prevent this
type of attack?
A. Implementing account lockout policies B. Enforcing a strong password policy with
with a low threshold. complexity requirements.
C. Using multi-factor authentication (MFA) D. Deploying a SIEM to correlate login
on all accounts. events across the enterprise.
Correct: C - Using multi-factor authentication (MFA) on all accounts.
Rationale:MFA prevents attackers from gaining access even if they have valid credentials, as
seen in the successful login from a remote location. Account lockout policies can be
bypassed via distributed attacks. Strong passwords alone are insufficient. A SIEM is a
monitoring tool, not a preventive control.
Q5.
A security engineer is designing a secure wireless network for a corporate environment.
Which of the following configurations provides the strongest authentication and
encryption?
A. WPA2-PSK with AES and a pre-shared B. WPA3-Enterprise with 802.1X and
key of 12 characters. AES-256 encryption.
Page 4
BANK | 2026/2027 EDITION | 220 CYBER THREAT &
NETWORK SECURITY SCENARIO QUESTIONS - GRADED A+
210 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
COMPTIA SECURITY+ SY0-701 PREMIUM CERTIFICATION BANK | 2026/2027 EDITION | 220 CYBER
THREAT & NETWORK SECURITY SCENARIO QUESTIONS - GRADED A+. It contains 210 carefully selected
questions that reflect the most current exam content and testing strategies. Each question is accompanied by a
correct answer and a detailed rationale that explains the underlying pathophysiology, pharmacology, or clinical
reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 210 Questions
Foundations - Application - Comptia Security Sy0-701 Certification BANK 2026/2027 Edition 220 Cyber
Threat & Network Security Scenario A Cybersecurity Network Security Comptia Security Undergraduate
YEAR 3 / Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
Comptia Security Sy0-701 1-35 Security, Analyst, Attack, Network, Engineer
Certification BANK 2026/2027
Edition 220 Cyber Threat &
Network Security Scenario A
Cybersecurity Network
Security Comptia Security
Undergraduate YEAR 3 /
Graduate
Analyst 36-70 Security, Server, Application, Configuring, Reviewing
Server 71-105 Security, Analyst, Email, Application, Network
Effective 106-140 Security, Analyst, Network, Server, Email
Email 141-175 Security, Analyst, Trust, Server, Attack
Reviewing 176-210 Security, Analyst, Server, Effective, Firewall
TOTAL 210 All questions include answers and detailed rationales
,Section A - Comptia Security Sy0-701 Certification BANK
2026/2027 Edition 220 Cyber Threat & Network Security
Scenario A Cybersecurity Network Security Comptia
Security Undergraduate YEAR 3 / Graduate
Q1.
During a threat-hunting engagement, an analyst discovers a process injecting code into a
legitimate system process. The injected code periodically queries a domain that has a
high entropy name and uses DNS over HTTPS to communicate. Which type of attack is
most likely occurring, and what is the best immediate containment step?
A. A rootkit; rebuild the system from B. A Trojan horse; isolate the system from
known-good media. the network and capture memory.
C. A polymorphic worm; apply the latest D. A fileless malware; disable the DNS over
patches and update antivirus signatures. HTTPS service and block the domain.
Correct: B - A Trojan horse; isolate the system from the network and capture memory.
Rationale:The scenario describes a Trojan horse that uses process injection and covert C2
channels. Isolation and memory capture preserve evidence and prevent lateral movement.
Rootkits typically modify kernel components, not just inject code. Fileless malware operates in
memory but often uses PowerShell or WMI, not necessarily DoH. Patching and AV updates
are not immediate containment for an active infection.
Q2.
A network administrator is configuring a new firewall rule set. The requirement is to allow
inbound HTTPS traffic to a web server, but only from the 192.168.1.0/24 subnet, and to
deny all other inbound traffic. Which rule set correctly implements this requirement?
A. Permit tcp any 192.168.1.0/24 443; Deny B. Permit tcp 192.168.1.0/24 any 443; Deny
ip any any ip any any
C. Deny ip any any; Permit tcp D. Permit tcp any any 443; Deny ip any any
192.168.1.0/24 any 443
Correct: B - Permit tcp 192.168.1.0/24 any 443; Deny ip any any
Rationale:The source is the 192.168.1.0/24 subnet, destination is the web server on port
443. The first rule permits this traffic, and the second denies all else. Option A incorrectly sets
the source as any and the destination as the subnet. Option C places the deny rule first,
which would block the permitted traffic. Option D allows all sources, violating the requirement.
Page 3
, Section A - Comptia Security Sy0-701 Certification BANK 2026/2027 Edition 220 Cyber Threat & Network Security Scenario A Cybersecurity
Network Security Comptia Security Undergraduate YEAR 3 / Graduate
Q3.
A security engineer is implementing a PKI solution for a large enterprise. Which of the
following practices best ensures the security of the certificate lifecycle?
A. Storing the root CA private key on a B. Using a single-tier CA hierarchy to
hardware security module (HSM) and using simplify management and reduce attack
a CRL with a short validity period. surface.
C. Relying on OCSP stapling to reduce the D. Issuing certificates with long validity
load on the CA and improve performance. periods to minimize the frequency of
renewals.
Correct: A - Storing the root CA private key on a hardware security module (HSM) and
using a CRL with a short validity period.
Rationale:An HSM protects the root CA private key, and a short CRL validity ensures timely
revocation. Single-tier hierarchies increase risk if the root is compromised. OCSP stapling is a
performance mechanism, not a security control for the lifecycle. Long validity periods increase
the impact of key compromise and make revocation more difficult.
Q4.
A security analyst is reviewing logs and notices that a user account has been locked out
due to multiple failed attempts, followed by a successful login from an unusual
geographic location. Which of the following is the most effective control to prevent this
type of attack?
A. Implementing account lockout policies B. Enforcing a strong password policy with
with a low threshold. complexity requirements.
C. Using multi-factor authentication (MFA) D. Deploying a SIEM to correlate login
on all accounts. events across the enterprise.
Correct: C - Using multi-factor authentication (MFA) on all accounts.
Rationale:MFA prevents attackers from gaining access even if they have valid credentials, as
seen in the successful login from a remote location. Account lockout policies can be
bypassed via distributed attacks. Strong passwords alone are insufficient. A SIEM is a
monitoring tool, not a preventive control.
Q5.
A security engineer is designing a secure wireless network for a corporate environment.
Which of the following configurations provides the strongest authentication and
encryption?
A. WPA2-PSK with AES and a pre-shared B. WPA3-Enterprise with 802.1X and
key of 12 characters. AES-256 encryption.
Page 4
