COMPTIA SECURITY+ SY0-701 CERTIFICATION EXAM 2026/2027
COMPREHENSIVE TEST BANK WITH 200 PRACTICE QUESTIONS AND
DETAILED RATIONALE
1. A security analyst is reviewing network traffic logs and observes
multiple failed login attempts from a single external IP address against
the SSH service, followed by a single successful login from that same
IP address. Which of the following attack types is the analyst MOST
likely observing?
A. On-path attack
B. Dictionary attack
C. Man-in-the-middle attack
D. Password spraying
Correct Answer: B. Dictionary attack
Rationale: A dictionary attack uses a list of common or known
passwords to attempt to gain access to a system. The multiple failed
login attempts indicate the attacker is systematically trying many
passwords against the SSH service. The single successful login suggests
that one of the attempted passwords was correct, allowing the attacker
access. An on-path attack and man-in-the-middle attack involve
intercepting communications, while password spraying uses a single
common password against many accounts to avoid lockouts.
2. A system administrator needs to ensure that a user cannot deny
having performed a financial transaction within a critical application.
,Which of the following security principles is the administrator
primarily trying to enforce?
A. Integrity
B. Availability
C. Authorization
D. Non-repudiation
Correct Answer: D. Non-repudiation
Rationale: Non-repudiation provides assurance that someone cannot
deny the validity of their actions. It proves that an action was
performed by a specific user and that the user is responsible for it. This
is often achieved through digital signatures and audit logs. Integrity
refers to the trustworthiness of data, availability is about system
uptime, and authorization is about what a user is permitted to do.
3. During a penetration test, a tester successfully exploits a vulnerable
web application to gain a foothold on a server. The tester then
attempts to move laterally to other systems on the internal network.
Which phase of a penetration test is the tester currently executing?
A. Reconnaissance
B. Exploitation
C. Post-exploitation
D. Reporting
Correct Answer: C. Post-exploitation
Rationale: Post-exploitation is the phase after an initial compromise
where the tester explores the compromised system, escalates
privileges, and moves laterally to discover other vulnerable systems and
sensitive data. Reconnaissance is the information-gathering phase.
,Exploitation is the initial breach, and reporting is the final
documentation phase.
4. A company wants to enforce a policy that requires a user to provide
a password and a one-time code generated by a hardware token to
access the corporate VPN. This is an example of which of the
following?
A. Single-factor authentication
B. Biometric authentication
C. Multifactor authentication
D. Single sign-on
Correct Answer: C. Multifactor authentication
Rationale: Multifactor authentication (MFA) requires two or more
different factors to authenticate. The password is a knowledge factor
(something you know), and the hardware token generating a one-time
code is a possession factor (something you have). This provides stronger
security than single-factor authentication. Biometrics are a separate
factor type (something you are), and single sign-on (SSO) is a different
concept about using one set of credentials for multiple applications.
5. An organization is planning to implement a system that
automatically locks a user's account after a certain number of failed
login attempts. Which of the following security controls is being
implemented?
A. Account lockout policy
B. Password history policy
C. Password complexity policy
D. Permission auditing
, Correct Answer: A. Account lockout policy
Rationale: An account lockout policy is a security control that
automatically locks a user account after a specific number of failed
authentication attempts to prevent brute-force attacks. Password
history prevents password reuse. Password complexity requires a mix of
character types. Permission auditing involves reviewing user
permissions.
6. A company is concerned about the risk of employees plugging in
personal USB drives, which could introduce malware. Which of the
following controls would BEST mitigate this risk?
A. Implement a data loss prevention (DLP) system.
B. Disable USB ports on all workstations via group policy.
C. Implement an intrusion detection system (IDS).
D. Deploy a web application firewall (WAF).
Correct Answer: B. Disable USB ports on all workstations via group
policy.
Rationale: Disabling USB ports is a technical control that directly
prevents the use of personal USB drives. This is a preventive measure
that eliminates the risk at the source. A DLP system helps prevent data
leakage, an IDS detects intrusions, and a WAF protects web
applications; none of these are the most effective direct mitigation
against USB-borne malware.
7. An attacker uses social engineering to trick an employee into
providing their username and password over the phone. This type of
attack is known as:
COMPREHENSIVE TEST BANK WITH 200 PRACTICE QUESTIONS AND
DETAILED RATIONALE
1. A security analyst is reviewing network traffic logs and observes
multiple failed login attempts from a single external IP address against
the SSH service, followed by a single successful login from that same
IP address. Which of the following attack types is the analyst MOST
likely observing?
A. On-path attack
B. Dictionary attack
C. Man-in-the-middle attack
D. Password spraying
Correct Answer: B. Dictionary attack
Rationale: A dictionary attack uses a list of common or known
passwords to attempt to gain access to a system. The multiple failed
login attempts indicate the attacker is systematically trying many
passwords against the SSH service. The single successful login suggests
that one of the attempted passwords was correct, allowing the attacker
access. An on-path attack and man-in-the-middle attack involve
intercepting communications, while password spraying uses a single
common password against many accounts to avoid lockouts.
2. A system administrator needs to ensure that a user cannot deny
having performed a financial transaction within a critical application.
,Which of the following security principles is the administrator
primarily trying to enforce?
A. Integrity
B. Availability
C. Authorization
D. Non-repudiation
Correct Answer: D. Non-repudiation
Rationale: Non-repudiation provides assurance that someone cannot
deny the validity of their actions. It proves that an action was
performed by a specific user and that the user is responsible for it. This
is often achieved through digital signatures and audit logs. Integrity
refers to the trustworthiness of data, availability is about system
uptime, and authorization is about what a user is permitted to do.
3. During a penetration test, a tester successfully exploits a vulnerable
web application to gain a foothold on a server. The tester then
attempts to move laterally to other systems on the internal network.
Which phase of a penetration test is the tester currently executing?
A. Reconnaissance
B. Exploitation
C. Post-exploitation
D. Reporting
Correct Answer: C. Post-exploitation
Rationale: Post-exploitation is the phase after an initial compromise
where the tester explores the compromised system, escalates
privileges, and moves laterally to discover other vulnerable systems and
sensitive data. Reconnaissance is the information-gathering phase.
,Exploitation is the initial breach, and reporting is the final
documentation phase.
4. A company wants to enforce a policy that requires a user to provide
a password and a one-time code generated by a hardware token to
access the corporate VPN. This is an example of which of the
following?
A. Single-factor authentication
B. Biometric authentication
C. Multifactor authentication
D. Single sign-on
Correct Answer: C. Multifactor authentication
Rationale: Multifactor authentication (MFA) requires two or more
different factors to authenticate. The password is a knowledge factor
(something you know), and the hardware token generating a one-time
code is a possession factor (something you have). This provides stronger
security than single-factor authentication. Biometrics are a separate
factor type (something you are), and single sign-on (SSO) is a different
concept about using one set of credentials for multiple applications.
5. An organization is planning to implement a system that
automatically locks a user's account after a certain number of failed
login attempts. Which of the following security controls is being
implemented?
A. Account lockout policy
B. Password history policy
C. Password complexity policy
D. Permission auditing
, Correct Answer: A. Account lockout policy
Rationale: An account lockout policy is a security control that
automatically locks a user account after a specific number of failed
authentication attempts to prevent brute-force attacks. Password
history prevents password reuse. Password complexity requires a mix of
character types. Permission auditing involves reviewing user
permissions.
6. A company is concerned about the risk of employees plugging in
personal USB drives, which could introduce malware. Which of the
following controls would BEST mitigate this risk?
A. Implement a data loss prevention (DLP) system.
B. Disable USB ports on all workstations via group policy.
C. Implement an intrusion detection system (IDS).
D. Deploy a web application firewall (WAF).
Correct Answer: B. Disable USB ports on all workstations via group
policy.
Rationale: Disabling USB ports is a technical control that directly
prevents the use of personal USB drives. This is a preventive measure
that eliminates the risk at the source. A DLP system helps prevent data
leakage, an IDS detects intrusions, and a WAF protects web
applications; none of these are the most effective direct mitigation
against USB-borne malware.
7. An attacker uses social engineering to trick an employee into
providing their username and password over the phone. This type of
attack is known as:
