COMPTIA SECURITY+ SY0-601
CERTIFICATION EXAM WITH QUESTIONS
AND VERIFIED ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
1. A security analyst discovers that an organization has experienced
repeated credential-stuffing attacks against its externally accessible
web portal. Logs show thousands of authentication attempts using
usernames and passwords obtained from previous data breaches.
Which security control would BEST mitigate this specific attack?
A. Network intrusion prevention system
B. Multi-factor authentication
C. Data loss prevention
D. File integrity monitoring
Answer: B. Multi-factor authentication
Rationale: Multi-factor authentication (MFA) adds an authentication
factor beyond the compromised username and password. Even if an
attacker possesses credentials obtained from previous breaches, the
attacker would generally still need the additional factor, such as a
hardware token, authenticator application approval, or biometric
factor. An IPS may detect some attack patterns, but it does not directly
eliminate the risk created by stolen credentials.
2. A company wants to ensure that employees cannot deny having
approved a legally significant electronic transaction. Which security
concept BEST addresses this requirement?
1
,A. Availability
B. Confidentiality
C. Non-repudiation
D. Obfuscation
Answer: C. Non-repudiation
Rationale: Non-repudiation provides evidence that an individual
performed or authorized an action and cannot credibly deny having
done so later. Digital signatures are a common mechanism for
achieving non-repudiation because they can associate an
authenticated identity with a particular piece of data. Confidentiality
protects information from unauthorized disclosure, while availability
ensures authorized access when needed.
3. During an incident investigation, a security engineer discovers
that an attacker compromised a public-facing web server and then
used it as a stepping stone to access an internal database server.
Which security architecture would BEST reduce the ability of the
compromised web server to directly access sensitive internal
systems?
A. Network segmentation
B. Full-disk encryption
C. Password complexity
D. Data masking
Answer: A. Network segmentation
Rationale: Network segmentation divides a network into separate
security zones and restricts traffic between them. A public-facing web
server can be placed in a DMZ or dedicated network segment while
database servers remain in a more restricted internal segment. Proper
2
,segmentation and firewall rules limit lateral movement if the web
server is compromised.
4. An organization wants to deploy a security technology that can
identify malicious network traffic and automatically block the
traffic before it reaches internal systems. Which technology BEST
meets the requirement?
A. IDS
B. IPS
C. SIEM
D. Vulnerability scanner
Answer: B. IPS
Rationale: An intrusion prevention system (IPS) is designed to detect
malicious network activity and actively prevent or block it. An
intrusion detection system (IDS) primarily detects and alerts on
suspicious activity without necessarily blocking it. A SIEM aggregates
and analyzes security events, while a vulnerability scanner identifies
weaknesses rather than directly preventing malicious traffic.
5. A security administrator needs to investigate whether an
employee account was used to access a sensitive database at 2:00
AM. Which source would provide the MOST useful evidence?
A. Firewall configuration
B. Authentication and database logs
C. Network topology diagram
D. Password policy
Answer: B. Authentication and database logs
3
, Rationale: Authentication logs can establish whether the account
successfully authenticated at the relevant time, while database audit
logs can show what actions were performed after authentication.
Together, these records provide evidence about account usage and
database activity. A firewall configuration or network diagram does
not establish whether a particular account accessed the database.
6. A company wants to protect sensitive files stored on laptops in
case a laptop is stolen. Which technology would BEST address this
requirement?
A. Full-disk encryption
B. Network segmentation
C. Web application firewall
D. Port security
Answer: A. Full-disk encryption
Rationale: Full-disk encryption encrypts data stored on the device so
that an attacker who removes the storage device or attempts to access
the disk without proper authentication cannot easily read the protected
information. Network controls such as segmentation and port security
protect communications infrastructure but do not directly protect
locally stored data if the physical device is stolen.
7. A penetration tester sends specially crafted input into a web
application's database query field. The application incorrectly
incorporates the input into a SQL statement, allowing the tester to
retrieve unauthorized database records. Which vulnerability is
being exploited?
A. Cross-site scripting
B. SQL injection
4
CERTIFICATION EXAM WITH QUESTIONS
AND VERIFIED ANSWERS, PLUS DETAILED
RATIONALES/EXPERT VERIFIED FOR
GUARANTEED PASS 2026/LATEST
UPDATE/INSTANT DOWNLOAD PDF
1. A security analyst discovers that an organization has experienced
repeated credential-stuffing attacks against its externally accessible
web portal. Logs show thousands of authentication attempts using
usernames and passwords obtained from previous data breaches.
Which security control would BEST mitigate this specific attack?
A. Network intrusion prevention system
B. Multi-factor authentication
C. Data loss prevention
D. File integrity monitoring
Answer: B. Multi-factor authentication
Rationale: Multi-factor authentication (MFA) adds an authentication
factor beyond the compromised username and password. Even if an
attacker possesses credentials obtained from previous breaches, the
attacker would generally still need the additional factor, such as a
hardware token, authenticator application approval, or biometric
factor. An IPS may detect some attack patterns, but it does not directly
eliminate the risk created by stolen credentials.
2. A company wants to ensure that employees cannot deny having
approved a legally significant electronic transaction. Which security
concept BEST addresses this requirement?
1
,A. Availability
B. Confidentiality
C. Non-repudiation
D. Obfuscation
Answer: C. Non-repudiation
Rationale: Non-repudiation provides evidence that an individual
performed or authorized an action and cannot credibly deny having
done so later. Digital signatures are a common mechanism for
achieving non-repudiation because they can associate an
authenticated identity with a particular piece of data. Confidentiality
protects information from unauthorized disclosure, while availability
ensures authorized access when needed.
3. During an incident investigation, a security engineer discovers
that an attacker compromised a public-facing web server and then
used it as a stepping stone to access an internal database server.
Which security architecture would BEST reduce the ability of the
compromised web server to directly access sensitive internal
systems?
A. Network segmentation
B. Full-disk encryption
C. Password complexity
D. Data masking
Answer: A. Network segmentation
Rationale: Network segmentation divides a network into separate
security zones and restricts traffic between them. A public-facing web
server can be placed in a DMZ or dedicated network segment while
database servers remain in a more restricted internal segment. Proper
2
,segmentation and firewall rules limit lateral movement if the web
server is compromised.
4. An organization wants to deploy a security technology that can
identify malicious network traffic and automatically block the
traffic before it reaches internal systems. Which technology BEST
meets the requirement?
A. IDS
B. IPS
C. SIEM
D. Vulnerability scanner
Answer: B. IPS
Rationale: An intrusion prevention system (IPS) is designed to detect
malicious network activity and actively prevent or block it. An
intrusion detection system (IDS) primarily detects and alerts on
suspicious activity without necessarily blocking it. A SIEM aggregates
and analyzes security events, while a vulnerability scanner identifies
weaknesses rather than directly preventing malicious traffic.
5. A security administrator needs to investigate whether an
employee account was used to access a sensitive database at 2:00
AM. Which source would provide the MOST useful evidence?
A. Firewall configuration
B. Authentication and database logs
C. Network topology diagram
D. Password policy
Answer: B. Authentication and database logs
3
, Rationale: Authentication logs can establish whether the account
successfully authenticated at the relevant time, while database audit
logs can show what actions were performed after authentication.
Together, these records provide evidence about account usage and
database activity. A firewall configuration or network diagram does
not establish whether a particular account accessed the database.
6. A company wants to protect sensitive files stored on laptops in
case a laptop is stolen. Which technology would BEST address this
requirement?
A. Full-disk encryption
B. Network segmentation
C. Web application firewall
D. Port security
Answer: A. Full-disk encryption
Rationale: Full-disk encryption encrypts data stored on the device so
that an attacker who removes the storage device or attempts to access
the disk without proper authentication cannot easily read the protected
information. Network controls such as segmentation and port security
protect communications infrastructure but do not directly protect
locally stored data if the physical device is stolen.
7. A penetration tester sends specially crafted input into a web
application's database query field. The application incorrectly
incorporates the input into a SQL statement, allowing the tester to
retrieve unauthorized database records. Which vulnerability is
being exploited?
A. Cross-site scripting
B. SQL injection
4
