CompTIA Security+ SY0-701 Practice Exam
Comprehensive Practice Examination (150
Questions)
Domain 1: General Security Concepts (Questions 1-25)
Question 1: Which of the following is the MOST important principle of information security?
A) Confidentiality, Integrity, Availability (CIA Triad)
B) Authentication, Authorization, Accounting (AAA)
C) Prevention, Detection, Response
D) Identification, Authentication, Authorization
Answer: A) Confidentiality, Integrity, Availability (CIA Triad)
Rationale: The CIA Triad—Confidentiality, Integrity, and Availability—is the foundational principle of
information security. Confidentiality ensures data is accessible only to authorized parties, Integrity
ensures data is accurate and unaltered, and Availability ensures data is accessible when needed. While
AAA and other frameworks are important, the CIA Triad is the most fundamental concept.
Question 2: A company wants to ensure that employees can only access data necessary for their job
functions. This is an example of:
A) Separation of duties
B) Principle of least privilege
C) Defense in depth
D) Mandatory access control
Answer: B) Principle of least privilege
Rationale: The principle of least privilege dictates that users should be granted only the minimum
permissions necessary to perform their job functions. This reduces the risk of unauthorized access, data
breaches, and insider threats. Separation of duties divides responsibilities to prevent fraud, defense in
depth uses multiple layers of security, and MAC is a strict access control model.
Question 3: Which access control model uses security labels and clearances to determine access?
A) Discretionary Access Control (DAC)
B) Mandatory Access Control (MAC)
C) Role-Based Access Control (RBAC)
D) Attribute-Based Access Control (ABAC)
Answer: B) Mandatory Access Control (MAC)
,Rationale: Mandatory Access Control (MAC) is a strict access control model where access decisions are
based on security labels (e.g., Top Secret, Secret, Confidential) and user clearances. MAC is commonly
used in government and military environments. DAC allows owners to set permissions, RBAC uses roles,
and ABAC uses attributes.
Question 4: Which of the following is an example of a physical security control?
A) Firewall
B) Encryption
C) Security guard
D) Antivirus software
Answer: C) Security guard
Rationale: Physical security controls are measures that protect physical assets, facilities, and personnel.
Examples include security guards, fences, locks, surveillance cameras, and biometric access controls.
Firewalls and antivirus are technical controls, while encryption is a technical control that protects data.
Question 5: A hacker sends a fraudulent email that appears to come from a trusted source to trick
recipients into revealing sensitive information. This is an example of:
A) Phishing
B) Spoofing
C) Vishing
D) Pretexting
Answer: A) Phishing
Rationale: Phishing is a social engineering attack where an attacker sends a fraudulent message (often
email) that appears to come from a trusted source to trick recipients into revealing sensitive information
(e.g., passwords, credit card numbers). Spoofing is falsifying the source of communication, vishing is
voice phishing, and pretexting involves creating a fabricated scenario to steal information.
Question 6: What is the primary purpose of a security policy?
A) To provide a framework for implementing security controls
B) To assign IP addresses
C) To monitor network traffic
D) To deploy software updates
Answer: A) To provide a framework for implementing security controls
Rationale: A security policy is a high-level document that defines the security objectives, roles,
responsibilities, and acceptable use for an organization. It provides a framework for implementing
security controls, ensuring consistency, and guiding decision-making. Policies are the foundation of a
security program.
,Question 7: Which of the following is a characteristic of a "zero trust" security model?
A) Trust everything inside the network perimeter
B) Verify every request as if it originates from an untrusted network
C) Rely on a single firewall for protection
D) Allow all internal traffic by default
Answer: B) Verify every request as if it originates from an untrusted network
Rationale: The zero trust security model assumes that no user, device, or network is inherently trusted.
Every request, regardless of origin (internal or external), must be verified and authenticated. Zero trust
uses micro-segmentation, least privilege, and continuous monitoring to enhance security. It is a modern
approach to network security.
Question 8: Which of the following is an example of a "honeypot" in cybersecurity?
A) A decoy system designed to attract and detect attackers
B) A firewall rule to block traffic
C) An encryption algorithm
D) A secure backup system
Answer: A) A decoy system designed to attract and detect attackers
Rationale: A honeypot is a decoy system or network that is intentionally vulnerable to attract attackers.
It is used to detect, monitor, and study attacker behavior. Honeypots can be used to gather intelligence
on attack techniques and to distract attackers from valuable resources.
Question 9: What is the difference between a vulnerability and a threat?
A) A vulnerability is a weakness; a threat is a potential danger that exploits the weakness
B) A threat is a weakness; a vulnerability is a potential danger
C) They are the same thing
D) A vulnerability is a type of attack
Answer: A) A vulnerability is a weakness; a threat is a potential danger that exploits the weakness
Rationale: A vulnerability is a weakness in a system (e.g., a misconfiguration, unpatched software). A
threat is a potential danger that can exploit a vulnerability (e.g., a hacker, malware). Risk = Threat ×
Vulnerability × Impact. Both vulnerabilities and threats must be managed to reduce risk.
Question 10: Which of the following is a symmetric encryption algorithm?
A) RSA
B) AES
C) ECC
D) DSA
, Answer: B) AES
Rationale: AES (Advanced Encryption Standard) is a symmetric encryption algorithm, meaning the same
key is used for encryption and decryption. RSA, ECC, and DSA are asymmetric (public-key) algorithms.
AES is widely used for data encryption and is considered secure.
Question 11: Which of the following is an asymmetric encryption algorithm?
A) AES
B) 3DES
C) RSA
D) RC4
Answer: C) RSA
Rationale: RSA (Rivest-Shamir-Adleman) is an asymmetric encryption algorithm that uses a pair of keys:
a public key for encryption and a private key for decryption. AES, 3DES, and RC4 are symmetric
encryption algorithms. Asymmetric encryption is used for secure key exchange, digital signatures, and
encryption.
Question 12: What is the purpose of a digital signature?
A) To provide confidentiality
B) To provide integrity and non-repudiation
C) To provide availability
D) To provide authentication only
Answer: B) To provide integrity and non-repudiation
Rationale: A digital signature provides integrity (ensures the message has not been altered) and non-
repudiation (the sender cannot deny having sent the message). It does not provide confidentiality; that
requires encryption. Digital signatures are created using asymmetric encryption and hash functions.
Question 13: Which of the following is a type of social engineering attack?
A) Phishing
B) DDoS
C) Malware
D) Man-in-the-middle
Answer: A) Phishing
Rationale: Phishing is a social engineering attack that manipulates human behavior to obtain sensitive
information. DDoS, malware, and man-in-the-middle are technical attacks. Social engineering exploits
human psychology rather than technical vulnerabilities.
Comprehensive Practice Examination (150
Questions)
Domain 1: General Security Concepts (Questions 1-25)
Question 1: Which of the following is the MOST important principle of information security?
A) Confidentiality, Integrity, Availability (CIA Triad)
B) Authentication, Authorization, Accounting (AAA)
C) Prevention, Detection, Response
D) Identification, Authentication, Authorization
Answer: A) Confidentiality, Integrity, Availability (CIA Triad)
Rationale: The CIA Triad—Confidentiality, Integrity, and Availability—is the foundational principle of
information security. Confidentiality ensures data is accessible only to authorized parties, Integrity
ensures data is accurate and unaltered, and Availability ensures data is accessible when needed. While
AAA and other frameworks are important, the CIA Triad is the most fundamental concept.
Question 2: A company wants to ensure that employees can only access data necessary for their job
functions. This is an example of:
A) Separation of duties
B) Principle of least privilege
C) Defense in depth
D) Mandatory access control
Answer: B) Principle of least privilege
Rationale: The principle of least privilege dictates that users should be granted only the minimum
permissions necessary to perform their job functions. This reduces the risk of unauthorized access, data
breaches, and insider threats. Separation of duties divides responsibilities to prevent fraud, defense in
depth uses multiple layers of security, and MAC is a strict access control model.
Question 3: Which access control model uses security labels and clearances to determine access?
A) Discretionary Access Control (DAC)
B) Mandatory Access Control (MAC)
C) Role-Based Access Control (RBAC)
D) Attribute-Based Access Control (ABAC)
Answer: B) Mandatory Access Control (MAC)
,Rationale: Mandatory Access Control (MAC) is a strict access control model where access decisions are
based on security labels (e.g., Top Secret, Secret, Confidential) and user clearances. MAC is commonly
used in government and military environments. DAC allows owners to set permissions, RBAC uses roles,
and ABAC uses attributes.
Question 4: Which of the following is an example of a physical security control?
A) Firewall
B) Encryption
C) Security guard
D) Antivirus software
Answer: C) Security guard
Rationale: Physical security controls are measures that protect physical assets, facilities, and personnel.
Examples include security guards, fences, locks, surveillance cameras, and biometric access controls.
Firewalls and antivirus are technical controls, while encryption is a technical control that protects data.
Question 5: A hacker sends a fraudulent email that appears to come from a trusted source to trick
recipients into revealing sensitive information. This is an example of:
A) Phishing
B) Spoofing
C) Vishing
D) Pretexting
Answer: A) Phishing
Rationale: Phishing is a social engineering attack where an attacker sends a fraudulent message (often
email) that appears to come from a trusted source to trick recipients into revealing sensitive information
(e.g., passwords, credit card numbers). Spoofing is falsifying the source of communication, vishing is
voice phishing, and pretexting involves creating a fabricated scenario to steal information.
Question 6: What is the primary purpose of a security policy?
A) To provide a framework for implementing security controls
B) To assign IP addresses
C) To monitor network traffic
D) To deploy software updates
Answer: A) To provide a framework for implementing security controls
Rationale: A security policy is a high-level document that defines the security objectives, roles,
responsibilities, and acceptable use for an organization. It provides a framework for implementing
security controls, ensuring consistency, and guiding decision-making. Policies are the foundation of a
security program.
,Question 7: Which of the following is a characteristic of a "zero trust" security model?
A) Trust everything inside the network perimeter
B) Verify every request as if it originates from an untrusted network
C) Rely on a single firewall for protection
D) Allow all internal traffic by default
Answer: B) Verify every request as if it originates from an untrusted network
Rationale: The zero trust security model assumes that no user, device, or network is inherently trusted.
Every request, regardless of origin (internal or external), must be verified and authenticated. Zero trust
uses micro-segmentation, least privilege, and continuous monitoring to enhance security. It is a modern
approach to network security.
Question 8: Which of the following is an example of a "honeypot" in cybersecurity?
A) A decoy system designed to attract and detect attackers
B) A firewall rule to block traffic
C) An encryption algorithm
D) A secure backup system
Answer: A) A decoy system designed to attract and detect attackers
Rationale: A honeypot is a decoy system or network that is intentionally vulnerable to attract attackers.
It is used to detect, monitor, and study attacker behavior. Honeypots can be used to gather intelligence
on attack techniques and to distract attackers from valuable resources.
Question 9: What is the difference between a vulnerability and a threat?
A) A vulnerability is a weakness; a threat is a potential danger that exploits the weakness
B) A threat is a weakness; a vulnerability is a potential danger
C) They are the same thing
D) A vulnerability is a type of attack
Answer: A) A vulnerability is a weakness; a threat is a potential danger that exploits the weakness
Rationale: A vulnerability is a weakness in a system (e.g., a misconfiguration, unpatched software). A
threat is a potential danger that can exploit a vulnerability (e.g., a hacker, malware). Risk = Threat ×
Vulnerability × Impact. Both vulnerabilities and threats must be managed to reduce risk.
Question 10: Which of the following is a symmetric encryption algorithm?
A) RSA
B) AES
C) ECC
D) DSA
, Answer: B) AES
Rationale: AES (Advanced Encryption Standard) is a symmetric encryption algorithm, meaning the same
key is used for encryption and decryption. RSA, ECC, and DSA are asymmetric (public-key) algorithms.
AES is widely used for data encryption and is considered secure.
Question 11: Which of the following is an asymmetric encryption algorithm?
A) AES
B) 3DES
C) RSA
D) RC4
Answer: C) RSA
Rationale: RSA (Rivest-Shamir-Adleman) is an asymmetric encryption algorithm that uses a pair of keys:
a public key for encryption and a private key for decryption. AES, 3DES, and RC4 are symmetric
encryption algorithms. Asymmetric encryption is used for secure key exchange, digital signatures, and
encryption.
Question 12: What is the purpose of a digital signature?
A) To provide confidentiality
B) To provide integrity and non-repudiation
C) To provide availability
D) To provide authentication only
Answer: B) To provide integrity and non-repudiation
Rationale: A digital signature provides integrity (ensures the message has not been altered) and non-
repudiation (the sender cannot deny having sent the message). It does not provide confidentiality; that
requires encryption. Digital signatures are created using asymmetric encryption and hash functions.
Question 13: Which of the following is a type of social engineering attack?
A) Phishing
B) DDoS
C) Malware
D) Man-in-the-middle
Answer: A) Phishing
Rationale: Phishing is a social engineering attack that manipulates human behavior to obtain sensitive
information. DDoS, malware, and man-in-the-middle are technical attacks. Social engineering exploits
human psychology rather than technical vulnerabilities.
