COMPTIA SECURITY+ (SY0-701) – EXAM QUESTIONS AND
CORRECT ANSWERS (VERIFIED ANSWERS) PLUS
RATIONALE | 2027 Q&A | INSTANT DOWNLOAD PDF
1. Which security principle ensures that a user receives only the permissions
necessary to perform assigned job responsibilities?
A. Separation of duties
B. Least privilege
C. Mandatory access control
D. Job rotation
Rationale: Least privilege limits users and processes to the minimum permissions required for
their tasks, reducing the potential impact of compromised accounts or misuse.
2. An organization requires two employees to approve a high-value financial
transaction before it can be completed. Which security concept is being applied?
A. Separation of duties
B. Non-repudiation
C. Availability
D. Obfuscation
Rationale: Separation of duties divides sensitive responsibilities among multiple individuals so
that one person cannot independently complete a high-risk action.
3. Which security objective is primarily concerned with preventing unauthorized
modification of information?
A. Availability
B. Confidentiality
C. Integrity
D. Authentication
Rationale: Integrity protects information from unauthorized alteration or destruction.
Confidentiality addresses unauthorized disclosure, while availability concerns reliable access.
, 4. A company uses multifactor authentication requiring a password and a
fingerprint. Which authentication factors are represented?
A. Something you know and somewhere you are
B. Something you have and something you are
C. Something you know and something you do
D. Something you know and something you are
Rationale: A password is something the user knows, while a fingerprint is something the user is.
Using different factor categories provides stronger authentication than multiple credentials from
the same category.
5. Which security control is primarily designed to discourage unauthorized activity
by making an individual aware that security measures are in place?
A. Corrective
B. Compensating
C. Deterrent
D. Recovery
Rationale: Deterrent controls are intended to discourage unwanted behavior. Warning banners,
security guards, and visible surveillance cameras can serve this purpose.
6. A web application remains available even after one of its servers fails because
another server automatically takes over. Which concept does this architecture
primarily demonstrate?
A. Fault tolerance
B. Data masking
C. Non-repudiation
D. Credential federation
Rationale: Fault tolerance allows a system to continue operating when a component fails, often
through redundancy and automatic failover.
7. Which technology provides cryptographic assurance that a message was
generated by the holder of a particular private key and has not been altered?
,A. Hashing
B. Encryption
C. Digital certificate
D. Digital signature
Rationale: A digital signature is created with a private key and can be verified using the
corresponding public key. It supports integrity and authentication and can contribute to non-
repudiation.
8. An administrator needs to protect stored customer records from unauthorized
disclosure if a database disk is stolen. Which control is most appropriate?
A. Network segmentation
B. Encryption at rest
C. Load balancing
D. Port security
Rationale: Encryption at rest protects stored information by making the data unreadable without
the required cryptographic key.
9. Which security technology is specifically designed to detect and block malicious
network traffic in real time?
A. IDS
B. Proxy server
C. IPS
D. Vulnerability scanner
Rationale: An intrusion prevention system can detect malicious traffic and actively block or
prevent the activity. An IDS primarily detects and alerts.
10. A company wants to ensure that administrators cannot use the same credentials
to access every critical system. Which approach most directly reduces the risk
associated with credential compromise?
A. Increasing screen timeout
, B. Disabling logging
C. Privileged access management
D. Using a single sign-on provider
Rationale: Privileged access management controls, monitors, and limits elevated accounts and
their access to sensitive systems.
11. Which attack attempts to make a legitimate user unknowingly disclose
credentials by directing the user to a fraudulent website?
A. Phishing
B. Tailgating
C. Shoulder surfing
D. Evil twin
Rationale: Phishing uses deceptive messages or websites to manipulate victims into revealing
information such as usernames, passwords, or payment details.
12. A targeted phishing campaign uses information gathered about a specific
executive from public sources. What type of phishing is this?
A. Smishing
B. Vishing
C. Pharming
D. Spear phishing
Rationale: Spear phishing is targeted at a particular individual or group and often uses personal
or organizational information to make the deception more convincing.
13. An attacker sends a fraudulent text message containing a link to a fake banking
login page. Which technique is being used?
A. Vishing
B. Smishing
C. Pharming
CORRECT ANSWERS (VERIFIED ANSWERS) PLUS
RATIONALE | 2027 Q&A | INSTANT DOWNLOAD PDF
1. Which security principle ensures that a user receives only the permissions
necessary to perform assigned job responsibilities?
A. Separation of duties
B. Least privilege
C. Mandatory access control
D. Job rotation
Rationale: Least privilege limits users and processes to the minimum permissions required for
their tasks, reducing the potential impact of compromised accounts or misuse.
2. An organization requires two employees to approve a high-value financial
transaction before it can be completed. Which security concept is being applied?
A. Separation of duties
B. Non-repudiation
C. Availability
D. Obfuscation
Rationale: Separation of duties divides sensitive responsibilities among multiple individuals so
that one person cannot independently complete a high-risk action.
3. Which security objective is primarily concerned with preventing unauthorized
modification of information?
A. Availability
B. Confidentiality
C. Integrity
D. Authentication
Rationale: Integrity protects information from unauthorized alteration or destruction.
Confidentiality addresses unauthorized disclosure, while availability concerns reliable access.
, 4. A company uses multifactor authentication requiring a password and a
fingerprint. Which authentication factors are represented?
A. Something you know and somewhere you are
B. Something you have and something you are
C. Something you know and something you do
D. Something you know and something you are
Rationale: A password is something the user knows, while a fingerprint is something the user is.
Using different factor categories provides stronger authentication than multiple credentials from
the same category.
5. Which security control is primarily designed to discourage unauthorized activity
by making an individual aware that security measures are in place?
A. Corrective
B. Compensating
C. Deterrent
D. Recovery
Rationale: Deterrent controls are intended to discourage unwanted behavior. Warning banners,
security guards, and visible surveillance cameras can serve this purpose.
6. A web application remains available even after one of its servers fails because
another server automatically takes over. Which concept does this architecture
primarily demonstrate?
A. Fault tolerance
B. Data masking
C. Non-repudiation
D. Credential federation
Rationale: Fault tolerance allows a system to continue operating when a component fails, often
through redundancy and automatic failover.
7. Which technology provides cryptographic assurance that a message was
generated by the holder of a particular private key and has not been altered?
,A. Hashing
B. Encryption
C. Digital certificate
D. Digital signature
Rationale: A digital signature is created with a private key and can be verified using the
corresponding public key. It supports integrity and authentication and can contribute to non-
repudiation.
8. An administrator needs to protect stored customer records from unauthorized
disclosure if a database disk is stolen. Which control is most appropriate?
A. Network segmentation
B. Encryption at rest
C. Load balancing
D. Port security
Rationale: Encryption at rest protects stored information by making the data unreadable without
the required cryptographic key.
9. Which security technology is specifically designed to detect and block malicious
network traffic in real time?
A. IDS
B. Proxy server
C. IPS
D. Vulnerability scanner
Rationale: An intrusion prevention system can detect malicious traffic and actively block or
prevent the activity. An IDS primarily detects and alerts.
10. A company wants to ensure that administrators cannot use the same credentials
to access every critical system. Which approach most directly reduces the risk
associated with credential compromise?
A. Increasing screen timeout
, B. Disabling logging
C. Privileged access management
D. Using a single sign-on provider
Rationale: Privileged access management controls, monitors, and limits elevated accounts and
their access to sensitive systems.
11. Which attack attempts to make a legitimate user unknowingly disclose
credentials by directing the user to a fraudulent website?
A. Phishing
B. Tailgating
C. Shoulder surfing
D. Evil twin
Rationale: Phishing uses deceptive messages or websites to manipulate victims into revealing
information such as usernames, passwords, or payment details.
12. A targeted phishing campaign uses information gathered about a specific
executive from public sources. What type of phishing is this?
A. Smishing
B. Vishing
C. Pharming
D. Spear phishing
Rationale: Spear phishing is targeted at a particular individual or group and often uses personal
or organizational information to make the deception more convincing.
13. An attacker sends a fraudulent text message containing a link to a fake banking
login page. Which technique is being used?
A. Vishing
B. Smishing
C. Pharming
