CompTIA Security+ (SY0-701) – 2026/2027 –
Questions & Verified Answers with Rationales –
Grade A+
Introduction
This practice exam is designed for candidates preparing for the CompTIA Security+
SY0-701 certification, valid through its retirement in May 2027. The 200 questions
in this bank are original and aligned to the five official exam domains, with
weighting that mirrors the actual exam: General Security Concepts (12%), Threats,
Vulnerabilities, and Mitigations (22%), Security Architecture (18%), Security
Operations (28%), and Security Program Management and Oversight (20%). Each
question includes a detailed rationale explaining why the correct answer is right
and why the distractors are wrong. Multiple-choice and SATA (Select All That
Apply) formats are both represented. Use this exam as a diagnostic tool, a study
aid, and a final-week refresher. For best results, review the rationale for every
question—even the ones you answer correctly—to reinforce the underlying
concept.
Domain 1: General Security Concepts (12%) – Questions 1–24
1. A security administrator is classifying controls for a new data center. The
organization installs bollards at the main entrance, implements an iris scanner for
the server room, and deploys a SIEM to correlate event logs. Which of the
following correctly categorizes these three controls (bollards, iris scanner, SIEM)?
A. Physical, technical, operational
B. Physical, physical, technical
C. Technical, physical, managerial
D. Deterrent, preventive, detective
Correct Answer: B
Rationale: Bollards are physical controls (they physically block vehicles).
An iris scanner is also a physical control (it controls physical access to a room). A
,SIEM is a technical (logical) control because it is implemented through technology
to monitor and correlate events. Option A misclassifies the iris scanner as
technical; it is a physical access control. Option C misclassifies bollards as
technical. Option D describes control types (deterrent, preventive, detective), not
categories.
2. Which of the following BEST describes the principle of non-repudiation?
A. Ensuring that data has not been altered in transit
B. Guaranteeing that a sender cannot deny having sent a message
C. Ensuring that data is available when authorized users need it
D. Preventing unauthorized users from reading sensitive data
Correct Answer: B
Rationale: Non-repudiation provides proof of the origin and integrity of
data, ensuring a sender cannot later deny sending a message or performing an
action. This is typically achieved through digital signatures. Option A describes
integrity. Option C describes availability. Option D describes confidentiality.
3. A company is implementing a Zero Trust architecture. The security team
separates the policy engine and policy administrator from the policy enforcement
point. Which plane does the policy enforcement point belong to?
A. Control plane
B. Data plane
C. Management plane
D. Orchestration plane
Correct Answer: B
Rationale: In the NIST SP 800-207 Zero Trust model, the control plane
contains the policy engine (which decides) and the policy administrator (which
communicates decisions). The data plane contains the policy enforcement point
(PEP), which enforces the decisions at the resource. Option A is where policy
decisions are made. Options C and D are not part of the standard Zero Trust
planes.
,4. A security analyst is reviewing a control that requires users to sign an
acceptable use policy before receiving network credentials. This control is BEST
classified as which of the following?
A. Technical, preventive
B. Operational, preventive
C. Managerial, preventive
D. Physical, deterrent
Correct Answer: C
Rationale: An acceptable use policy is a managerial (administrative)
control because it establishes rules and expectations. Requiring users to sign it
before receiving credentials makes it preventive—it aims to stop policy violations
before they occur. Option A is incorrect because a policy is not technical. Option B
is incorrect because operational controls are day-to-day procedures executed by
people; a signed policy is a management directive. Option D is incorrect because it
is not a physical control.
5. Which of the following cryptographic algorithms is symmetric?
A. RSA
B. ECC
C. AES
D. Diffie-Hellman
Correct Answer: C
Rationale: AES (Advanced Encryption Standard) is a symmetric encryption
algorithm, meaning the same key is used for both encryption and decryption. RSA,
ECC, and Diffie-Hellman are asymmetric algorithms. Option A uses a
public/private key pair. Option B is an asymmetric key-agreement algorithm.
Option D is used for key exchange, not symmetric encryption.
6. A security engineer needs to verify the integrity of a downloaded file. Which of
the following should the engineer use?
A. Digital signature
B. Symmetric encryption
, C. Steganography
D. Tokenization
Correct Answer: A
Rationale: A digital signature provides both integrity and authenticity. It is
created by hashing the file and encrypting the hash with the sender's private key.
The receiver can verify the signature with the sender's public key, confirming the
file has not been altered. Option B provides confidentiality, not integrity
verification. Option C hides data within other data. Option D replaces sensitive
data with a placeholder.
7. Which of the following describes the concept of "defense in depth"?
A. Using a single, strong firewall to protect the network
B. Layering multiple security controls so that if one fails, others still protect the
asset
C. Encrypting all data at rest and in transit
D. Implementing multifactor authentication for all users
Correct Answer: B
Rationale: Defense in depth is the practice of layering multiple controls
(technical, operational, physical) so that no single control failure leads to a
breach. Option A is the opposite of defense in depth. Options C and D are specific
controls, not the overarching principle.
8. A security administrator is setting up a honeynet. Which of the following is the
PRIMARY purpose of this deployment?
A. To block malicious traffic at the perimeter
B. To lure attackers and observe their techniques
C. To provide a backup network for critical services
D. To encrypt sensitive data at rest
Correct Answer: B
Rationale: A honeynet is a network of decoy systems designed to attract
attackers, allowing defenders to observe attack methods and gather threat
Questions & Verified Answers with Rationales –
Grade A+
Introduction
This practice exam is designed for candidates preparing for the CompTIA Security+
SY0-701 certification, valid through its retirement in May 2027. The 200 questions
in this bank are original and aligned to the five official exam domains, with
weighting that mirrors the actual exam: General Security Concepts (12%), Threats,
Vulnerabilities, and Mitigations (22%), Security Architecture (18%), Security
Operations (28%), and Security Program Management and Oversight (20%). Each
question includes a detailed rationale explaining why the correct answer is right
and why the distractors are wrong. Multiple-choice and SATA (Select All That
Apply) formats are both represented. Use this exam as a diagnostic tool, a study
aid, and a final-week refresher. For best results, review the rationale for every
question—even the ones you answer correctly—to reinforce the underlying
concept.
Domain 1: General Security Concepts (12%) – Questions 1–24
1. A security administrator is classifying controls for a new data center. The
organization installs bollards at the main entrance, implements an iris scanner for
the server room, and deploys a SIEM to correlate event logs. Which of the
following correctly categorizes these three controls (bollards, iris scanner, SIEM)?
A. Physical, technical, operational
B. Physical, physical, technical
C. Technical, physical, managerial
D. Deterrent, preventive, detective
Correct Answer: B
Rationale: Bollards are physical controls (they physically block vehicles).
An iris scanner is also a physical control (it controls physical access to a room). A
,SIEM is a technical (logical) control because it is implemented through technology
to monitor and correlate events. Option A misclassifies the iris scanner as
technical; it is a physical access control. Option C misclassifies bollards as
technical. Option D describes control types (deterrent, preventive, detective), not
categories.
2. Which of the following BEST describes the principle of non-repudiation?
A. Ensuring that data has not been altered in transit
B. Guaranteeing that a sender cannot deny having sent a message
C. Ensuring that data is available when authorized users need it
D. Preventing unauthorized users from reading sensitive data
Correct Answer: B
Rationale: Non-repudiation provides proof of the origin and integrity of
data, ensuring a sender cannot later deny sending a message or performing an
action. This is typically achieved through digital signatures. Option A describes
integrity. Option C describes availability. Option D describes confidentiality.
3. A company is implementing a Zero Trust architecture. The security team
separates the policy engine and policy administrator from the policy enforcement
point. Which plane does the policy enforcement point belong to?
A. Control plane
B. Data plane
C. Management plane
D. Orchestration plane
Correct Answer: B
Rationale: In the NIST SP 800-207 Zero Trust model, the control plane
contains the policy engine (which decides) and the policy administrator (which
communicates decisions). The data plane contains the policy enforcement point
(PEP), which enforces the decisions at the resource. Option A is where policy
decisions are made. Options C and D are not part of the standard Zero Trust
planes.
,4. A security analyst is reviewing a control that requires users to sign an
acceptable use policy before receiving network credentials. This control is BEST
classified as which of the following?
A. Technical, preventive
B. Operational, preventive
C. Managerial, preventive
D. Physical, deterrent
Correct Answer: C
Rationale: An acceptable use policy is a managerial (administrative)
control because it establishes rules and expectations. Requiring users to sign it
before receiving credentials makes it preventive—it aims to stop policy violations
before they occur. Option A is incorrect because a policy is not technical. Option B
is incorrect because operational controls are day-to-day procedures executed by
people; a signed policy is a management directive. Option D is incorrect because it
is not a physical control.
5. Which of the following cryptographic algorithms is symmetric?
A. RSA
B. ECC
C. AES
D. Diffie-Hellman
Correct Answer: C
Rationale: AES (Advanced Encryption Standard) is a symmetric encryption
algorithm, meaning the same key is used for both encryption and decryption. RSA,
ECC, and Diffie-Hellman are asymmetric algorithms. Option A uses a
public/private key pair. Option B is an asymmetric key-agreement algorithm.
Option D is used for key exchange, not symmetric encryption.
6. A security engineer needs to verify the integrity of a downloaded file. Which of
the following should the engineer use?
A. Digital signature
B. Symmetric encryption
, C. Steganography
D. Tokenization
Correct Answer: A
Rationale: A digital signature provides both integrity and authenticity. It is
created by hashing the file and encrypting the hash with the sender's private key.
The receiver can verify the signature with the sender's public key, confirming the
file has not been altered. Option B provides confidentiality, not integrity
verification. Option C hides data within other data. Option D replaces sensitive
data with a placeholder.
7. Which of the following describes the concept of "defense in depth"?
A. Using a single, strong firewall to protect the network
B. Layering multiple security controls so that if one fails, others still protect the
asset
C. Encrypting all data at rest and in transit
D. Implementing multifactor authentication for all users
Correct Answer: B
Rationale: Defense in depth is the practice of layering multiple controls
(technical, operational, physical) so that no single control failure leads to a
breach. Option A is the opposite of defense in depth. Options C and D are specific
controls, not the overarching principle.
8. A security administrator is setting up a honeynet. Which of the following is the
PRIMARY purpose of this deployment?
A. To block malicious traffic at the perimeter
B. To lure attackers and observe their techniques
C. To provide a backup network for critical services
D. To encrypt sensitive data at rest
Correct Answer: B
Rationale: A honeynet is a network of decoy systems designed to attract
attackers, allowing defenders to observe attack methods and gather threat
