2025 COMPATIA Security + SYO 701 Test Bank
Exam with 1000+ Questions, 100% Correct
Answers and Rationales
Question 1
Which principle ensures that users have only the access necessary to perform their jobs?
A) Defense-in-depth
B) Least privilege
C) Separation of duties
D) Zero trust
Correct Answer: B) Least privilege
Rationale: Least privilege limits access to the minimum required, reducing risk. Defense-in-
depth layers security, separation splits tasks, and zero trust assumes no inherent trust.
Question 2
What type of attack uses fraudulent emails to trick users into revealing credentials?
A) Brute force
B) Phishing
C) Spoofing
D) Keylogging
Correct Answer: B) Phishing
Rationale: Phishing uses deceptive emails to steal credentials. Brute force guesses passwords,
spoofing fakes identities, and keylogging captures keystrokes.
Question 3
Which mitigation prevents attackers from exploiting unpatched software?
A) Two-factor authentication
B) Regular patch management
C) Network encryption
D) User awareness training
Correct Answer: B) Regular patch management
Rationale: Patching fixes known vulnerabilities. 2FA adds login security, encryption protects
data, and training addresses behavior, but only patching targets software flaws.
Question 4
What is the primary role of a virtual private network (VPN)?
A) Filter web content
B) Encrypt remote connections
C) Detect intrusions
D) Manage IP addresses
Correct Answer: B) Encrypt remote connections
Rationale: VPNs secure remote access by encrypting traffic. Filtering is for proxies, detection for
IDS, and IP management for DHCP.
,Question 5
Which wireless security protocol is considered outdated and insecure?
A) WPA2
B) WEP
C) WPA3
D) TKIP
Correct Answer: B) WEP
Rationale: Wired Equivalent Privacy (WEP) has known vulnerabilities (e.g., weak IVs). WPA2
and WPA3 are stronger, and TKIP is a deprecated WPA component.
Question 6
What is a key feature of a next-generation firewall (NGFW)?
A) Packet filtering only
B) Deep packet inspection
C) Basic NAT support
D) Static rule sets
Correct Answer: B) Deep packet inspection
Rationale: NGFWs analyze packet contents for threats, beyond basic filtering. NAT and static
rules are traditional firewall features.
Question 7
Which malware type spreads without user interaction across a network?
A) Trojan
B) Worm
C) Adware
D) Rootkit
Correct Answer: B) Worm
Rationale: Worms self-replicate across networks (e.g., Stuxnet). Trojans require activation,
adware displays ads, and rootkits hide processes.
Question 8
What does a security information and event management (SIEM) system primarily do?
A) Block malicious traffic
B) Collect and analyze logs
C) Encrypt sensitive data
D) Authenticate users
Correct Answer: B) Collect and analyze logs
Rationale: SIEM aggregates and correlates logs for threat detection. Blocking is for IPS,
encryption for other tools, and authentication for identity systems.
Question 9
Which protocol is used to securely manage network devices remotely?
A) Telnet
B) SSH
C) SNMP
,D) RDP
Correct Answer: B) SSH
Rationale: Secure Shell (SSH) encrypts remote management. Telnet is unsecure, SNMP
monitors, and RDP is for desktops.
Question 10
What is a common indicator of a distributed denial-of-service (DDoS) attack?
A) Slow login times for users
B) Unusual traffic from multiple sources
C) Corrupted database records
D) Unauthorized file access
Correct Answer: B) Unusual traffic from multiple sources
Rationale: DDoS floods a target from many IPs. Slow logins could be unrelated, corruption
suggests other attacks, and file access points to breaches.
Question 11
Which security architecture design reduces the attack surface?
A) Flat network
B) Network segmentation
C) Open Wi-Fi
D) Single-factor authentication
Correct Answer: B) Network segmentation
Rationale: Segmentation isolates systems, limiting breach spread. Flat networks increase risk,
open Wi-Fi is insecure, and 1FA is an access issue.
Question 12
What is a risk of using default credentials on a device?
A) Increased latency
B) Unauthorized access
C) Data corruption
D) Hardware failure
Correct Answer: B) Unauthorized access
Rationale: Default credentials (e.g., admin/admin) are easily guessed, enabling access. Other
options are unrelated to credentials.
Question 13
Which tool captures and analyzes network traffic?
A) Nessus
B) Wireshark
C) Metasploit
D) Nmap
Correct Answer: B) Wireshark
Rationale: Wireshark is a packet analyzer. Nessus scans vulnerabilities, Metasploit exploits, and
Nmap maps networks.
Question 14
, What is the purpose of a risk assessment?
A) Deploy security patches
B) Identify and prioritize threats
C) Monitor real-time traffic
D) Train employees
Correct Answer: B) Identify and prioritize threats
Rationale: Risk assessments evaluate vulnerabilities and threats to guide mitigation. Patching,
monitoring, and training are follow-ups.
Question 15
Which attack injects malicious code into a web application via user input?
A) Cross-site scripting (XSS)
B) Buffer overflow
C) Password spraying
D) DNS poisoning
Correct Answer: A) Cross-site scripting (XSS)
Rationale: XSS exploits input fields to run scripts. Buffer overflow targets memory, spraying
guesses passwords, and DNS poisoning spoofs addresses.
Question 16
What does endpoint detection and response (EDR) primarily focus on?
A) Network traffic analysis
B) Device-level threat detection
C) User authentication
D) Data encryption
Correct Answer: B) Device-level threat detection
Rationale: EDR monitors endpoints (e.g., PCs) for threats. Traffic analysis is network-based, and
authentication/encryption are separate functions.
Question 17
Which log type tracks changes to system configurations?
A) Audit log
B) Access log
C) Performance log
D) Error log
Correct Answer: A) Audit log
Rationale: Audit logs record configuration changes and user actions. Access logs track logins,
performance logs metrics, and error logs failures.
Question 18
What is a key benefit of penetration testing?
A) Ensures compliance with laws
B) Identifies exploitable weaknesses
C) Reduces network latency
D) Encrypts sensitive data
Correct Answer: B) Identifies exploitable weaknesses
Exam with 1000+ Questions, 100% Correct
Answers and Rationales
Question 1
Which principle ensures that users have only the access necessary to perform their jobs?
A) Defense-in-depth
B) Least privilege
C) Separation of duties
D) Zero trust
Correct Answer: B) Least privilege
Rationale: Least privilege limits access to the minimum required, reducing risk. Defense-in-
depth layers security, separation splits tasks, and zero trust assumes no inherent trust.
Question 2
What type of attack uses fraudulent emails to trick users into revealing credentials?
A) Brute force
B) Phishing
C) Spoofing
D) Keylogging
Correct Answer: B) Phishing
Rationale: Phishing uses deceptive emails to steal credentials. Brute force guesses passwords,
spoofing fakes identities, and keylogging captures keystrokes.
Question 3
Which mitigation prevents attackers from exploiting unpatched software?
A) Two-factor authentication
B) Regular patch management
C) Network encryption
D) User awareness training
Correct Answer: B) Regular patch management
Rationale: Patching fixes known vulnerabilities. 2FA adds login security, encryption protects
data, and training addresses behavior, but only patching targets software flaws.
Question 4
What is the primary role of a virtual private network (VPN)?
A) Filter web content
B) Encrypt remote connections
C) Detect intrusions
D) Manage IP addresses
Correct Answer: B) Encrypt remote connections
Rationale: VPNs secure remote access by encrypting traffic. Filtering is for proxies, detection for
IDS, and IP management for DHCP.
,Question 5
Which wireless security protocol is considered outdated and insecure?
A) WPA2
B) WEP
C) WPA3
D) TKIP
Correct Answer: B) WEP
Rationale: Wired Equivalent Privacy (WEP) has known vulnerabilities (e.g., weak IVs). WPA2
and WPA3 are stronger, and TKIP is a deprecated WPA component.
Question 6
What is a key feature of a next-generation firewall (NGFW)?
A) Packet filtering only
B) Deep packet inspection
C) Basic NAT support
D) Static rule sets
Correct Answer: B) Deep packet inspection
Rationale: NGFWs analyze packet contents for threats, beyond basic filtering. NAT and static
rules are traditional firewall features.
Question 7
Which malware type spreads without user interaction across a network?
A) Trojan
B) Worm
C) Adware
D) Rootkit
Correct Answer: B) Worm
Rationale: Worms self-replicate across networks (e.g., Stuxnet). Trojans require activation,
adware displays ads, and rootkits hide processes.
Question 8
What does a security information and event management (SIEM) system primarily do?
A) Block malicious traffic
B) Collect and analyze logs
C) Encrypt sensitive data
D) Authenticate users
Correct Answer: B) Collect and analyze logs
Rationale: SIEM aggregates and correlates logs for threat detection. Blocking is for IPS,
encryption for other tools, and authentication for identity systems.
Question 9
Which protocol is used to securely manage network devices remotely?
A) Telnet
B) SSH
C) SNMP
,D) RDP
Correct Answer: B) SSH
Rationale: Secure Shell (SSH) encrypts remote management. Telnet is unsecure, SNMP
monitors, and RDP is for desktops.
Question 10
What is a common indicator of a distributed denial-of-service (DDoS) attack?
A) Slow login times for users
B) Unusual traffic from multiple sources
C) Corrupted database records
D) Unauthorized file access
Correct Answer: B) Unusual traffic from multiple sources
Rationale: DDoS floods a target from many IPs. Slow logins could be unrelated, corruption
suggests other attacks, and file access points to breaches.
Question 11
Which security architecture design reduces the attack surface?
A) Flat network
B) Network segmentation
C) Open Wi-Fi
D) Single-factor authentication
Correct Answer: B) Network segmentation
Rationale: Segmentation isolates systems, limiting breach spread. Flat networks increase risk,
open Wi-Fi is insecure, and 1FA is an access issue.
Question 12
What is a risk of using default credentials on a device?
A) Increased latency
B) Unauthorized access
C) Data corruption
D) Hardware failure
Correct Answer: B) Unauthorized access
Rationale: Default credentials (e.g., admin/admin) are easily guessed, enabling access. Other
options are unrelated to credentials.
Question 13
Which tool captures and analyzes network traffic?
A) Nessus
B) Wireshark
C) Metasploit
D) Nmap
Correct Answer: B) Wireshark
Rationale: Wireshark is a packet analyzer. Nessus scans vulnerabilities, Metasploit exploits, and
Nmap maps networks.
Question 14
, What is the purpose of a risk assessment?
A) Deploy security patches
B) Identify and prioritize threats
C) Monitor real-time traffic
D) Train employees
Correct Answer: B) Identify and prioritize threats
Rationale: Risk assessments evaluate vulnerabilities and threats to guide mitigation. Patching,
monitoring, and training are follow-ups.
Question 15
Which attack injects malicious code into a web application via user input?
A) Cross-site scripting (XSS)
B) Buffer overflow
C) Password spraying
D) DNS poisoning
Correct Answer: A) Cross-site scripting (XSS)
Rationale: XSS exploits input fields to run scripts. Buffer overflow targets memory, spraying
guesses passwords, and DNS poisoning spoofs addresses.
Question 16
What does endpoint detection and response (EDR) primarily focus on?
A) Network traffic analysis
B) Device-level threat detection
C) User authentication
D) Data encryption
Correct Answer: B) Device-level threat detection
Rationale: EDR monitors endpoints (e.g., PCs) for threats. Traffic analysis is network-based, and
authentication/encryption are separate functions.
Question 17
Which log type tracks changes to system configurations?
A) Audit log
B) Access log
C) Performance log
D) Error log
Correct Answer: A) Audit log
Rationale: Audit logs record configuration changes and user actions. Access logs track logins,
performance logs metrics, and error logs failures.
Question 18
What is a key benefit of penetration testing?
A) Ensures compliance with laws
B) Identifies exploitable weaknesses
C) Reduces network latency
D) Encrypts sensitive data
Correct Answer: B) Identifies exploitable weaknesses
