COMPTIA SECURITY+ SY0-701
COMPLETE TEST BANK: PRACTICE
QUESTIONS & RATIONALES –
NEWEST 2026/2027 EDITION
(COVERS ALL EXAM DOMAINS)
1. A company wants to ensure that a user cannot deny performing a
financial transaction. What security principle is being enforced?
A. Authorization
B. Non-repudiation
C. Authentication
D. Accounting
Correct Answer: B. Non-repudiation
Rationale: Non-repudiation provides proof of the origin and integrity of
data. It makes it difficult or impossible to deny that someone has
performed an action, often implemented through digital signatures and
logging.
2. A security administrator is creating an inbound firewall rule to block
traffic from a known malicious IP address. Which ACL best
accomplishes this?
A. access-list inbound deny ip source 0.0.0.0/0 destination
10.1.4.9/32
,B. access-list inbound deny ip source 10.1.4.9/32 destination
0.0.0.0/0
C. access-list inbound permit ip source 10.1.4.9/32
destination 0.0.0.0/0
D. access-list inbound permit ip source 0.0.0.0/0 destination
10.1.4.9/32
Correct Answer: B. access-list inbound deny ip source 10.1.4.9/32
destination 0.0.0.0/0
Rationale: This ACL correctly identifies the source IP (the malicious
address) and denies it from reaching any destination on the network.
The /32 is a host mask, indicating a single IP address.
3. Employees are reporting a lock symbol on their screens, and a
message demands payment to unlock their files. What attack is this?
A. Rootkit
B. Spyware
C. Ransomware
D. Logic Bomb
Correct Answer: C. Ransomware
Rationale: Ransomware is a type of malicious software designed to encrypt
files on a system, rendering them inaccessible, and then demands a ransom
payment to restore access.
4. Which threat actor is most likely to use common hacking tools
found on the internet to attempt to compromise an organization's
web server?
A. Organized Crime
B. Insider Threat
,C. Unskilled Attacker
D. Nation-state
Correct Answer: C. Unskilled Attacker
Rationale: Unskilled attackers, sometimes called "script kiddies," typically
use existing scripts and tools downloaded from the internet to perform
attacks. They lack the expertise to develop their own sophisticated
methods.
5. What is the primary difference between a vulnerability scan and a
penetration test?
A. Vulnerability scans are always automated, while penetration tests are
always manual.
B. A penetration test exploits vulnerabilities, while a vulnerability scan only
identifies them.
C. Vulnerability scans are more accurate than penetration tests.
D. There is no difference; the terms are interchangeable.
Correct Answer: B. A penetration test exploits vulnerabilities, while a
vulnerability scan only identifies them.
Rationale: A vulnerability scan is an automated process to identify
potential weaknesses. A penetration test (pen test) goes further by actively
exploiting vulnerabilities to determine the real-world impact and confirm if
they can be used for unauthorized access.
6. A systems administrator discovers that a critical Windows server is
missing a patch for a vulnerability announced last week, but the
vulnerability scanner did not flag it. This is an example of a:
A. Zero-day attack
B. False positive
, C. False negative
D. Compensating control
Correct Answer: C. False negative
Rationale: A false negative occurs when a security tool, like a vulnerability
scanner, fails to detect a vulnerability that actually exists. This is dangerous
because it creates a false sense of security.
7. An organization wants to allow external security researchers to test
its internet-facing application and will compensate them for
discovered vulnerabilities. What program is this?
A. Red Team
B. Penetration Testing
C. Bug Bounty
D. Open-Source Intelligence
Correct Answer: C. Bug Bounty
Rationale: A bug bounty program is an initiative where an organization
offers rewards to external security researchers for identifying and reporting
vulnerabilities in its systems. This is a crowdsourced approach to
vulnerability discovery.
8. A company is deploying a new web application and wants to protect
it from SQL injection and cross-site scripting attacks. Which security
control is BEST suited for this?
A. Web Application Firewall (WAF)
B. Network Firewall
C. Intrusion Detection System (IDS)
D. Load Balancer
Correct Answer: A. Web Application Firewall (WAF)
COMPLETE TEST BANK: PRACTICE
QUESTIONS & RATIONALES –
NEWEST 2026/2027 EDITION
(COVERS ALL EXAM DOMAINS)
1. A company wants to ensure that a user cannot deny performing a
financial transaction. What security principle is being enforced?
A. Authorization
B. Non-repudiation
C. Authentication
D. Accounting
Correct Answer: B. Non-repudiation
Rationale: Non-repudiation provides proof of the origin and integrity of
data. It makes it difficult or impossible to deny that someone has
performed an action, often implemented through digital signatures and
logging.
2. A security administrator is creating an inbound firewall rule to block
traffic from a known malicious IP address. Which ACL best
accomplishes this?
A. access-list inbound deny ip source 0.0.0.0/0 destination
10.1.4.9/32
,B. access-list inbound deny ip source 10.1.4.9/32 destination
0.0.0.0/0
C. access-list inbound permit ip source 10.1.4.9/32
destination 0.0.0.0/0
D. access-list inbound permit ip source 0.0.0.0/0 destination
10.1.4.9/32
Correct Answer: B. access-list inbound deny ip source 10.1.4.9/32
destination 0.0.0.0/0
Rationale: This ACL correctly identifies the source IP (the malicious
address) and denies it from reaching any destination on the network.
The /32 is a host mask, indicating a single IP address.
3. Employees are reporting a lock symbol on their screens, and a
message demands payment to unlock their files. What attack is this?
A. Rootkit
B. Spyware
C. Ransomware
D. Logic Bomb
Correct Answer: C. Ransomware
Rationale: Ransomware is a type of malicious software designed to encrypt
files on a system, rendering them inaccessible, and then demands a ransom
payment to restore access.
4. Which threat actor is most likely to use common hacking tools
found on the internet to attempt to compromise an organization's
web server?
A. Organized Crime
B. Insider Threat
,C. Unskilled Attacker
D. Nation-state
Correct Answer: C. Unskilled Attacker
Rationale: Unskilled attackers, sometimes called "script kiddies," typically
use existing scripts and tools downloaded from the internet to perform
attacks. They lack the expertise to develop their own sophisticated
methods.
5. What is the primary difference between a vulnerability scan and a
penetration test?
A. Vulnerability scans are always automated, while penetration tests are
always manual.
B. A penetration test exploits vulnerabilities, while a vulnerability scan only
identifies them.
C. Vulnerability scans are more accurate than penetration tests.
D. There is no difference; the terms are interchangeable.
Correct Answer: B. A penetration test exploits vulnerabilities, while a
vulnerability scan only identifies them.
Rationale: A vulnerability scan is an automated process to identify
potential weaknesses. A penetration test (pen test) goes further by actively
exploiting vulnerabilities to determine the real-world impact and confirm if
they can be used for unauthorized access.
6. A systems administrator discovers that a critical Windows server is
missing a patch for a vulnerability announced last week, but the
vulnerability scanner did not flag it. This is an example of a:
A. Zero-day attack
B. False positive
, C. False negative
D. Compensating control
Correct Answer: C. False negative
Rationale: A false negative occurs when a security tool, like a vulnerability
scanner, fails to detect a vulnerability that actually exists. This is dangerous
because it creates a false sense of security.
7. An organization wants to allow external security researchers to test
its internet-facing application and will compensate them for
discovered vulnerabilities. What program is this?
A. Red Team
B. Penetration Testing
C. Bug Bounty
D. Open-Source Intelligence
Correct Answer: C. Bug Bounty
Rationale: A bug bounty program is an initiative where an organization
offers rewards to external security researchers for identifying and reporting
vulnerabilities in its systems. This is a crowdsourced approach to
vulnerability discovery.
8. A company is deploying a new web application and wants to protect
it from SQL injection and cross-site scripting attacks. Which security
control is BEST suited for this?
A. Web Application Firewall (WAF)
B. Network Firewall
C. Intrusion Detection System (IDS)
D. Load Balancer
Correct Answer: A. Web Application Firewall (WAF)
