CompTIA Security+ SY0-701 Exam 2026: Professional Certification
Practice Test — Security Concepts, Threats, Architecture, Security
Operations & Risk Management — 190 Multiple-Choice Questions
with Answers & Detailed Rationales
Domain 1: General Security Concepts (12% — Approximately 23 Questions)
Question 1
A security administrator implements a policy requiring all employees to complete annual
security awareness training. Which category of security control does this represent?
A. Technical
B. Managerial
C. Operational
D. Physical
Correct Answer: B
Explanation: Managerial controls are administrative actions involving policy, training, and
risk assessment. Training is managerial because it establishes organizational behavior
expectations rather than technical enforcement.
Question 2
An organization deploys a honeypot network segment designed to attract attackers and
gather intelligence on their techniques. Which security concept does this illustrate?
A. Non-repudiation
B. Deception and disruption
,C. Zero trust
D. AAA framework
Correct Answer: B
Explanation: Deception technology intentionally misleads attackers while collecting threat
intelligence. Honeypots are the primary example of deception controls that disrupt attack
economics.
Question 3
A company requires that all changes to production systems follow a documented approval
process before implementation. This is an example of:
A. Configuration enforcement
B. Change management
C. Least privilege
D. Segmentation
Correct Answer: B
Explanation: Change management ensures modifications are reviewed, approved, and
documented to prevent unauthorized alterations. It reduces operational risk from
uncoordinated system changes.
Question 4
A security engineer needs to verify that a downloaded software package has not been
altered during transit. Which cryptographic solution is most appropriate?
,A. Symmetric encryption
B. Asymmetric encryption
C. Hashing
D. Steganography
Correct Answer: C
Explanation: Hashing produces a fixed-length digest that changes if any portion of the file is
modified. Comparing the original and calculated hash verifies integrity without requiring
confidentiality.
Question 5
An organization implements a policy where users must present a smart card and enter a PIN
to access a secure facility. Which AAA component is primarily being addressed?
A. Authorization
B. Accounting
C. Authentication
D. Non-repudiation
Correct Answer: C
Explanation: Authentication verifies identity through credential presentation. The smart card
(something you have) plus PIN (something you know) establishes identity before access
decisions occur.
Question 6
, A security team implements micro-segmentation within the data center to prevent lateral
movement after a breach. Which fundamental security principle does this best support?
A. Defense in depth
B. Zero trust
C. Fail-secure
D. Separation of duties
Correct Answer: B
Explanation: Zero trust assumes breach and requires verification for every access request.
Micro-segmentation enforces least-privilege network access regardless of location within the
perimeter.
Question 7
A company wants to ensure that a signed contract cannot later be denied by the party who
signed it. Which cryptographic property is required?
A. Confidentiality
B. Integrity
C. Non-repudiation
D. Availability
Correct Answer: C
Explanation: Non-repudiation prevents signers from denying their action. Digital signatures
using the signer's private key provide cryptographic proof of origin and intent.
Practice Test — Security Concepts, Threats, Architecture, Security
Operations & Risk Management — 190 Multiple-Choice Questions
with Answers & Detailed Rationales
Domain 1: General Security Concepts (12% — Approximately 23 Questions)
Question 1
A security administrator implements a policy requiring all employees to complete annual
security awareness training. Which category of security control does this represent?
A. Technical
B. Managerial
C. Operational
D. Physical
Correct Answer: B
Explanation: Managerial controls are administrative actions involving policy, training, and
risk assessment. Training is managerial because it establishes organizational behavior
expectations rather than technical enforcement.
Question 2
An organization deploys a honeypot network segment designed to attract attackers and
gather intelligence on their techniques. Which security concept does this illustrate?
A. Non-repudiation
B. Deception and disruption
,C. Zero trust
D. AAA framework
Correct Answer: B
Explanation: Deception technology intentionally misleads attackers while collecting threat
intelligence. Honeypots are the primary example of deception controls that disrupt attack
economics.
Question 3
A company requires that all changes to production systems follow a documented approval
process before implementation. This is an example of:
A. Configuration enforcement
B. Change management
C. Least privilege
D. Segmentation
Correct Answer: B
Explanation: Change management ensures modifications are reviewed, approved, and
documented to prevent unauthorized alterations. It reduces operational risk from
uncoordinated system changes.
Question 4
A security engineer needs to verify that a downloaded software package has not been
altered during transit. Which cryptographic solution is most appropriate?
,A. Symmetric encryption
B. Asymmetric encryption
C. Hashing
D. Steganography
Correct Answer: C
Explanation: Hashing produces a fixed-length digest that changes if any portion of the file is
modified. Comparing the original and calculated hash verifies integrity without requiring
confidentiality.
Question 5
An organization implements a policy where users must present a smart card and enter a PIN
to access a secure facility. Which AAA component is primarily being addressed?
A. Authorization
B. Accounting
C. Authentication
D. Non-repudiation
Correct Answer: C
Explanation: Authentication verifies identity through credential presentation. The smart card
(something you have) plus PIN (something you know) establishes identity before access
decisions occur.
Question 6
, A security team implements micro-segmentation within the data center to prevent lateral
movement after a breach. Which fundamental security principle does this best support?
A. Defense in depth
B. Zero trust
C. Fail-secure
D. Separation of duties
Correct Answer: B
Explanation: Zero trust assumes breach and requires verification for every access request.
Micro-segmentation enforces least-privilege network access regardless of location within the
perimeter.
Question 7
A company wants to ensure that a signed contract cannot later be denied by the party who
signed it. Which cryptographic property is required?
A. Confidentiality
B. Integrity
C. Non-repudiation
D. Availability
Correct Answer: C
Explanation: Non-repudiation prevents signers from denying their action. Digital signatures
using the signer's private key provide cryptographic proof of origin and intent.
