CompTIA · Free Practice Questions · Last reviewed May 2026
30real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
12% of exam · 6 sample questions below
A security engineer writes a script that computes SHA-256 hashes of critical server configuration files every night and sends an alert if any hash value has changed since the previous night. Which security goal is this control primarily designed to protect?
Confidentiality
Integrity
Integrity ensures that data has not been tampered with or altered by unauthorized parties. Comparing hashes allows the engineer to detect any unauthorized changes to the configuration files, directly supporting the integrity goal. This is the correct answer.
Availability
Authentication
A financial institution updates its access control policy to require that two different system administrators must approve and execute any changes to the core transaction processing database. Which security principle is this practice primarily designed to enforce?
Defense in depth
Separation of duties
Separation of duties is a core internal control that requires more than one person to complete a critical task or transaction. By splitting the approval and execution of access control changes between two distinct administrators, the policy ensures no single individual has the authority to unilaterally modify security settings, which significantly reduces the risk of fraud, sabotage, or unauthorized changes. This is the correct answer because the scenario explicitly describes dividing the change into approval and implementation steps, which is the hallmark of separation of duties.
Least privilege
Need to know
A security architect is designing the network security posture for a new branch office. The plan includes a next-generation firewall at the perimeter, an intrusion prevention system on the internal network, mandatory multi-factor authentication for all remote access, and quarterly security awareness training for employees. The architect explains that these controls are independent of each other so that a failure in any single control does not leave the entire network unprotected. Which security concept is the architect primarily implementing?
Least privilege
Defense in depth
Defense in depth uses multiple overlapping and independent security controls to protect an environment, ensuring that if one control fails, others continue to provide protection. The architect's design directly implements this principle.
Zero trust
Separation of duties
A security analyst at a hospital is reviewing user permissions in the electronic health record (EHR) system. The analyst discovers that all nursing staff accounts are members of the 'Administrators' group, which grants full read and write access to all patient records, as well as the ability to modify system configuration settings. The nursing staff's job responsibilities only require viewing and updating records for patients currently assigned to them. Which security principle is most directly violated by this configuration?
Defense in depth
Least privilege
The principle of least privilege dictates that users should have only the minimum permissions needed to perform their duties. Granting nursing staff full administrative rights violates this principle because the staff only need limited, role-specific access to patient records.
Non-repudiation
Availability
A defense contractor is deploying a new document management system that will store classified military intelligence. The security policy requires that user access to each document is strictly determined by the document's classification label (e.g., Confidential, Secret, Top Secret) and the user's verified security clearance level. Furthermore, system administrators must not be able to change these access rules or grant themselves access to documents above their clearance. Which access control model is best suited for this requirement?
Discretionary Access Control (DAC)
Role-Based Access Control (RBAC)
Mandatory Access Control (MAC)
Mandatory Access Control (MAC) enforces access decisions through system-wide security labels, such as user clearances and document classifications, that are centrally administered. Unlike other models, these rules cannot be overridden by the document owner or even a system administrator, ensuring that a user lacking the required clearance can never access classified documents. This aligns with the policy's requirement for non-discretionary, clearance-based enforcement, making MAC the correct choice.
Attribute-Based Access Control (ABAC)
A security analyst is investigating a data integrity incident where an attacker exploited a vulnerability in a web application to alter customer account balance records in the database. The analyst identifies the exact records that were modified and restores those records from a verified read-only backup taken prior to the attack. Which security goal is the analyst primarily addressing by restoring the records from backup?
Confidentiality
Integrity
Integrity is the security goal that assures data remains accurate, complete, and unchanged from its legitimate state. In this scenario, the unauthorized modifications directly violate that requirement, because the database no longer reflects the original authorized values. Restoring from a known-good backup is a corrective control that re-establishes an untampered baseline, thereby remediating the integrity breach and returning the data to a trustworthy condition.
Availability
Non-repudiation
Want more General Security Concepts practice?
Practice this domain22% of exam · 6 sample questions below
A security analyst is reviewing web server logs from an e-commerce application. The logs show repeated requests containing URLs with appended strings such as: `' OR '1'='1' --` and `'; DROP TABLE Users; --`. The application returned HTTP 200 responses with unexpected data in several instances. Which type of attack is most likely being attempted?
SQL injection
Correct. The log entries show SQL syntax such as `OR '1'='1'` and `DROP TABLE`, which are classic indicators of SQL injection attempts. This attack exploits improper input sanitization to manipulate database queries. These payloads are appended to SQL statements executed by the web application's backend database, allowing an attacker to bypass authentication or alter data.
LDAP injection
Command injection
Cross-site scripting (XSS)
A security analyst is reviewing the source code of a custom network service written in C. The service allocates a 256-byte buffer and uses the strcpy() function to copy incoming data into that buffer without verifying the length of the input. If an attacker sends a specially crafted payload that exceeds 256 bytes, which security control would be most effective at detecting and preventing the resulting exploitation at runtime?
Stack canaries
Correct. Stack canaries are placed before the return address on the stack. If a buffer overflow overwrites the canary, the program terminates, preventing control-flow hijacking. This is a highly effective runtime defense against stack-based buffer overflows.
Transport Layer Security (TLS)
Code signing
Data Execution Prevention (DEP)
A CFO at a mid-sized company receives an urgent email that appears to come from the CEO's email address, requesting an immediate wire transfer of $50,000 to a new vendor for a time-sensitive project. The email address displayed is 'ceo@cornpany.com' instead of the legitimate 'ceo@company.com'. The CFO follows the instruction and initiates the transfer. Later, the real CEO denies sending such a request. Which of the following security controls would have been MOST effective in preventing this type of attack from succeeding?
Deploying a stronger email spam filter that blocks all emails from unrecognized domains
Requiring multi-factor authentication (MFA) for all corporate email accounts
Implementing a policy that all financial transfers over a certain threshold must be verbally verified via a known phone number before execution
This is correct because email authentication cannot fully prevent CEO fraud, especially when the attacker uses a lookalike domain or spoofed display name. Requiring a verbal confirmation via a pre-established phone number obtained from a trusted directory, not the email itself, creates an out-of-band verification channel. This ensures the financial instruction is genuine before any transfer is executed, directly mitigating the impersonation risk.
Enabling Transport Layer Security (TLS) encryption for all outgoing email communications
A user receives a phone call from someone who claims to be a member of the company's IT support team. The caller states that the user's account has been compromised and requests the user's username, password, and the current multi-factor authentication (MFA) code to 'verify identity and secure the account.' Which type of social engineering attack is being attempted?
Spear phishing
Vishing
Vishing (voice phishing) is a social engineering attack executed over phone calls or Voice over IP (VoIP), where the attacker impersonates a trusted authority—such as IT support, a bank, or a government agency—to manipulate the victim into revealing sensitive data like passwords, PINs, or one-time MFA codes. This scenario explicitly involves a phone call, which directly aligns with the definition of vishing. The attacker leverages the voice channel to establish urgency and bypass email-based security defenses, making vishing the precise classification under CompTIA Security+.
Pretexting
Tailgating
A security analyst is reviewing the source code of a custom authentication service. The service uses a function that compares a user-supplied password to the stored password hash by iterating through each byte and returning false immediately upon the first mismatch. The analyst measures the function's execution time and discovers it varies measurably depending on how many initial bytes match. Which type of attack is this vulnerability most likely to facilitate?
Brute-force attack
Dictionary attack
Replay attack
Timing attack
A timing attack exploits measurable variations in the time it takes to execute a cryptographic operation. In this case, the early-exit comparison enables an attacker to deduce the correct secret byte by byte, making it the correct classification.
A security analyst is reviewing the results of a dynamic application security test (DAST) on a new e-commerce application. The report indicates that the application's product search functionality is vulnerable to blind SQL injection. The analyst is tasked with recommending a remediation to the development team. The developers currently concatenate user input directly into SQL queries. Which of the following recommendations would most effectively and permanently mitigate this vulnerability?
Implement a web application firewall (WAF) rule to block suspicious SQL keywords in search parameters.
Sanitize user input by escaping single quotes and other special characters before concatenation.
Replace dynamic SQL queries with parameterized prepared statements.
Parameterized prepared statements ensure that user input is always treated as data, not executable code. The database compiles the SQL statement with parameter placeholders, and the actual values are bound separately. This completely prevents SQL injection because the input cannot alter the query structure. This is the industry-standard permanent fix.
Encode all user input using HTML entity encoding before database operations.
Want more Threats, Vulnerabilities, and Mitigations practice?
Practice this domain18% of exam · 6 sample questions below
A company is redesigning its network to host a public-facing web application that accesses a confidential database. The security team needs to minimize the risk of a direct attack against the database server while still allowing the web server to retrieve and update data. Which network architecture best achieves this objective?
Place both the web server and the database server in the same DMZ segment and rely on host-based firewalls for protection.
Place the web server in the DMZ and the database server on the internal network. Configure the firewall to allow inbound traffic from the web server to the database server on the required port only.
This architecture follows the principle of defense in depth. The DMZ provides an additional security layer for the web server, while the database is isolated on the internal network with a restrictive firewall rule that limits access to only the web server, reducing the attack surface.
Connect both servers to a single internal VLAN and use a reverse proxy to forward external traffic to the web server.
Use a site-to-site VPN to connect the web server and database server, and place both behind a single NAT gateway.
A security architect is designing a new data center network that will host public-facing web servers and internal application servers handling confidential employee data. The architect places the web servers in a DMZ and the internal application servers on a separate internal network segment. A stateful firewall is configured to allow inbound HTTP/HTTPS traffic from the internet to the web servers only. The firewall also permits only the web servers to initiate outbound connections to the internal application servers on a specific TCP port, and all such traffic is encrypted using TLS. Which security architecture principle is this design primarily intended to enforce?
Least privilege
Defense in depth
Correct. The design uses network segmentation, firewalls, and encryption to create multiple layers of defense. This is the core concept of defense in depth, ensuring that a failure in one layer does not compromise the entire system.
Separation of duties
Zero trust
A company's current remote access solution uses a traditional VPN that grants users full network-layer access to the internal LAN once authenticated. The security architect wants to adopt a zero trust architecture to reduce the risk of lateral movement by compromised endpoints. Which of the following implementations best aligns with zero trust principles?
Implement a next-generation firewall and require all remote traffic to pass through it with strict rules.
Deploy a secure web gateway and require all remote users to browse through a proxy.
Use a software-defined perimeter that authenticates each user and device before granting access only to specific applications.
A software-defined perimeter (SDP) or zero trust network access (ZTNA) solution authenticates and authorizes each connection request individually, creating an encrypted tunnel only to the requested application. This prevents lateral movement because the user never receives a network-level address on the internal LAN.
Enable multi-factor authentication for VPN and implement a VPN concentrator with split tunneling.
A security architect is designing a solution to process highly sensitive financial transactions in a shared cloud environment. The architect needs to ensure that the processor and memory used to handle transaction data are isolated from the host operating system and other virtual machines, even if the hypervisor is compromised. Which technology is specifically designed to provide this level of isolation for code and data during runtime?
Trusted Platform Module (TPM)
Hardware Security Module (HSM)
Secure enclave (e.g., Intel SGX)
A secure enclave, such as Intel Software Guard Extensions (SGX), creates hardware-enforced encrypted regions of memory that protect code and data from access by the host OS, hypervisor, or other processes, even if those lower layers are compromised.
UEFI Secure Boot
A security architect is designing the network security for a web application hosted in a public cloud environment such as AWS. The application uses an Application Load Balancer (ALB) that distributes traffic to a fleet of web servers. The web servers must only accept traffic from the ALB, and all other inbound traffic must be blocked. The ALB itself needs to accept HTTP/HTTPS traffic from anywhere on the internet. Which of the following cloud security controls should the architect configure on the web servers' network interface to best meet this requirement, assuming the cloud provider offers both stateful and stateless network filtering options?
A stateless network ACL that allows inbound traffic from the ALB's subnet only.
A stateful security group that allows inbound traffic from the ALB's security group only.
Correct. Security groups are stateful and can use another security group as a source. This configuration cleanly allows only traffic originating from the ALB, automatically handles return traffic, and is the recommended cloud-native approach for controlling instance-level access.
A web application firewall (WAF) that inspects all traffic for SQL injection.
A host-based firewall on each web server that allows traffic from the ALB's private IP address.
A security architect at a retail company is deploying a new e-commerce platform that processes credit card payments. The architect needs to minimize the scope of the PCI DSS assessment. The platform consists of a web server, an application server, and a database server. The cardholder data (credit card numbers) will be processed and stored only on the database server. Which of the following network architecture designs would best reduce the PCI DSS scope?
Place all servers in the same VLAN and apply a host-based firewall on the database server.
Place the database server in a separate, isolated network segment with a dedicated firewall that blocks all traffic except from the application server on the required port.
This design creates a clear cardholder data environment (CDE) boundary. The dedicated firewall restricts access so only the application server can communicate with the database server on a specific port. The web server and application server can be placed outside the CDE if they do not directly transmit or store cardholder data, thereby reducing the PCI DSS scope.
Encrypt all data in transit using TLS and at rest using AES-256.
Implement network intrusion detection systems on all network segments.
Want more Security Architecture practice?
Practice this domain28% of exam · 6 sample questions below
A SOC analyst receives an alert from the EDR system indicating that the process 'C:\Program Files\Vendor\Updater.exe' attempted to modify the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key on a user's workstation. The analyst checks the file hash and finds it matches a known legitimate software updater. Which of the following actions is most appropriate for the analyst to take?
Disable the software updater immediately to prevent further registry modifications.
Create an exception rule in the EDR to suppress future alerts for this process.
Investigate the user's recent activity and check for signs of process hollowing or DLL injection.
This is the correct next step. The analyst should examine the process's behavior in depth, including checking for anomalies such as unexpected command-line arguments, suspicious parent processes, or indicators of code injection, before concluding whether the alert is a false positive.
Isolate the workstation from the network and reimage the system immediately.
A SOC analyst is reviewing logs from a Windows domain controller and notices a large number of failed logon attempts (Event ID 4625) from a single source IP address within a five-minute window. The account names used are random strings such as "a1b2c3", "x9y8z7", etc. The analyst then checks the source IP and finds it is a known external address from a foreign country. Which of the following is the most appropriate next step for the analyst to take?
Immediately block the IP address at the perimeter firewall.
Investigate whether any of the attempted accounts correspond to actual domain users.
This is the correct first step. If any of the random account names match legitimate domain accounts, it indicates a targeted attack and possible credential compromise. Even if no failures are logged, a successful authentication might have been recorded separately. This investigation guides subsequent containment and remediation.
Run a full antivirus scan on the domain controller.
Notify the company's legal department for law enforcement involvement.
A security analyst is responding to a potential ransomware incident on a Windows server that is still running. The analyst needs to preserve forensic evidence for analysis. Which of the following actions should the analyst perform first, based on the order of volatility?
Capture a full memory dump of the server
Correct. Memory is the most volatile data and should be captured first to preserve evidence such as running processes, network connections, and malware in memory. Any delay or system shutdown may cause this data to be lost.
Shut down the server to prevent further damage
Create a forensic disk image of the hard drive
Run a full antivirus scan on the system
A security analyst is monitoring logs from the cloud access security broker (CASB) and observes that a user account downloaded 500 GB of data from a highly sensitive SharePoint document library within a single hour. The user's historical baseline shows an average daily download of less than 10 MB. Additionally, the log shows the session originated from an IP address in a country where the company has no employees or business operations. Which of the following actions is the most appropriate for the analyst to take?
Immediately block the user account and the source IP address at the CASB.
Contact the user directly by phone to verify whether they initiated the download.
Initiate the organization's incident response process for a potential data exfiltration event.
Correct. The combination of anomalous data volume and unusual geolocation strongly suggests a security incident. The analyst should follow the incident response plan, which typically includes preserving logs, engaging the incident response team, and escalating per policy.
Disable the SharePoint document library and remove all user permissions to prevent further data loss.
A security analyst in the SOC is investigating a potential DNS tunneling incident. The analyst has identified a workstation that is making thousands of DNS queries to an external domain with base64-encoded subdomains. The analyst suspects that sensitive files from the workstation are being exfiltrated by encoding their contents into the subdomains of the DNS queries. Which of the following log sources will provide the most definitive evidence to confirm that the contents of a specific sensitive file are being transmitted in the DNS queries?
The DNS server logs showing the queried domains and subdomains.
The workstation's process creation logs showing which process initiated the DNS queries.
A full packet capture of the network traffic from the workstation showing the complete DNS messages.
A full packet capture includes the entire DNS query packet, including the complete subdomain portion. The analyst can extract and decode the base64-encoded subdomain data and compare it directly to the contents of a sensitive file on the workstation to definitively confirm data exfiltration.
The firewall logs showing outbound connections from the workstation to the external DNS server on port 53.
A security analyst is reviewing network flow logs and notices a series of outbound connections from a single internal workstation to an external IP address on TCP port 443. The connections occur every 5 minutes, each lasting about 2 seconds, and the amount of data transferred per connection is consistently around 1 KB. The workstation's user reports no unusual activity. The analyst checks the host's EDR logs and sees no malicious processes or known indicators. Which type of activity is this pattern most consistent with?
Beaconing to a command-and-control server
Beaconing to a command-and-control server is the correct classification. This pattern is hallmarks of malware that maintains a C2 channel by sending periodic 'heartbeat' messages at fixed intervals with minimal payloads. The consistent 5-minute cadence and ~1 KB data transfer per connection are classic indicators of a beaconing protocol, designed to evade detection by blending in with low-volume background traffic while ensuring the compromised host remains controllable. Such regularity is atypical for legitimate software, which usually introduces jitter or variable sizes, and the tiny payload is insufficient for meaningful data exfiltration, making C2 beaconing the most probable explanation.
Normal software update check
DNS tunneling
Data exfiltration via HTTPS
Want more Security Operations practice?
Practice this domain20% of exam · 6 sample questions below
A company is evaluating a new cloud-based customer relationship management (CRM) provider. The provider’s documentation includes a SOC 2 Type II report, but the company’s compliance team specifically requires evidence that data in transit is encrypted using TLS 1.2 or higher, and data at rest is encrypted with AES-256. Which of the following actions best demonstrates that the company has performed proper due diligence in vendor risk management?
Request the provider to sign a contractual service-level agreement (SLA) that guarantees encryption compliance.
Accept the SOC 2 Type II report as sufficient and proceed without further review.
Review the detailed control descriptions and auditor test results within the SOC 2 Type II report that address encryption of data in transit and at rest.
A SOC 2 Type II report includes a detailed description of controls, the control objectives, and the results of the auditor’s testing over a period of time. Reviewing these specific sections allows the company to verify that encryption controls are designed and operating effectively, which satisfies due diligence requirements for third-party risk management.
Conduct an independent penetration test on the provider’s infrastructure before signing the contract.
A security manager is evaluating the effectiveness of a new security awareness training program that all employees completed last quarter. The company has been conducting monthly phishing simulation campaigns for the past year. Which of the following metrics would provide the strongest evidence that the training is achieving its intended goal of changing employee behavior?
95% of employees completed the training within the deadline.
The number of employees reporting phishing attempts to the SOC increased by 40%.
The percentage of employees who clicked on a simulated phishing email decreased from 18% to 6%.
A simulated phishing click-through rate is a direct behavioral measure: it tests precisely the skill the training is designed to improve, and the marked drop from 18% to 6% shows employees are applying their knowledge in realistic conditions. Unlike self-reports or knowledge quizzes, this metric captures actual decision-making under a simulated attack, making it strong evidence of decreased susceptibility. The pre/post comparison controls for prior awareness and isolates the training’s impact on the target behavior, which is why it is the most convincing effectiveness indicator.
The number of helpdesk tickets related to password resets decreased by 10%.
After completing a vulnerability scan, a security analyst discovers that a legacy customer-facing application running on an unsupported operating system contains a critical remote code execution vulnerability. The application is essential to daily operations and cannot be patched or upgraded in the near term. Management has approved the purchase of a hardware-based network firewall that will be placed in front of the application to restrict inbound traffic to only authorized source IP addresses and port numbers. Which risk management strategy does this action primarily represent?
Risk acceptance
Risk mitigation
Correct. By deploying a firewall to restrict access, the organization is reducing the likelihood that the vulnerability can be exploited. This is a risk mitigation strategy using a compensating control.
Risk avoidance
Risk transference
A security manager is preparing a quarterly report for the board of directors on the effectiveness of the organization's security program. The manager has access to detailed technical data, including firewall log statistics, patch compliance percentages, and number of phishing simulation clicks. Which of the following would be the most appropriate way to present this information to the board?
Provide a list of all firewall rule changes made during the quarter.
Show a trend chart of the number of security incidents categorized by severity, along with average time to resolve.
This option provides a high-level, actionable summary that demonstrates the security program's effectiveness. Incident trends by severity and resolution time are key performance indicators that the board can use to assess risk reduction and operational maturity.
Include raw logs of the top 10 most frequent alerts from the SIEM.
Describe the technical architecture of the intrusion prevention system.
A security manager is leading a risk assessment for the organization. The team identifies a legacy application that contains a known critical vulnerability. The vendor has discontinued support and no patch is available. The manager calculates that the annualized loss expectancy (ALE) for exploiting this vulnerability is $50,000. Implementing a third-party web application firewall (WAF) as a compensating control would cost $80,000 per year. The organization's leadership decides that accepting the risk is the most cost-effective approach. Which of the following documents should the security manager update to formally record this risk acceptance decision and obtain the necessary sign-off?
Business impact analysis (BIA)
Risk register
Correct. The risk register is used to track identified risks, their characteristics, and the chosen treatment. Updating it with the acceptance decision, rationale, and approval is essential for risk governance.
Security baseline configuration document
Incident response plan
A security manager at a financial services company is proposing a new policy that would require annual background checks for all employees with access to sensitive customer payment data. The proposed policy, if implemented, would increase the organization's operational costs by approximately $200,000 per year. The manager needs to obtain formal approval to implement this policy. Which of the following groups is MOST likely to have the authority to approve this policy and allocate the necessary budget?
Board of directors
The board of directors has the fiduciary responsibility and ultimate authority to approve significant policy changes that require a substantial budget allocation, such as a $200,000 annual expense for background checks. This is correct because the policy crosses functional areas (security, HR, finance) and requires formal governance approval.
Chief Information Security Officer (CISO)
IT steering committee
Security operations team
Want more Security Program Management and Oversight practice?
Practice this domainThe SY0-701 exam has 90 questions and must be completed in 90 minutes. The passing score is 750/1000.
Multiple-choice and performance-based questions covering threats, cryptography, PKI, identity, network architecture, cloud security, and incident response. Some questions are performance-based (PBQs), asking you to complete tasks in a simulated environment.
The exam covers 5 domains: General Security Concepts, Threats, Vulnerabilities, and Mitigations, Security Architecture, Security Operations, Security Program Management and Oversight. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official CompTIA SY0-701 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.