How many Troubleshooting Scenario Questions questions are on this page?

This page has 5 Troubleshooting Scenario Questions scenario questions for the SY0-701 exam, each with detailed explanations and wrong-answer analysis.

How should I approach SY0-701 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Security+ SY0-701 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Security+ SY0-701 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SY0-701

exam code

CompTIA

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1easymultiple choice

Full question →

A help desk team wants users to be unable to install unsanctioned browser extensions or freeware on corporate Windows laptops, while approved business apps still run. Which endpoint control is best?

A
Full-disk encryption on every laptop.
Why wrong: Encryption protects data if a device is lost, but it does not control which software can run on the system.
B
Application allowlisting or application control.
This is the best choice because allowlisting permits only approved software and blocks unapproved tools, extensions, and installers. It is a strong way to reduce malware risk and limit user-driven software sprawl. Approved business applications can still run because they are explicitly allowed, which preserves usability while enforcing a controlled endpoint environment.
C
A remote access VPN.
Why wrong: A VPN protects network traffic, but it does not prevent local software installation on the laptop itself.
D
A desktop wallpaper policy.
Why wrong: Wallpaper settings are cosmetic and do not enforce software execution restrictions or improve endpoint hardening.

Full breakdown with real-world context →

Question 2hardmulti select

Full question →

A contractor is brought in to investigate a single alert on an ERP system. The contractor gets read-only access to one log source through a jump host, cannot see user payroll records, and the account expires automatically at shift end. Which two principles are being applied? Select two.

A
Least privilege, because the contractor receives only the access needed for one investigation.
The account is restricted to the minimum permissions needed to complete the assigned task.
B
Need-to-know, because the contractor sees only the log source required for the job.
The contractor is limited to information directly relevant to the alert, not broader payroll data.
C
Separation of duties, because one person cannot both request and approve the access.
Why wrong: The scenario describes restricted access, not a split between requesting and approving a transaction.
D
Defense in depth, because multiple layers of security tools are deployed around the server.
Why wrong: A jump host helps reduce exposure, but the question is about access scope rather than layered controls.
E
Zero trust, because every request is automatically denied until proven safe.
Why wrong: Zero trust emphasizes continuous verification, but the scenario specifically highlights scoped access and data restriction.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

A payment processor stores full card numbers in its transaction database, but developers and analysts should never see the real numbers in nonproduction reports or troubleshooting tools. The business still needs to correlate the same card across multiple records. Which technique is the best fit?

A
Tokenization, because it replaces the real value with a surrogate token for business use.
Tokenization preserves referential value for transactions while keeping the original card number out of ordinary views and reports.
B
Hashing, because the output can always be reversed by the application later.
Why wrong: Hashes are designed to be one-way and are not suitable when the original value must be recoverable or consistently mapped.
C
Data masking, because it permanently deletes the sensitive record from the database.
Why wrong: Masking hides displayed data, but it does not inherently replace the stored value or support secure token-based workflows.
D
Compression, because reducing file size also hides the payment information from users.
Why wrong: Compression reduces storage size, but it does not protect sensitive data from exposure or unauthorized viewing.

Full breakdown with real-world context →

Question 4easymultiple choice

Full question →

A SIEM correlation rule alerts when a single user account fails to authenticate 20 times in 5 minutes and then succeeds from the same source IP. What is the most likely reason the team should investigate this event?

A
The account was probably being used normally because the password was changed
Why wrong: Normal password changes do not usually produce many rapid failures followed by success from the same source.
B
The pattern may indicate password guessing or credential stuffing
Repeated failures followed by a success can show automated guessing, and it is worth investigating for compromise.
C
The SIEM is misconfigured because all failed logons are false positives
Why wrong: Failed logons are valid security events; the sequence can be suspicious even if some failures are legitimate.
D
The account is definitely malicious and should be deleted immediately
Why wrong: The pattern is suspicious, but confirmation and scope checking should happen before destructive account actions.

Full breakdown with real-world context →

Question 5hardmulti select

Full question →

A Windows file server was rebuilt from a gold image, but later troubleshooting re-enabled Remote Desktop, SMBv1, and the Print Spooler. The security team wants to harden the host and catch the same configuration changes early in the future. Which three actions are the best fit? Select three.

A
Disable unnecessary services and remove legacy protocols that are not required.
Disabling Remote Desktop, SMBv1, and the Print Spooler when they are not needed directly reduces attack surface. Legacy protocols and extra services are frequent entry points for attackers. A hardened file server should expose only the functions required for its role and nothing more.
B
Enforce the approved build with configuration management and drift alerts.
Configuration management helps ensure the server stays aligned with the approved baseline after maintenance or troubleshooting. Drift alerts notify the team when someone changes a setting that should remain fixed. This is the best way to catch re-enabled services before they become a long-term security problem.
C
Limit administrative access to a dedicated management subnet or jump host.
Restricting admin access to a controlled management path reduces exposure of sensitive services and makes it easier to monitor privileged activity. Even if a service must exist for a valid reason, limiting who can reach it and from where improves the host's overall security posture. It also supports least privilege for administration.
D
Leave all management ports open so technicians can troubleshoot from anywhere.
Why wrong: Leaving management ports open broadly increases the chance of abuse and makes the server easier to attack. Convenience for troubleshooting is not a substitute for controlled administration. A jump host or management network preserves access without exposing the server to every endpoint.
E
Turn off logging to reduce the chance that attackers can see the server.
Why wrong: Logging does not increase exposure in the way open ports do, and disabling logs removes valuable evidence and operational visibility. Security teams need logs to detect drift, investigate incidents, and prove what changed. Removing monitoring makes hardening and response much harder.

Full breakdown with real-world context →

These SY0-701 practice questions are part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style SY0-701 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related SY0-701 topic practice pages

General Security Concepts practice questions

Threats, Vulnerabilities, and Mitigations practice questions

Security Architecture practice questions

Security Operations practice questions

Security Program Management and Oversight practice questions

Security+ social engineering questions

Security+ cryptography practice questions

Security+ IAM questions

Security+ risk management questions

Security+ incident response questions

Security+ malware questions

Security+ vulnerability management questions

Practice scenarios

A help desk team wants users to be unable to install unsanctioned browser extensions or freeware on corporate Windows laptops, while approved business apps still run. Which endpoint control is best?

A contractor is brought in to investigate a single alert on an ERP system. The contractor gets read-only access to one log source through a jump host, cannot see user payroll records, and the account expires automatically at shift end. Which two principles are being applied? Select two.

A payment processor stores full card numbers in its transaction database, but developers and analysts should never see the real numbers in nonproduction reports or troubleshooting tools. The business still needs to correlate the same card across multiple records. Which technique is the best fit?

A SIEM correlation rule alerts when a single user account fails to authenticate 20 times in 5 minutes and then succeeds from the same source IP. What is the most likely reason the team should investigate this event?

A Windows file server was rebuilt from a gold image, but later troubleshooting re-enabled Remote Desktop, SMBv1, and the Print Spooler. The security team wants to harden the host and catch the same configuration changes early in the future. Which three actions are the best fit? Select three.