CompTIA Security+ SY0-701 Practice Test — 40 Free Questions (Unofficial)
An unofficial practice set for CompTIA Security+ SY0-701. 40 original scenario questions on security fundamentals and access, threats and software weaknesses, architecture and data protection, security operations, recovery and risk, and governance.
- Questions: 40 multiple choice, each with an explanation.
- Based on: Concepts mapped to the public CompTIA Security+ SY0-701 exam objectives, with definitions checked against NIST glossary and publications.
- Affiliation: Unofficial. Not affiliated with any exam board, agency or state.
- Last reviewed: 2026-11-04.
Topics covered
- Security Fundamentals and Access
- Threats and Software Weaknesses
- Recovery Objectives and Risk
- Architecture and Data Protection
- Security Operations
- Governance and Risk Responses
All 40 questions with answers
Try each question first, then open the answer. To practice them as a timed quiz with a score and a mistake list, use the practice test.
Security Fundamentals and Access
1. A clinic encrypts exported patient files so people without the key cannot read them. Which CIA objective is the primary aim?
Show answer
Answer: C. Confidentiality
The scenario primarily prevents unauthorized disclosure, rather than ensuring uptime or faster processing.
2. An attacker changes an invoice amount while leaving the billing site online. Which CIA property has been directly violated?
Show answer
Answer: D. Integrity
Unauthorized changes to stored information directly compromise integrity.
3. A flood of traffic makes a booking service unreachable, but investigators find no data modification or disclosure. Which CIA property is directly affected?
Show answer
Answer: C. Availability
The stated impact is loss of timely access to the service.
4. A gateway checks that a user controls the authenticator associated with a claimed account. Which function is being performed?
Show answer
Answer: B. Authentication
Authentication checks a claimed identity; authorization determines permitted actions.
5. A signed-in employee can view a report but is denied permission to delete it. Which function determines this difference?
Show answer
Answer: D. Authorization
Permissions determine what an authenticated user may do.
Threats and Software Weaknesses
6. A message impersonates payroll and links to a counterfeit sign-in page that collects passwords. What is the most specific threat described?
Show answer
Answer: C. Phishing
The attack uses deceptive impersonation to solicit sensitive information.
7. A downloaded executable secretly copies local documents to an attacker's server. How should the intentionally harmful software be classified?
Show answer
Answer: A. Malware
The program deliberately performs unauthorized actions affecting confidentiality.
8. An application contains an input-validation flaw that an attacker could exploit. What does the flaw represent?
Show answer
Answer: A. A vulnerability
A weakness that can be exploited is a vulnerability, whether or not exploitation has occurred.
Recovery Objectives and Risk
9. A team models a fire that could destroy its server room. In this assessment, the potentially harmful event is what?
Show answer
Answer: C. A threat
A threat is a circumstance or event with potential adverse impact; it need not be a malicious person.
Threats and Software Weaknesses
10. A review finds an administrative account still using a publicly documented default password. Which assessment item should record this weakness?
Show answer
Answer: C. Vulnerability finding
An exploitable configuration weakness is a vulnerability, not proof of a completed intrusion.
11. An employee receives an unexpected message claiming a shared document requires a password on an unfamiliar website. Which description best captures the suspected attack?
Show answer
Answer: A. Deceptive credential solicitation
Impersonation and a request to disclose credentials are consistent with phishing.
12. A vendor releases a fix for a remotely exploitable software defect. Which action directly addresses the code defect, after the organization's testing and approval?
Show answer
Answer: A. Apply the applicable patch
A patch modifies software to repair an identified problem; the other actions do not repair the defect.
13. A team repeatedly fixes the same class of insecure input handling. What improvement most directly addresses recurrence during development?
Show answer
Answer: A. Integrate secure development practices addressing the root cause
SSDF practices aim to reduce released vulnerabilities and address causes of recurrence.
Architecture and Data Protection
14. A compromised reporting service can read only its own dataset and cannot administer other systems. Which design most directly limits the privileges available to the attacker?
Show answer
Answer: C. Least privilege
Restricting a service to necessary permissions limits what its compromise can authorize.
15. A workstation is connected to the office LAN. Under zero trust, what should that location alone establish about access to a sensitive application?
Show answer
Answer: C. It should not grant implicit trust
Zero trust does not infer trust solely from network location or asset ownership.
16. A data-analysis job needs read access to one bucket for an hour. Which grant best follows least privilege?
Show answer
Answer: D. Read-only access to that bucket for the required period
The narrow resource, action, and duration match the task's actual requirements.
17. A company wants stolen laptop files to remain unreadable without the decryption key. Which mechanism directly supports that objective?
Show answer
Answer: D. Encryption of the stored data
Encryption protects data confidentiality; a filename or unkeyed checksum does not conceal contents.
18. A recipient needs evidence that a software package came from the signing publisher and was not altered. Which mechanism is designed to support both checks?
Show answer
Answer: C. A digital signature verified with the trusted publisher key
A correctly implemented digital signature supports origin authentication and integrity, not merely secrecy.
19. An analyst compares a downloaded file's cryptographic hash with a reference hash received through a trusted channel. What is the main purpose of the comparison?
Show answer
Answer: C. Detect whether the file differs from the referenced content
A hash comparison checks content consistency; trust in the reference is a separate prerequisite.
20. A design document says plaintext will be transformed into ciphertext using an algorithm and key. Which process does it describe?
Show answer
Answer: C. Encryption
Encryption is the keyed transformation to ciphertext; authorization concerns permitted actions.
21. A service is redesigned to keep operating when one application node fails. Which CIA goal does that resilience most directly support?
Show answer
Answer: A. Availability
The design aims to preserve access during a component failure.
Security Fundamentals and Access
22. Which sign-in combines different authentication factor types?
Show answer
Answer: B. A password and a hardware security key requiring possession
Knowledge plus possession uses different factor types; two memorized secrets do not.
23. A payment process requires one employee to create a transfer and a different employee to approve it. Which principle does this implement?
Show answer
Answer: D. Separation of duty
The process prevents one person from completing both conflicting steps alone.
Security Operations
24. After an approved update window, an administrator checks software versions on every targeted host. What does this verify most directly?
Show answer
Answer: A. Whether the intended patch was installed on the targets
Installation verification checks deployment, while future security and recovery remain separate concerns.
25. An analyst needs one platform to collect security logs from multiple systems and correlate related events. Which tool category best fits?
Show answer
Answer: B. SIEM
SIEM combines security event collection and analysis across sources.
26. A sensor monitors activity and alerts on suspected attacks but is not configured to block traffic. Which role does it primarily perform?
Show answer
Answer: B. Intrusion detection
The stated role is detecting and alerting, not actively preventing the traffic.
Recovery Objectives and Risk
27. A service plan sets a target of restoring operations within two hours of disruption. Which objective expresses that recovery-duration target?
Show answer
Answer: D. RTO
RTO concerns recovery time; RPO concerns the point in time to which data must be recovered.
28. A database recovery plan permits losing at most the transactions from the last fifteen minutes. Which objective captures this data-recovery requirement?
Show answer
Answer: D. RPO
RPO identifies the required recoverable data point, unlike a service restoration duration.
29. A system fails at 12:00. The latest usable backup is from 10:00, and the required RPO is thirty minutes. Does that backup alone meet the requirement?
Show answer
Answer: D. No; it leaves a two-hour data gap
The two-hour gap exceeds the permitted thirty-minute recovery point gap.
Security Operations
30. An employee leaves the company. Which access change directly addresses continued use of permissions tied to the former role?
Show answer
Answer: C. Remove the former employee's authorized access
Access permissions should no longer authorize actions that the former role no longer permits.
31. A help-desk worker needs password-reset rights but not permission to delete payroll records. Which access choice best matches the job?
Show answer
Answer: A. Grant only the required password-reset capabilities
The granted capabilities should match assigned tasks, rather than include unrelated powers.
32. After an incident, a team uses lessons from response and recovery to improve preparation. Which approach best matches current NIST guidance?
Show answer
Answer: C. Integrate incident response with ongoing cybersecurity risk management
NIST SP 800-61r3 connects preparation, detection, response, and recovery with broader risk management.
Recovery Objectives and Risk
33. Two systems have similar vulnerabilities, but one supports emergency dispatch while the other is a disposable test host. What should a risk comparison consider besides likelihood?
Show answer
Answer: A. The magnitude of potential adverse impact
Risk considers both occurrence likelihood and the consequences for affected operations.
Governance and Risk Responses
34. An organization discontinues a planned service because its risk is outside tolerance. Which response is most directly illustrated?
Show answer
Answer: C. Risk avoidance
Not undertaking the risky activity is avoidance rather than retaining its risk.
35. A responsible manager knowingly retains a documented residual risk within approved tolerance. Which response is illustrated?
Show answer
Answer: B. Risk acceptance
Acceptance retains the recognized risk rather than eliminating the activity.
36. A firm purchases cyber insurance to shift specified financial consequences to an insurer. Which response is most directly illustrated?
Show answer
Answer: D. Risk transfer
Insurance can transfer specified financial risk; it does not remove the underlying technical threat.
37. A policy reviewer finds that one employee can request, approve, and execute a privileged change without review. Which governance weakness is most directly present?
Show answer
Answer: A. Lack of separation of duty
Concentrating conflicting approval and execution roles permits unilateral misuse.
38. A business is defining who is accountable for cybersecurity policy and oversight. Which CSF 2.0 function most directly addresses this governance work?
Show answer
Answer: D. Govern
The Govern function addresses strategy, expectations, policy, and oversight rather than a specific detection technology.
39. A buyer wants to discuss secure development expectations consistently with software suppliers. Which published resource provides a shared secure-development vocabulary?
Show answer
Answer: C. NIST SSDF
SSDF supplies common secure-development terminology useful to producers and purchasers.
Recovery Objectives and Risk
40. A report counts vulnerabilities but ignores whether they affect a critical service or are likely to be exploited. What is the key limitation of calling the count a complete risk assessment?
Show answer
Answer: A. It omits likelihood and impact context
A raw count cannot by itself capture the likelihood and consequences underlying risk.
Frequently asked questions
Is this an official exam?
No. These are original, unofficial practice questions written by PocketLearn. They are not released exam items. This set covers selected core concepts, not every SY0-701 objective, and has no performance-based questions. PocketLearn is not affiliated with CompTIA.
How many questions are there?
40 multiple-choice questions in 6 topics. Each question has an explanation.
Is it free?
Yes. You can open the practice set without an account; signing in lets you save progress and review mistakes.
Can I use it on my phone?
It opens in a mobile browser. A laptop or tablet is easier for longer sets.