Prepare for CompTIA Security+ (SY0-701) with free sample questions, a full-length diagnostic, topic drills, timed practice, threat analysis, security architecture, implementation, operations, incident response, governance-risk-compliance scenarios, and detailed explanations in IT Mastery.
CompTIA Security+ (SY0-701) focuses on practical security judgment across threats, architecture, implementation, operations, incident response, and governance. If you are searching for SY0-701 sample questions, a practice test, mock exam, or simulator, this is the main IT Mastery page to start on web and continue on iOS or Android with the same IT Mastery account.
Start a practice session for CompTIA Security+ (SY0-701) below, or open the full app in a new tab. For the best experience, open the full app in a new tab and navigate with swipes/gestures or the mouse wheel—just like on your phone or tablet.
Open Full App in a New TabA small set of questions is available for free preview. Subscribers can unlock full access by signing in with the same app-family account they use on web and mobile.
Prefer to practice on your phone or tablet? Download the IT Mastery – AWS, Azure, GCP & CompTIA exam prep app for iOS or IT Mastery app on Google Play (Android) and use the same IT Mastery account across web and mobile.
Free diagnostic: Try the 90-question CompTIA Security+ full-length practice exam before subscribing. Use it to separate misses around threats, architecture, implementation, operations/incident response, and governance-risk-compliance.
Security+ questions usually reward the option that preserves least privilege, secure defaults, layered controls, and the correct order of operational response.
Security+ questions usually reward layered, least-privilege decisions in the right operational sequence.
| Scenario signal | First check | Strong answer usually… | Weak answer usually… |
|---|---|---|---|
| An incident is active | Response phase | Triage, contain, preserve evidence, eradicate, recover, and document in the right order | Wipes systems before evidence or containment |
| A user needs access | Least privilege and business need | Grants scoped access through approved identity/control paths | Gives admin rights to solve the ticket |
| A system must be hardened | Secure baseline | Applies secure configuration, patching, endpoint control, encryption, and monitoring | Adds a tool without fixing defaults |
| Cloud or zero-trust design appears | Identity, segmentation, and continuous verification | Uses strong identity, policy, segmentation, monitoring, and least privilege | Trusts network location alone |
| Audit gaps are found | Governance and evidence | Tracks findings, assigns owners, remediates, and retests | Treats training completion as proof of compliance |
| Threat details are provided | Attack pattern and mitigation | Maps the behavior to the correct control or detection method | Chooses a famous control unrelated to the behavior |
| Domain area | What the exam tests | What IT Mastery practice should force | Common trap |
|---|---|---|---|
| General security concepts | Whether foundational control and risk terms are understood | Apply CIA, authentication, authorization, and control categories | Memorizing terms without use cases |
| Threats and mitigations | Whether attack behavior maps to defense | Identify the threat pattern before selecting a control | Choosing the strongest-sounding tool |
| Security architecture | Whether secure design principles fit cloud, network, and identity scenarios | Use segmentation, resilience, zero trust, and secure defaults | Relying on perimeter trust only |
| Security operations | Whether monitoring, incident response, vulnerability management, and evidence handling are sequenced correctly | Follow operational order under pressure | Skipping containment or documentation |
| Security program oversight | Whether policies, audits, risk, privacy, and compliance are governed | Connect controls to evidence and accountability | Treating compliance as paperwork only |
| Timing | Practice focus | What to review after the set |
|---|---|---|
| Days 7-5 | One 90-question diagnostic plus drills in weak Security+ domains | Whether misses came from threat recognition, architecture, IAM/control implementation, incident response, or governance |
| Days 4-3 | Mixed security scenarios with logs, architecture, and response ordering | Whether you can identify the risk and the correct control layer before choosing |
| Days 2-1 | Light review of IAM, incident-response sequence, encryption/PKI basics, secure architecture, audit findings, and common attacks | Only recurring traps; avoid deep specialist topics outside SY0-701 scope |
| Exam day | Short warm-up if useful | Choose the answer that is least privilege, layered, evidence-aware, and in the right response order |
If you can score above 75% on several unseen mixed attempts and explain the control or response sequence behind each miss, you are likely ready. Do not keep repeating familiar threat scenarios until memory replaces security reasoning from risk, evidence, and sequence.
Use these child pages when you want focused IT Mastery practice before returning to mixed sets and timed mocks.
Need concept review first? Read the CompTIA Security+ SY0-701 Cheat Sheet on Tech Exam Lexicon, then return here for timed mocks, topic drills, and full IT Mastery practice.
Topic: Domain 5: Security Program Management and Oversight
A new CISO wants to be ready for an upcoming external regulatory audit. The goals are to verify that security controls actually operate as required by policy and to ensure any gaps are formally corrected and rechecked. Which of the following actions/controls will BEST meet these requirements? (Select TWO.)
Options:
Correct answers: A and D
Explanation: The choice to launch a recurring internal audit program aligns directly with the requirement to verify that security controls operate as required by policy and regulation. Internal auditors act as an independent check on operations, reviewing documentation and performing tests to confirm compliance and control effectiveness.
The choice to implement a centralized audit-finding register with owners, due dates, and follow-up testing addresses the requirement to ensure any gaps are formally corrected and rechecked. This is how audit findings are typically handled in governance programs: they are tracked, remediated, and then retested to verify closure, providing clear evidence for both internal leadership and external auditors.
Topic: Domain 3: Security Architecture
Which statement BEST describes how security should be integrated into a DevSecOps software development lifecycle (SDLC)?
Options:
Best answer: D
Explanation: The option describing security checks that are automated and embedded throughout the pipeline, starting early and running on every change, aligns directly with the DevSecOps concept. It captures both key ideas: early integration within the SDLC and continuous, automated enforcement in the pipeline.
Topic: Domain 2: Threats, Vulnerabilities, and Mitigations
Which of the following statements about common web application attacks is INCORRECT? (Select TWO.)
Options:
../ (dot-dot-slash) to try to access files outside the intended web root directory.' OR 1=1-- intended to alter backend database queries.Correct answers: C and E
Explanation: The statement that CSRF “usually requires the attacker to install malware on the victim’s browser” is incorrect because CSRF relies on normal browser behavior and existing authentication (cookies, sessions), not on compromising the browser. The statement that command injection “only affects SQL databases” is also incorrect because command injection typically targets operating system commands or other interpreters; it is SQL injection that specifically targets databases via SQL queries.
Topic: Domain 3: Security Architecture
A security analyst at a 200‑employee company is tasked with hardening all Windows and macOS laptops after a ransomware incident traced to unpatched software and users installing unapproved apps. Management wants a standard secure configuration on every endpoint, to minimize what users can install, and to ensure systems receive patches automatically even when staff work remotely, all without heavy manual effort from IT. Which of the following actions BEST meets these requirements?
Options:
Best answer: D
Explanation: The option that creates and deploys a hardened endpoint baseline via a centralized configuration management tool is correct because it:
This directly meets all stated requirements: standardized secure configuration, prevention of unapproved installations, automatic patching for remote staff, and low ongoing administrative overhead.
Topic: Domain 2: Threats, Vulnerabilities, and Mitigations
A security analyst is reviewing a cloud environment for common misconfigurations. Which of the following findings BEST represents an overly broad IAM policy, violating the principle of least privilege?
Options:
Best answer: C
Explanation: The option describing an application service account role that grants full administrative access to all cloud services in the account is correct because it is clearly an IAM permissions issue.
The discriminating factor is that this finding is about the scope of a role’s permissions (identity and authorization). Giving a service account full administrative access across all services is a textbook example of an overly broad IAM policy and violates least privilege: the account should only have the minimal rights needed for its specific application tasks.
Topic: Domain 4: Security Operations
Which of the following statements about the order of volatility in digital forensics is NOT correct?
Options:
Best answer: C
Explanation: The statement that a forensics team should image long-term backups before collecting data from running processes is incorrect because it reverses the order of volatility. Running processes and RAM are highly volatile and can change or disappear at any moment, so they must be collected first. Backups are among the least volatile data sources and can usually be acquired later without as much risk of loss or alteration.
Topic: Domain 4: Security Operations
Which of the following statements about containment during incident response are TRUE and best balance limiting damage with maintaining business operations? (Select TWO.)
Options:
Correct answers: C and D
Explanation: The statement about quarantining only confirmed compromised endpoints is correct because it applies targeted network isolation: infected systems are contained, but unaffected hosts stay online, which aligns with the goal of minimizing business impact.
The statement about disabling a single compromised user account instead of shutting down the entire identity provider is also correct, as it removes the attacker’s access path while keeping authentication services available for all other users and applications. Both choices reflect the principle of applying the least disruptive control that still effectively contains the threat.
Topic: Domain 3: Security Architecture
In containerized application deployments, which option BEST describes the security purpose of image scanning?
Options:
Best answer: A
Explanation: The option describing analysis of container images for known vulnerabilities, malware, and misconfigurations before deployment correctly defines image scanning. This aligns with secure container architecture practices that aim to reduce risk by ensuring only vetted, hardened images are allowed into runtime environments.
Topic: Domain 4: Security Operations
Which statement BEST defines the principle of least privilege in the context of service accounts and local administrator access?
Options:
Best answer: D
Explanation: The choice stating that accounts are granted only the minimum permissions needed to perform their specific tasks accurately defines least privilege in a concise way. The option about users accessing only data relevant to their jobs instead describes the need-to-know principle, which is related but focuses specifically on restricting information access rather than overall permissions.
Topic: Domain 2: Threats, Vulnerabilities, and Mitigations
A security analyst is investigating user reports that their laptops are repeatedly dropped from the corporate Wi-Fi even though the signal appears strong and the access point remains online. Logs show many unsolicited disconnect events for affected clients. Which type of wireless attack is MOST likely occurring?
Options:
Best answer: D
Explanation: The choice describing a deauthentication attack is correct because this attack specifically involves sending forged deauthentication (or disassociation) frames to clients or the access point. This causes clients to be dropped from the network repeatedly, even when the AP is working and signal strength is good. The observable sign is frequent, involuntary disconnects without an underlying RF or AP failure, which matches the scenario.
Topic: Domain 5: Security Program Management and Oversight
A mid-sized company has a documented disaster recovery plan that lists systems, RTO/RPO targets, and an incident commander role assigned to the operations director. However, during a recent regional power outage, the operations director was unreachable while traveling, and no one was formally authorized to take over their responsibilities. Senior leadership now wants to ensure that key leadership and operational responsibilities are clearly covered if a primary role holder is unavailable during or after a disruptive event, without significantly increasing cost or complexity.
Which of the following changes to the business continuity planning process would BEST meet this requirement?
Options:
Best answer: C
Explanation: The option that creates a written role matrix with primary and backup owners, delegation triggers, and required cross-training is correct because it is a textbook application of succession planning and role mapping in BC/DR.
This change directly ensures key responsibilities are covered even if primary role holders are unavailable, and it does so through process and documentation, not costly new tools or major reorganization.
Topic: Domain 3: Security Architecture
An organization deploys a mobile device management (MDM) solution that creates a separate encrypted work container on employee-owned smartphones. Corporate apps and data must run only inside this container, which can be remotely wiped without affecting users’ personal photos or apps. Which security concept is MOST clearly illustrated by this control?
Options:
Best answer: B
Explanation: The choice describing data separation and containerization to isolate corporate information from personal data matches every detail in the scenario:
This is the primary security concept being tested: using MDM/MAM containerization to enforce logical and cryptographic separation between work and personal data on the same physical device.
Topic: Domain 2: Threats, Vulnerabilities, and Mitigations
Which of the following statements about communicating security assessment results are NOT appropriate best practices? (Select TWO.)
Options:
Correct answers: C and D
Explanation: The statement that recommends avoiding remediation guidance is incorrect because a core purpose of an assessment report is to tell stakeholders not only what is wrong but also how to address it. Objectivity comes from evidence and sound reasoning, not from withholding recommendations.
The statement that suggests using vague language like “might be an issue” is also incorrect. Such phrasing downplays risk and can cause confusion or inaction. Good reports use precise, direct language and clearly communicate the level of concern for each finding.
Topic: Domain 4: Security Operations
A midsize company has a flat office LAN and handles security incidents with ad-hoc, manual steps. During business hours, the EDR platform alerts on active ransomware behavior on a single accounting workstation that is connected to a shared file server used by the entire finance team. The file server shows no suspicious activity yet, and accounting is currently processing payroll, which must continue with minimal disruption.
Which containment action is the most appropriate next step to reduce risk while maintaining business operations?
Options:
Best answer: A
Explanation: Using the EDR tool to isolate the affected workstation from the network while keeping it powered on is the best choice because it:
This precisely balances the requirement to contain the incident quickly with the need to minimize business disruption.
Topic: Domain 4: Security Operations
Which statement about internal and external communication during a cybersecurity incident is MOST accurate according to a well-defined incident communication plan?
Options:
Best answer: A
Explanation: The option stating that internal updates may include detailed technical and investigative information while external communications are limited to approved, high-level facts delivered by designated spokespersons is correct because it reflects how incident communication plans separate audience, detail level, and roles. Internal teams need specifics to act; external audiences need concise, consistent information provided through an authorized channel to avoid confusion, leaks, or legal issues.
Topic: Domain 5: Security Program Management and Oversight
Which data classification label is MOST appropriate for information that can be shared freely outside the organization and does not require access controls to protect it?
Options:
Best answer: C
Explanation: The choice labeled Public is correct because public data is designed for open distribution. By definition, it can be shared outside the organization without causing harm, so it does not require strict access controls to protect its confidentiality.
Topic: Domain 1: General Security Concepts
Which TWO of the following statements about public key infrastructure (PKI), digital certificates, and certificate authorities are INCORRECT? (Select TWO.)
Options:
Correct answers: C and D
Explanation: The statement claiming that the private key is embedded inside the digital certificate is incorrect because certificates only contain the public key and identity information; exposing the private key in a certificate would destroy confidentiality and non-repudiation. The statement asserting that self-signed certificates are automatically trusted by all external clients is also incorrect because public browsers and operating systems only trust roots in their preconfigured trust stores, and self-signed internal certificates are not included there by default.
Topic: Domain 3: Security Architecture
A hospital installs network-connected infusion pumps that use outdated firmware and cannot run endpoint protection. The security team’s primary goal is to prevent any compromise of these pumps from reaching other clinical or business systems. Which control best meets this goal?
Options:
Best answer: C
Explanation: The option that places the infusion pumps on a dedicated VLAN with strict firewall rules is correct because it directly implements network segmentation and isolation. By restricting pump communications to only required traffic with specific management servers, it:
This matches the explicit requirement: prevent any compromise of the pumps from reaching other clinical or business systems. The discriminating factor is network isolation, which this control provides and the others do not.
Topic: Domain 4: Security Operations
A SOC analyst is reviewing a SIEM alert showing outbound connections from an internal workstation to 203.0.113.55. The SIEM has automatically enriched the alert with several threat intelligence sources, shown below.
Exhibit:
| Source type | Indicator | Confidence | Note |
|---|---|---|---|
| Open-source threat feed | 203.0.113.55 | High | Listed as C2 server for current ransomware campaign |
| National CERT bulletin | 203.0.113.55 | High | Involved in multiple confirmed incidents this week |
| Industry sharing community | 203.0.113.55 | Medium | Reported by peers as active outbound beacon target |
| Internal firewall logs | 203.0.113.55 | N/A | Repeated outbound connections from host WS-17 |
Which statement BEST explains the role of these threat intelligence feeds and information‑sharing communities in identifying and correlating this IOC?
Options:
Best answer: B
Explanation: The choice stating that the feeds “independently corroborate the same IP as malicious, increasing confidence that 203.0.113.55 is a high-priority IOC to investigate and contain” matches the exhibit.
All three external sources in the table list 203.0.113.55 as malicious: the open-source feed (high confidence, C2 server), the national CERT bulletin (high confidence, recent incidents), and the industry sharing community (medium confidence, active beacon target). When these are combined with internal firewall logs showing repeated outbound connections from WS-17, the SIEM can correlate and raise the alert’s priority. This is precisely the role of threat intelligence feeds and information-sharing communities: to enrich, corroborate, and prioritize IOCs rather than to act as standalone proof or configuration archives.
Topic: Domain 4: Security Operations
A SOC analyst reviews a SIEM alert: a user account shows multiple failed logins from a foreign IP, then a successful VPN login, followed within minutes by large data downloads from a file server. The user reports they did not log in at that time. Which response is the MOST INCORRECT interpretation of this alert?
Options:
Best answer: B
Explanation: The choice that marks the alert as a false positive and closes it because no malware was detected and the VPN login used valid credentials is the most incorrect interpretation.
This response:
At Security+ level, analysts are expected to use corroborating evidence to recognize this as a likely true positive and avoid unsafe dismissal of the alert.
Topic: Domain 4: Security Operations
A junior analyst collects a USB drive from an employee’s desk during an internal investigation. The company wants to preserve the drive as potential legal evidence and maintain a clear chain of custody. Which of the following actions should the analyst AVOID? (Select TWO.)
Options:
Correct answers: A and B
Explanation: Copying the contents of the USB drive directly to the analyst’s workstation for a quick review before any formal imaging or documentation is a poor practice. It can change file timestamps, metadata, and even content, making it hard to prove that the evidence is in its original state. This undermines integrity and can be challenged in court.
Handing the USB drive to a manager in a hallway without logging the transfer and relying on memory instead of documentation is also unsafe. This creates a gap in the chain of custody, because there is no reliable record of who controlled the evidence, when, and under what conditions. Such gaps can cause the evidence to be considered unreliable or inadmissible.
Topic: Domain 4: Security Operations
A SOC analyst is investigating a potentially compromised user account. The account is cloud-based and can log in from multiple devices and IP addresses. In the SIEM, the analyst wants to see only events related to that specific account from all log sources. Which configuration is MOST appropriate?
Options:
Best answer: C
Explanation: The choice to filter events where the user field matches the suspected account across all log sources directly aligns with the requirement. The discriminating factor is that the filter is user-centric, not tied to a particular device, IP, or severity level.
Because the account is cloud-based and can log in from various locations, any IP- or host-based filter would miss activity from other devices. A username-based filter works across all log sources that include that username field, giving a complete view of the account’s activity and supporting an effective compromise investigation.
Topic: Domain 2: Threats, Vulnerabilities, and Mitigations
A midsize online retailer is building its annual security assessment plan for its customer-facing web applications. Management wants: 1) a routine, low-impact way to automatically identify missing patches and common misconfigurations each month, and 2) a separate engagement once a year where testers attempt to exploit weaknesses like real attackers, under tightly defined rules and change windows. Which of the following actions/controls will BEST meet these requirements? (Select TWO.)
Options:
Correct answers: A and D
Explanation: The option that schedules an authenticated, automated monthly vulnerability scan with disruptive checks disabled matches the description of a vulnerability scan: it is routine, largely automated, low‑impact, and focuses on finding missing patches and misconfigurations.
The option that contracts an external firm for an annual manual penetration test with a signed rules‑of‑engagement and defined maintenance windows describes a proper penetration test: a controlled, intrusive assessment where testers attempt to exploit weaknesses like real attackers, under formal ROE to manage risk and scope.
Together, these two actions directly satisfy management’s requirements for both routine automated scanning and controlled, exploit‑focused testing.
Topic: Domain 4: Security Operations
A security analyst is investigating suspicious remote logins to a Linux web server from unfamiliar IP addresses. The goal is to understand how accounts were accessed and whether the attacker moved laterally from this host. Which TWO data sources should the analyst prioritize collecting to support this investigation? (Select TWO.)
Options:
Correct answers: A and B
Explanation: The choice describing web server access logs is correct because access logs are the primary record of HTTP(S) activity to the web server, including client IPs, timestamps, requested resources, and often session or username information. This helps answer which remote clients connected, at what times, and what they accessed around the suspicious login period.
The choice describing operating system authentication logs is correct because files such as /var/log/auth.log on Linux record SSH and other authentication events, including successful and failed login attempts, usernames, and (for network logins) source IPs. These logs are essential for determining which accounts were used, whether brute-force or password-guessing occurred, and whether attackers obtained shell access that could be used for lateral movement.
Use this map after the sample questions to connect individual items to the Security+ threats, architecture, operations, governance, and incident-response decisions these practice samples test.
flowchart LR
S1["Security scenario or alert"] --> S2
S2["Classify threat vulnerability or control domain"] --> S3
S3["Assess asset identity data and network impact"] --> S4
S4["Apply prevention detection or response control"] --> S5
S5["Verify evidence and recovery"] --> S6
S6["Update policy training and monitoring"]
| Cue | What to remember |
|---|---|
| Control type | Separate preventive, detective, corrective, deterrent, compensating, physical, technical, and administrative controls. |
| Identity | Use MFA, least privilege, federation, PAM, and account lifecycle controls. |
| Data protection | Apply classification, encryption, DLP, backups, and retention. |
| Incident response | Prepare, detect, analyze, contain, eradicate, recover, and learn. |
| Governance | Connect policies, risk, compliance, training, and third-party controls to technical decisions. |