CompTIA Security+ (SY0-701) — Questions and Answers

Question 1: Which risk response strategy involves reducing the likelihood or impact of a risk?

Risk escalation
Risk acceptance
Risk transfer
Risk mitigation (Correct answer)

Correct answer: Risk mitigation

Risk mitigation involves taking proactive steps to reduce either the probability of a risk occurring or its potential impact if it does occur.

Question 2: The Gramm-Leach-Bliley Act (GLBA) Safeguards Rule applies primarily to which type of organization?

Financial institutions handling consumers' nonpublic personal information (Correct answer)
Federal defense contractors
Hospitals and health plans
K-12 public schools

Correct answer: Financial institutions handling consumers' nonpublic personal information

GLBA requires financial institutions to protect customers' nonpublic personal financial information.

Question 3: What is the main security risk of reusing the same nonce with the same key in AES-GCM?

The ciphertext becomes twice as long
Keystream reuse exposes plaintext relationships and allows authentication tag forgery (Correct answer)
Decryption becomes impossible for the recipient
The key length is reduced to 64 bits

Correct answer: Keystream reuse exposes plaintext relationships and allows authentication tag forgery

Nonce reuse in GCM repeats the CTR keystream and leaks the authentication subkey, allowing forgeries.

Question 4: What is edge computing in the context of IoT?

Using edge routers to block IoT traffic from the internet
Processing data closer to the device rather than sending everything to the cloud (Correct answer)
Connecting IoT devices via Bluetooth only
Storing all IoT data in a central cloud data center

Correct answer: Processing data closer to the device rather than sending everything to the cloud

Edge computing moves processing and storage closer to where data is generated, reducing latency and bandwidth usage compared to centralized cloud processing.

Question 5: Which RAID level provides fault tolerance by writing identical data to two disks?

RAID 0
RAID 1 (Correct answer)
RAID 6
RAID 5

Correct answer: RAID 1

RAID 1 mirrors data across two disks so the array survives the failure of either disk.

Question 6: Which business continuity test involves key personnel walking through a scenario in a meeting room without activating any systems?

Parallel test
Simulation failover
Tabletop exercise (Correct answer)
Full interruption test

Correct answer: Tabletop exercise

A tabletop exercise is a discussion-based walkthrough of roles and responses with no impact on production.

Question 7: Which emerging technology uses distributed ledger to enable automated, self-executing contracts?

Smart contracts on blockchain (Correct answer)
Differential privacy
Federated learning
Quantum computing

Correct answer: Smart contracts on blockchain

Smart contracts are self-executing programs stored on a blockchain that automatically enforce agreement terms when predefined conditions are met.

Question 8: Which approach to compliance is considered most effective?

Focusing compliance efforts only on areas that have been cited previously
A reactive approach that addresses issues only after violations
A proactive approach that integrates compliance into daily operations (Correct answer)
Hiring a consultant once a year for a brief review

Correct answer: A proactive approach that integrates compliance into daily operations

A proactive compliance approach that integrates regulatory requirements into daily operations is most effective at preventing violations and maintaining standards.

Question 9: A security team wants to divide a data center so that workloads can only communicate with explicitly allowed peers, even within the same subnet. What technique is this?

Link aggregation
Microsegmentation (Correct answer)
Port address translation
Supernetting

Correct answer: Microsegmentation

Microsegmentation enforces granular, workload-level policies to limit lateral movement.

Question 10: Which organizations must comply with PCI DSS?

Only U.S. federal agencies accepting payments
Any organization that stores, processes, or transmits payment cardholder data (Correct answer)
Only banks that issue credit cards
Only e-commerce companies with more than 1 million transactions per year

Correct answer: Any organization that stores, processes, or transmits payment cardholder data

PCI DSS applies to all entities that store, process, or transmit cardholder data, regardless of size.

Question 11: Which AI technique enables IoT devices to collaboratively train a model without sharing raw data?

Transfer learning
Supervised batch learning
Federated learning (Correct answer)
Reinforcement learning

Correct answer: Federated learning

Federated learning trains a shared model across distributed devices by exchanging model updates rather than raw data, preserving privacy on each device.

Question 12: Which feature on a switch protects against rogue DHCP servers by allowing DHCP offers only from trusted ports?

Storm control
BPDU Guard
DHCP snooping (Correct answer)
Dynamic ARP Inspection

Correct answer: DHCP snooping

DHCP snooping designates trusted ports so only legitimate DHCP servers can respond to clients.

Question 13: A change management policy most commonly requires which step before a production change is implemented?

Disabling logging during the change window
Notifying customers via social media
Deleting the previous version of the system
Review and approval by a Change Advisory Board (CAB) with a rollback plan (Correct answer)

Correct answer: Review and approval by a Change Advisory Board (CAB) with a rollback plan

Formal change management requires documented review, approval, testing, and a backout plan before production changes.

Question 14: A company relies on one internet connection from a single ISP. What is the best way to eliminate this single point of failure?

Increase the bandwidth of the current link
Add a firewall in front of the router
Add a redundant link from a different ISP (Correct answer)
Sign a longer SLA with the same ISP

Correct answer: Add a redundant link from a different ISP

A second link from a diverse provider removes dependency on one circuit and one carrier.

Question 15: A tester wants to intercept and modify HTTP requests between the browser and a web application. Which tool is best suited?

Wireshark
Nikto
Nmap
Burp Suite (Correct answer)

Correct answer: Burp Suite

Burp Suite works as an intercepting proxy that lets testers view and edit requests before they are sent on.

Question 16: What is the first phase of the Lockheed Martin Cyber Kill Chain?

Reconnaissance (Correct answer)
Exploitation
Weaponization
Delivery

Correct answer: Reconnaissance

Attackers first gather information about the target during reconnaissance.

Question 17: Which IEEE 802.11 standard, also known as WiGig, operates in the 60 GHz band to achieve multi-gigabit speeds over very short distances?

802.11ac
802.11n
802.11ax
802.11ad (Correct answer)

Correct answer: 802.11ad

IEEE 802.11ad (WiGig) operates at 60 GHz, delivering throughput up to 7 Gbps but with extremely limited range due to poor wall penetration at that frequency.

Question 18: What is the correct relationship between the recovery time objective (RTO) and the maximum tolerable downtime (MTD)?

RTO must be greater than MTD
RTO and MTD are unrelated
MTD must be less than RTO
RTO must be less than or equal to MTD (Correct answer)

Correct answer: RTO must be less than or equal to MTD

Systems must be restored within the RTO, which must fit inside the MTD to avoid unacceptable business harm.

Question 19: Which best describes the scope of Database Management & Security in professional practice?

A narrow topic relevant only to entry-level professionals
A theoretical framework with no practical applications
An outdated concept no longer relevant to modern practice
A comprehensive area covering both theoretical foundations and practical applications (Correct answer)

Correct answer: A comprehensive area covering both theoretical foundations and practical applications

Database Management & Security encompasses both theoretical foundations and practical applications that are essential to professional practice in this field.

Question 20: An attacker sends double-tagged 802.1Q frames to reach a VLAN they are not assigned to. Which mitigation is most effective?

Enable jumbo frames on trunks
Increase the STP priority
Change the native VLAN to an unused VLAN and avoid using it for user traffic (Correct answer)
Disable port security

Correct answer: Change the native VLAN to an unused VLAN and avoid using it for user traffic

Double-tagging exploits the native VLAN, so using an unused native VLAN defeats the attack.

Question 21: What is a major drawback of a reciprocal agreement with another company to share facilities during a disaster?

It is the most expensive recovery option
It is often unenforceable and the partner may lack spare capacity (Correct answer)
It requires a dedicated hot site contract
It eliminates the need for testing

Correct answer: It is often unenforceable and the partner may lack spare capacity

Reciprocal agreements are inexpensive but hard to enforce, and the partner may not have capacity when both are affected.

Question 22: An attacker sets up an access point with the same SSID as a corporate network to capture user credentials. What is this attack called?

Deauthentication replay
Evil twin (Correct answer)
War driving
Bluesnarfing

Correct answer: Evil twin

An evil twin impersonates a legitimate AP to lure clients into connecting.

Question 23: Which machine learning deployment technique runs AI models directly on IoT devices?

Cloud inference
TinyML / on-device inference (Correct answer)
Federated learning only
Batch processing

Correct answer: TinyML / on-device inference

TinyML optimizes machine learning models to run on microcontrollers and low-power chips, enabling real-time AI inference without cloud connectivity.

Question 24: A DDoS attacker sends small queries with a spoofed source IP to open resolvers that return much larger responses to the victim. What is this called?

Ping of death
Smurf attack
Teardrop attack
DNS amplification attack (Correct answer)

Correct answer: DNS amplification attack

DNS amplification uses spoofed requests to reflect magnified responses at a target.

Question 25: How does Cloud Computing & Virtualization contribute to overall professional effectiveness?

It is relevant only during the certification examination
It serves only as a credential requirement with no practical impact
It applies only to supervisory-level professionals
It provides essential knowledge and skills that directly impact quality of work and outcomes (Correct answer)

Correct answer: It provides essential knowledge and skills that directly impact quality of work and outcomes

Cloud Computing & Virtualization directly contributes to professional effectiveness by providing essential knowledge and skills that improve the quality of work and outcomes across all career levels.

Question 26: An attacker floods a switch with frames containing thousands of fake source MAC addresses, causing it to broadcast traffic out all ports. What is this attack called?

VLAN hopping
DNS poisoning
ARP spoofing
MAC flooding (Correct answer)

Correct answer: MAC flooding

MAC flooding overflows the CAM table so the switch fails open and acts like a hub.

Question 27: What does '5G network slicing' enable for IoT deployments?

Slicing the radio spectrum in half for IoT use
Physically partitioning cell towers
Limiting IoT devices to 4G speeds
Creating virtual dedicated networks with guaranteed QoS for specific IoT use cases (Correct answer)

Correct answer: Creating virtual dedicated networks with guaranteed QoS for specific IoT use cases

5G network slicing allows operators to create isolated virtual network segments with specific latency, bandwidth, and reliability guarantees tailored to different IoT applications.

Question 28: A company has many unused VMs consuming resources and licenses because they were never decommissioned. What is this problem called?

Resource pooling
VM escape
Hypervisor hardening
VM sprawl (Correct answer)

Correct answer: VM sprawl

VM sprawl occurs when VMs multiply without management, wasting resources and increasing security risk.

Question 29: What distinguishes a SOC 2 Type II report from a SOC 2 Type I report?

Type II is a self-assessment without an auditor
Type II covers financial controls only
Type II only evaluates control design at a single point in time
Type II evaluates the operating effectiveness of controls over a period of time (Correct answer)

Correct answer: Type II evaluates the operating effectiveness of controls over a period of time

Type I assesses control design at a point in time, while Type II tests operating effectiveness over a period, typically 6-12 months.

Question 30: A legacy system cannot support multifactor authentication, so the organization isolates it on a restricted VLAN with extra monitoring. What type of control is this?

Corrective control
Directive control
Compensating control (Correct answer)
Deterrent control

Correct answer: Compensating control

A compensating control is an alternative measure used when the primary required control cannot be implemented.

Question 31: What is the primary security risk of using unsegmented flat networks for IoT devices?

Increased latency for cloud API calls
Slower Wi-Fi speeds for laptops
Compromised IoT devices can laterally move to attack critical corporate systems (Correct answer)
Higher electricity costs for IoT sensors

Correct answer: Compromised IoT devices can laterally move to attack critical corporate systems

Without network segmentation, a compromised IoT device has unrestricted access to the same network as servers and workstations, enabling lateral movement attacks.

Question 32: What is the primary security benefit of placing a jump server (bastion host) between administrators and sensitive servers?

It load-balances administrative sessions
It replaces the need for multifactor authentication
It increases network throughput to servers
It centralizes and audits privileged access to a protected zone (Correct answer)

Correct answer: It centralizes and audits privileged access to a protected zone

A jump server provides a single, hardened, monitored entry point for administrative access.

Question 33: What is the primary purpose of a risk register?

To document identified risks, owners, ratings, and response plans (Correct answer)
To list all hardware assets and serial numbers
To log user access requests
To record firewall rule changes

Correct answer: To document identified risks, owners, ratings, and response plans

A risk register is a central record that tracks each risk, its assessment, its owner, and the planned response.

Question 34: A help desk technician is given only the permissions needed to reset passwords, not to modify server configurations. Which principle is applied?

Defense in depth
Need to share
Implicit deny
Least privilege (Correct answer)

Correct answer: Least privilege

Least privilege grants users only the minimum access required to perform their job.

Question 35: A company purchases a cyber insurance policy to cover losses from a data breach. Which risk response strategy is this?

Risk mitigation
Risk avoidance
Risk transference (Correct answer)
Risk acceptance

Correct answer: Risk transference

Insurance shifts the financial impact of a risk to a third party, which is risk transference.

Question 36: What does a risk matrix assess?

The timeline for risk resolution
The number of employees affected
The probability and impact of identified risks (Correct answer)
Only the financial cost of risks

Correct answer: The probability and impact of identified risks

A risk matrix evaluates risks based on two dimensions: the probability (likelihood) of occurrence and the potential impact (severity) if the risk materializes.

Question 37: Which function was added to the NIST Cybersecurity Framework in version 2.0?

Recover
Identify
Detect
Govern (Correct answer)

Correct answer: Govern

NIST CSF 2.0 (2024) added Govern as a sixth function alongside Identify, Protect, Detect, Respond, and Recover.

Question 38: In a data governance model, who is responsible for classifying data and approving who may access it?

End user
Data custodian
Data owner (Correct answer)
Data processor

Correct answer: Data owner

The data owner is accountable for classification and access decisions, while custodians implement the technical controls.

Question 39: Which defense allows a server to handle SYN floods without storing state for half-open connections?

Rate-limited ICMP
NAT traversal
Port knocking
SYN cookies (Correct answer)

Correct answer: SYN cookies

SYN cookies encode connection info in the sequence number, avoiding backlog allocation.

Question 40: What distinguishes inherent risk from residual risk?

Inherent risk is financial; residual risk is operational
Inherent risk is internal; residual risk is external
There is no meaningful difference between them
Inherent risk exists before controls; residual risk remains after controls are applied (Correct answer)

Correct answer: Inherent risk exists before controls; residual risk remains after controls are applied

Inherent risk is the level of risk present before any controls are implemented, while residual risk is the level that remains after controls and mitigations are applied.

Question 41: What are STIX and TAXII used for?

Sharing threat intelligence in a structured, automated way (Correct answer)
Encrypting email messages
Segmenting enterprise networks
Automating patch deployment

Correct answer: Sharing threat intelligence in a structured, automated way

STIX is the format for describing threat intelligence, and TAXII is the protocol for exchanging it.

Question 42: The Sarbanes-Oxley Act (SOX) primarily requires IT controls that protect which of the following?

Student education records
Integrity of financial reporting at publicly traded companies (Correct answer)
Patient medical records
Consumer credit card numbers

Correct answer: Integrity of financial reporting at publicly traded companies

SOX Section 404 requires public companies to maintain internal controls over financial reporting, including supporting IT systems.

Question 43: Which tool is best known for fast, GPU-accelerated offline password hash cracking?

Responder
Medusa
Hydra
Hashcat (Correct answer)

Correct answer: Hashcat

Hashcat uses GPUs to crack captured hashes offline at very high speed.

Question 44: What common challenge do professionals face when applying Access Control & Identity Management principles?

The principles are too simple to present any challenge
Finding the relevant textbook chapter
Obtaining permission to use the principles
Balancing theoretical best practices with practical constraints and real-world conditions (Correct answer)

Correct answer: Balancing theoretical best practices with practical constraints and real-world conditions

Professionals commonly face the challenge of adapting theoretical best practices in Access Control & Identity Management to the practical constraints and varying conditions encountered in real-world settings.

Question 45: Which practice, described in BCP 38, has providers drop packets from customer networks whose source addresses are spoofed?

Split tunneling
Port forwarding
Route summarization
Ingress filtering (Correct answer)

Correct answer: Ingress filtering

BCP 38 network ingress filtering drops packets with source addresses not belonging to the originating network.

Question 46: What is residual risk?

Risk that remains after security controls have been applied (Correct answer)
Risk identified during the initial assessment before any controls
Risk that is transferred to a vendor
Risk caused only by natural disasters

Correct answer: Risk that remains after security controls have been applied

Residual risk is what is left over after mitigation and must be formally accepted by management.

Question 47: In which type of penetration test does the tester start with no prior knowledge of the target environment?

White box
Gray box
Crystal box
Black box (Correct answer)

Correct answer: Black box

A black box test mimics an outside attacker who has no internal information.

Question 48: What is the primary advantage of using blockchain for IoT data integrity?

Tamper-evident, decentralized record of device transactions (Correct answer)
Faster data transmission speed
Simplified device provisioning
Lower power consumption on sensors

Correct answer: Tamper-evident, decentralized record of device transactions

Blockchain creates an immutable, distributed ledger of IoT transactions, making it extremely difficult to alter historical sensor records without detection.

Question 49: An organization performs a full backup on Sunday and incremental backups every other night. If a failure occurs Thursday, which backups are needed to restore?

Sunday's full and every incremental from Monday through Wednesday (Correct answer)
Sunday's full and Wednesday's incremental only
Only Wednesday's incremental
Only Sunday's full backup

Correct answer: Sunday's full and every incremental from Monday through Wednesday

Each incremental captures only changes since the previous backup, so the full backup plus every incremental in sequence are required.

Question 50: A company decides to stop offering a legacy online service because its security risks outweigh its revenue. Which risk response is this?

Risk transference
Risk avoidance (Correct answer)
Risk acceptance
Risk mitigation

Correct answer: Risk avoidance

Eliminating the activity that creates the risk is risk avoidance.

Question 51: Which NIST publication provides guidance on contingency planning for federal information systems?

NIST SP 800-63
NIST SP 800-34 (Correct answer)
NIST SP 800-53
NIST SP 800-61

Correct answer: NIST SP 800-34

NIST SP 800-34 is the Contingency Planning Guide for Federal Information Systems.

Question 52: What cybersecurity framework specifically addresses IoT device security requirements in the US?

SOC 2
PCI DSS
NIST IR 8259 (Correct answer)
ISO 27001

Correct answer: NIST IR 8259

NIST IR 8259 provides a baseline of cybersecurity activities for IoT device manufacturers to improve the security of their products sold in the US market.

Question 53: What is a Virtual Private Cloud (VPC)?

A VPN client installed on user laptops
A private cloud hosted on-premises
A physically separate data center rented by one customer
A logically isolated network section within a public cloud (Correct answer)

Correct answer: A logically isolated network section within a public cloud

A VPC is a logically isolated virtual network that the customer defines within a provider's cloud.

Question 54: Which best describes the scope of System Administration & Configuration in professional practice?

An outdated concept no longer relevant to modern practice
A comprehensive area covering both theoretical foundations and practical applications (Correct answer)
A theoretical framework with no practical applications
A narrow topic relevant only to entry-level professionals

Correct answer: A comprehensive area covering both theoretical foundations and practical applications

System Administration & Configuration encompasses both theoretical foundations and practical applications that are essential to professional practice in this field.

Question 55: Which Zero Trust principle best reflects how access should be handled?

Authenticate once per day at VPN login
Rely primarily on perimeter firewalls
Trust all devices on the internal network
Verify explicitly on every access request regardless of location (Correct answer)

Correct answer: Verify explicitly on every access request regardless of location

Zero Trust assumes no implicit trust and continuously verifies identity, device, and context for every request.

Question 56: What is the relationship between Database Management & Security and ethical professional conduct?

Ethical considerations are integrated into all aspects of professional practice in this area (Correct answer)
Ethics applies only to separate, unrelated decisions
There is no connection between technical knowledge and ethics
Ethics is relevant only when legal issues arise

Correct answer: Ethical considerations are integrated into all aspects of professional practice in this area

Ethical considerations are deeply integrated into Database Management & Security, as professional conduct and integrity underpin all aspects of practice in this field.

Question 57: What is the primary purpose of industry regulations in this field?

To create barriers to entry for new professionals
To generate revenue for regulatory bodies
To protect the public and ensure consistent professional standards (Correct answer)
To limit competition in the marketplace

Correct answer: To protect the public and ensure consistent professional standards

Industry regulations are primarily designed to protect the public by ensuring professionals meet consistent standards of competence and conduct.

Question 58: A security architect wants to ensure that every access request is authenticated and authorized regardless of whether it originates inside or outside the corporate network. Which model best describes this approach?

Implicit trust zones
Defense in depth
Zero Trust (Correct answer)
Castle-and-moat

Correct answer: Zero Trust

Zero Trust assumes no implicit trust based on network location and verifies every request.

Question 59: Which attack sends forged ARP replies to associate the attacker's MAC address with the default gateway's IP address?

DNS amplification
ARP poisoning (Correct answer)
MAC flooding
SYN flood

Correct answer: ARP poisoning

ARP poisoning redirects traffic through the attacker, enabling on-path interception.

Question 60: Which term describes the overall amount of risk an organization is willing to pursue or retain to achieve its objectives?

Risk threshold
Risk appetite (Correct answer)
Risk register
Risk exposure

Correct answer: Risk appetite

Risk appetite is the broad, strategic level of risk leadership is willing to accept in pursuit of goals.

Question 61: What is the term for the risk that remains after security controls have been applied?

Control risk
Residual risk (Correct answer)
Risk appetite
Inherent risk

Correct answer: Residual risk

Residual risk is the level of risk left over once countermeasures are in place.

Question 62: Under a BYOD policy, which control lets the organization remotely wipe corporate data from an employee's personal phone without erasing personal photos?

Geofencing alone
Full-disk encryption
Mobile device management with containerization (Correct answer)
Screen lock timeout

Correct answer: Mobile device management with containerization

MDM/MAM containerization separates corporate data so it can be selectively wiped.

Question 63: Which standard specifies requirements for an Information Security Management System (ISMS) that organizations can be certified against?

NIST SP 800-53
ISO 9001
ISO/IEC 27002
ISO/IEC 27001 (Correct answer)

Correct answer: ISO/IEC 27001

ISO/IEC 27001 defines certifiable ISMS requirements, while 27002 provides control guidance.

Question 64: In continuity planning, MTD is commonly expressed as the sum of which two values?

RTO + work recovery time (WRT) (Correct answer)
RPO + RTO
RPO + work recovery time (WRT)
MTBF + MTTR

Correct answer: RTO + work recovery time (WRT)

MTD equals the time to restore systems (RTO) plus the time to verify data and resume business processes (WRT).

Question 65: In the context of BYOD policies, what does BYOD stand for?

Bind Your Own Domain
Bring Your Own Device (Correct answer)
Build Your Own Device
Back Your Own Data

Correct answer: Bring Your Own Device

BYOD (Bring Your Own Device) is a policy allowing employees to use personal devices for work purposes, requiring MDM solutions to balance productivity and security.

Question 66: Which IPsec protocol provides both confidentiality through encryption and integrity of the payload?

Authentication Header (AH)
Internet Key Exchange (IKE)
Encapsulating Security Payload (ESP) (Correct answer)
Generic Routing Encapsulation (GRE)

Correct answer: Encapsulating Security Payload (ESP)

ESP encrypts and authenticates the payload, while AH provides integrity without encryption.

Question 67: A web form collects a user's birth date, home address, and mother's maiden name just to subscribe to a newsletter. Which privacy principle is being violated?

Right to rectification
Non-repudiation
Data minimization (Correct answer)
Data portability

Correct answer: Data minimization

Data minimization requires collecting only the personal data necessary for the stated purpose.

Question 68: Which DNS security extension uses digital signatures to verify that DNS responses have not been tampered with?

Dynamic DNS
Split-horizon DNS
DNS over HTTPS
DNSSEC (Correct answer)

Correct answer: DNSSEC

DNSSEC signs DNS records so resolvers can validate their authenticity and integrity.

Question 69: What does a digital twin represent in IoT?

A backup cloud server
A virtual replica of a physical device or system for simulation (Correct answer)
An encrypted copy of device firmware
A secondary IoT sensor for redundancy

Correct answer: A virtual replica of a physical device or system for simulation

A digital twin is a virtual model that mirrors a physical asset in real time, enabling simulation, monitoring, and predictive maintenance.

Question 70: Which of the following is an open-source vulnerability scanner that came from the Nessus codebase?

Burp Suite
Qualys
OpenVAS (Correct answer)
Nexpose

Correct answer: OpenVAS

OpenVAS (now part of Greenbone) started as a fork of Nessus after Nessus became closed-source.

Question 71: What does 'shift-left' mean in a DevSecOps context?

Migrating servers to the left data center rack
Moving security testing earlier in the development lifecycle (Correct answer)
Deploying to staging before production
Shifting developer responsibilities to operations

Correct answer: Moving security testing earlier in the development lifecycle

Shift-left means integrating security checks into early development stages rather than waiting until after deployment.

Question 72: What does the 3-2-1 backup rule recommend?

3 backup administrators, 2 approvals, 1 restore test
3 full backups per week, 2 incrementals, 1 differential
3 days retention, 2 weeks archive, 1 year offline
3 copies of data, on 2 different media types, with 1 copy offsite (Correct answer)

Correct answer: 3 copies of data, on 2 different media types, with 1 copy offsite

The 3-2-1 rule calls for three copies of data on two different media with at least one stored offsite.

Question 73: What is the purpose of Certificate Transparency logs?

To speed up TLS handshakes
To store users' private keys securely
To revoke expired certificates automatically
To publicly record issued certificates so misissued ones can be detected (Correct answer)

Correct answer: To publicly record issued certificates so misissued ones can be detected

CT logs are append-only public records that let domain owners spot certificates issued without their approval.

Question 74: Which governance document is mandatory, approved by senior management, and states high-level security intent without specifying technical details?

Guideline
Standard
Procedure
Policy (Correct answer)

Correct answer: Policy

A policy expresses management's high-level intent and direction, while standards, procedures, and guidelines implement it.

Question 75: What is a DMZ (Demilitarized Zone) in network architecture?

A network segment between internal and external networks that hosts public-facing services (Correct answer)
A backup data center in a remote location
A meeting room for discussing network security
A restricted area where damaged equipment is stored

Correct answer: A network segment between internal and external networks that hosts public-facing services

A DMZ is a network segment that sits between the internal network and external networks, hosting public-facing services while protecting the internal network from direct exposure.

Question 76: Why are Kerberos-based environments sensitive to clock differences between hosts?

Clock drift corrupts the password hash
Tickets are encrypted with the system time as the key
Timestamps are used to prevent replay attacks (Correct answer)
Kerberos uses NTP for key exchange

Correct answer: Timestamps are used to prevent replay attacks

Kerberos relies on timestamps in authenticators, so excessive clock skew (default 5 minutes) causes authentication to fail.

Question 77: Which protocol does Matter (formerly Project CHIP) use as its underlying IP transport for smart home devices?

Bluetooth Low Energy only
Zigbee only
Z-Wave only
Thread (IPv6 mesh) (Correct answer)

Correct answer: Thread (IPv6 mesh)

Matter uses Thread as its primary IP-based mesh networking protocol, running over IPv6 to provide reliable, low-power smart home device communication.

Question 78: Which practice prevents a single employee from both creating a new vendor in the payment system and approving payments to that vendor?

Least privilege
Mandatory vacation
Separation of duties (Correct answer)
Job rotation

Correct answer: Separation of duties

Separation of duties splits critical tasks among different people to prevent fraud by one individual.

Question 79: In a SYN flood attack, what resource on the target server is primarily exhausted?

DNS cache entries
Disk storage
The half-open connection backlog queue (Correct answer)
ARP table entries

Correct answer: The half-open connection backlog queue

SYN floods fill the queue of half-open TCP connections, blocking legitimate sessions.

Question 80: Which communication protocol is most commonly used for lightweight IoT messaging?

FTP
SMTP
MQTT (Correct answer)
HTTP/1.1

Correct answer: MQTT

MQTT is a lightweight publish-subscribe protocol designed for constrained devices and low-bandwidth, high-latency IoT networks.

Question 81: What is the primary purpose of an Acceptable Use Policy (AUP)?

Document the steps for restoring backups
Specify the encryption algorithms used on servers
Define how employees may and may not use organizational IT resources (Correct answer)
List the firewall rules for the network perimeter

Correct answer: Define how employees may and may not use organizational IT resources

An AUP sets rules for appropriate use of company systems, networks, and data by users.

Question 82: Which command shows the most recent log entries for a specific systemd service?

tail /var/log/sshd.conf
dmesg -u sshd
systemctl logs sshd
journalctl -u sshd (Correct answer)

Correct answer: journalctl -u sshd

journalctl -u filters the systemd journal by unit name.

Question 83: What is the consequence of non-compliance with mandatory regulations?

Automatic extension of compliance deadline
A verbal warning with no further consequences
Reduced insurance premiums
Penalties including fines, license revocation, and potential legal action (Correct answer)

Correct answer: Penalties including fines, license revocation, and potential legal action

Non-compliance with mandatory regulations can result in serious consequences including financial penalties, loss of licensure, and legal proceedings.

Question 84: Which practice involves automatically rolling back a deployment when error rates exceed a threshold?

Canary release
Feature flagging
Blue-green deployment
Automated rollback (Correct answer)

Correct answer: Automated rollback

Automated rollback uses monitoring thresholds to detect failures and revert to the previous stable version without manual intervention.

Question 85: Granting administrator rights only for a limited time window when needed, then automatically revoking them, is known as what?

Just-in-time access (Correct answer)
Single sign-on
Role mining
Federated identity

Correct answer: Just-in-time access

Just-in-time (JIT) access eliminates standing privileges by elevating access only when and as long as needed.

Question 86: An organization performs a full backup on Sunday and differential backups every other night. If a failure occurs Thursday, which backups are needed to restore?

Sunday's full and Wednesday's differential (Correct answer)
Sunday's full and every differential since Sunday
Only Sunday's full backup
Only Wednesday's differential

Correct answer: Sunday's full and Wednesday's differential

Each differential contains all changes since the last full backup, so only the full and the most recent differential are needed.

Question 87: Which type of firewall tracks the state of active connections and allows return traffic automatically?

Stateful inspection firewall (Correct answer)
Circuit-level proxy only
Static ACL router
Stateless packet filter

Correct answer: Stateful inspection firewall

Stateful firewalls maintain a connection table and permit responses to established sessions.

Question 88: An attacker uses username/password pairs leaked from one website to log into accounts on other sites. What is this attack?

Password spraying
Credential stuffing (Correct answer)
Pass-the-hash
Rainbow table attack

Correct answer: Credential stuffing

Credential stuffing exploits password reuse by replaying breached credentials across services.

Question 89: Which U.S. law protects the privacy of student education records?

HIPAA
COPPA
FERPA (Correct answer)
GLBA

Correct answer: FERPA

FERPA governs access to and disclosure of student education records at schools receiving federal funding.

Question 90: What does MDM stand for in enterprise mobility management?

Mobile Data Management
Multi-Device Monitoring
Mobile Device Management (Correct answer)
Managed Desktop Module

Correct answer: Mobile Device Management

MDM (Mobile Device Management) is the solution IT departments use to monitor, manage, and enforce security policies on employees' mobile devices.

CompTIA Security+ (SY0-701)

CompTIA Security+ is a globally recognized entry-level cybersecurity certification that validates foundational skills in network security, risk management, access control, cryptography, and security operations. It covers five core domains including threats & vulnerabilities, security architecture, security operations, and security program management.

Questions

90 min

Time Limit

83%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. We have not yet matched this exam's facts to an official source, so confirm fees, dates and rules with the exam body. Not reviewed by a subject-matter expert. Editorial policy