CompTIA Security+ (SY0-701) — Questions and Answers

Question 1: What does 'shift-left' mean in a DevSecOps context?

Moving security testing earlier in the development lifecycle (Correct answer)
Migrating servers to the left data center rack
Shifting developer responsibilities to operations
Deploying to staging before production

Correct answer: Moving security testing earlier in the development lifecycle

Shift-left means integrating security checks into early development stages rather than waiting until after deployment.

Question 2: What distinguishes inherent risk from residual risk?

Inherent risk exists before controls; residual risk remains after controls are applied (Correct answer)
Inherent risk is internal; residual risk is external
Inherent risk is financial; residual risk is operational
There is no meaningful difference between them

Correct answer: Inherent risk exists before controls; residual risk remains after controls are applied

Inherent risk is the level of risk present before any controls are implemented, while residual risk is the level that remains after controls and mitigations are applied.

Question 3: Which wireless technology uses adaptive frequency-hopping spread spectrum (AFHS) across 79 channels to minimize interference?

Bluetooth Classic (Correct answer)
Wi-Fi 802.11n
LTE-U
Zigbee

Correct answer: Bluetooth Classic

Bluetooth Classic uses adaptive frequency-hopping spread spectrum, hopping 1,600 times per second across 79 channels in the 2.4 GHz band to avoid persistent interference.

Question 4: What common challenge do professionals face when applying Threat Detection & Incident Response principles?

Obtaining permission to use the principles
The principles are too simple to present any challenge
Balancing theoretical best practices with practical constraints and real-world conditions (Correct answer)
Finding the relevant textbook chapter

Correct answer: Balancing theoretical best practices with practical constraints and real-world conditions

Professionals commonly face the challenge of adapting theoretical best practices in Threat Detection & Incident Response to the practical constraints and varying conditions encountered in real-world settings.

Question 5: Which tool is most commonly used for container orchestration in a DevOps environment?

Terraform
Ansible
Jenkins
Kubernetes (Correct answer)

Correct answer: Kubernetes

Kubernetes is the industry-standard platform for automating deployment, scaling, and management of containerized applications.

Question 6: What is network segmentation and why is it important?

Upgrading all network cables simultaneously
Increasing the number of network devices
Removing old network equipment
Dividing a network into smaller segments to contain breaches and control access (Correct answer)

Correct answer: Dividing a network into smaller segments to contain breaches and control access

Network segmentation divides a network into isolated segments, limiting the spread of security breaches and providing granular access control.

Question 7: What is the primary security risk of using unsegmented flat networks for IoT devices?

Compromised IoT devices can laterally move to attack critical corporate systems (Correct answer)
Higher electricity costs for IoT sensors
Increased latency for cloud API calls
Slower Wi-Fi speeds for laptops

Correct answer: Compromised IoT devices can laterally move to attack critical corporate systems

Without network segmentation, a compromised IoT device has unrestricted access to the same network as servers and workstations, enabling lateral movement attacks.

Question 8: Which version control workflow uses short-lived feature branches merged frequently into main?

Gitflow
Trunk-based development (Correct answer)
Release branching
Forking workflow

Correct answer: Trunk-based development

Trunk-based development keeps branches small and short-lived, merging to a single main branch frequently to reduce integration conflicts.

Question 9: What does LTE stand for in mobile broadband communications?

Long Term Evolution (Correct answer)
Linked Transfer Endpoint
Linear Transmission Encoding
Low Transmission Efficiency

Correct answer: Long Term Evolution

LTE (Long Term Evolution) is the 4G wireless broadband standard for mobile devices, evolving from 3G UMTS/HSPA technology.

Question 10: What is the primary purpose of the Remote Wipe feature in mobile device management?

Update device firmware over-the-air
Erase all data on a lost or stolen device (Correct answer)
Reboot an unresponsive device remotely
Back up device data to the corporate cloud

Correct answer: Erase all data on a lost or stolen device

Remote Wipe allows IT administrators or device owners to erase all data on a mobile device that is lost, stolen, or no longer authorized, protecting sensitive information.

Question 11: How often should compliance procedures be reviewed and updated?

Once at initial certification and never again
Only when an audit is scheduled
Every ten years regardless of changes
Regularly, and whenever regulations change or new risks are identified (Correct answer)

Correct answer: Regularly, and whenever regulations change or new risks are identified

Compliance procedures should be reviewed regularly and updated whenever regulations change, new risks emerge, or organizational changes occur.

Question 12: Which generation of cellular networks first introduced mobile broadband Internet access for smartphones?

3G (UMTS/HSPA) (Correct answer)
4G (LTE)
2G (GSM)
5G (NR)

Correct answer: 3G (UMTS/HSPA)

3G networks introduced mobile broadband, enabling smartphones to access the internet with speeds suitable for web browsing, email, and streaming.

Question 13: Which wireless technology is designed for long-range, low-power IoT communication?

NFC
LoRaWAN (Correct answer)
Wi-Fi 6
Bluetooth Classic

Correct answer: LoRaWAN

LoRaWAN (Long Range Wide Area Network) is designed for IoT devices that need to transmit small amounts of data over several kilometers while running on battery for years.

Question 14: What common challenge do professionals face when applying Access Control & Identity Management principles?

The principles are too simple to present any challenge
Finding the relevant textbook chapter
Balancing theoretical best practices with practical constraints and real-world conditions (Correct answer)
Obtaining permission to use the principles

Correct answer: Balancing theoretical best practices with practical constraints and real-world conditions

Professionals commonly face the challenge of adapting theoretical best practices in Access Control & Identity Management to the practical constraints and varying conditions encountered in real-world settings.

Question 15: What is the purpose of intrusion detection systems (IDS)?

To speed up network performance
To prevent all unauthorized access automatically
To manage network IP addresses
To monitor network traffic for suspicious activity and known threats (Correct answer)

Correct answer: To monitor network traffic for suspicious activity and known threats

IDS monitors network traffic for suspicious activity, known attack patterns, and policy violations, alerting administrators to potential security threats.

Question 16: Which best describes the scope of Application Security & Development in professional practice?

An outdated concept no longer relevant to modern practice
A narrow topic relevant only to entry-level professionals
A theoretical framework with no practical applications
A comprehensive area covering both theoretical foundations and practical applications (Correct answer)

Correct answer: A comprehensive area covering both theoretical foundations and practical applications

Application Security & Development encompasses both theoretical foundations and practical applications that are essential to professional practice in this field.

Question 17: Which practice involves automatically rolling back a deployment when error rates exceed a threshold?

Automated rollback (Correct answer)
Blue-green deployment
Canary release
Feature flagging

Correct answer: Automated rollback

Automated rollback uses monitoring thresholds to detect failures and revert to the previous stable version without manual intervention.

Question 18: What is the most important competency assessed in Vulnerability Assessment & Penetration Testing for professionals in this field?

Academic credentials without practical application
Memorization of textbook definitions only
Applied knowledge and practical problem-solving ability (Correct answer)
Years of experience without demonstrated skill

Correct answer: Applied knowledge and practical problem-solving ability

Vulnerability Assessment & Penetration Testing assessment focuses on applied knowledge and practical problem-solving ability, ensuring professionals can effectively perform in real-world situations.

Question 19: What is the recommended approach to staying current in Application Security & Development?

Waiting for regulatory changes to force updates
Regular professional development, industry publications, and peer collaboration (Correct answer)
Reviewing initial training materials once per year
Relying solely on past experience

Correct answer: Regular professional development, industry publications, and peer collaboration

Staying current in Application Security & Development requires ongoing professional development, reading industry publications, and collaborating with peers to share knowledge and best practices.

Question 20: What is the relationship between Database Management & Security and ethical professional conduct?

Ethical considerations are integrated into all aspects of professional practice in this area (Correct answer)
There is no connection between technical knowledge and ethics
Ethics applies only to separate, unrelated decisions
Ethics is relevant only when legal issues arise

Correct answer: Ethical considerations are integrated into all aspects of professional practice in this area

Ethical considerations are deeply integrated into Database Management & Security, as professional conduct and integrity underpin all aspects of practice in this field.

Question 21: Which best describes the scope of Threat Detection & Incident Response in professional practice?

A narrow topic relevant only to entry-level professionals
A theoretical framework with no practical applications
A comprehensive area covering both theoretical foundations and practical applications (Correct answer)
An outdated concept no longer relevant to modern practice

Correct answer: A comprehensive area covering both theoretical foundations and practical applications

Threat Detection & Incident Response encompasses both theoretical foundations and practical applications that are essential to professional practice in this field.

Question 22: What does MDM stand for in enterprise mobility management?

Mobile Device Management (Correct answer)
Managed Desktop Module
Multi-Device Monitoring
Mobile Data Management

Correct answer: Mobile Device Management

MDM (Mobile Device Management) is the solution IT departments use to monitor, manage, and enforce security policies on employees' mobile devices.

Question 23: What common challenge do professionals face when applying System Administration & Configuration principles?

Finding the relevant textbook chapter
The principles are too simple to present any challenge
Obtaining permission to use the principles
Balancing theoretical best practices with practical constraints and real-world conditions (Correct answer)

Correct answer: Balancing theoretical best practices with practical constraints and real-world conditions

Professionals commonly face the challenge of adapting theoretical best practices in System Administration & Configuration to the practical constraints and varying conditions encountered in real-world settings.

Question 24: Which best describes the scope of Access Control & Identity Management in professional practice?

A narrow topic relevant only to entry-level professionals
A comprehensive area covering both theoretical foundations and practical applications (Correct answer)
A theoretical framework with no practical applications
An outdated concept no longer relevant to modern practice

Correct answer: A comprehensive area covering both theoretical foundations and practical applications

Access Control & Identity Management encompasses both theoretical foundations and practical applications that are essential to professional practice in this field.

Question 25: How does Vulnerability Assessment & Penetration Testing contribute to overall professional effectiveness?

It applies only to supervisory-level professionals
It provides essential knowledge and skills that directly impact quality of work and outcomes (Correct answer)
It serves only as a credential requirement with no practical impact
It is relevant only during the certification examination

Correct answer: It provides essential knowledge and skills that directly impact quality of work and outcomes

Vulnerability Assessment & Penetration Testing directly contributes to professional effectiveness by providing essential knowledge and skills that improve the quality of work and outcomes across all career levels.

Question 26: What is a DMZ (Demilitarized Zone) in network architecture?

A network segment between internal and external networks that hosts public-facing services (Correct answer)
A backup data center in a remote location
A meeting room for discussing network security
A restricted area where damaged equipment is stored

Correct answer: A network segment between internal and external networks that hosts public-facing services

A DMZ is a network segment that sits between the internal network and external networks, hosting public-facing services while protecting the internal network from direct exposure.

Question 27: How does System Administration & Configuration contribute to overall professional effectiveness?

It serves only as a credential requirement with no practical impact
It is relevant only during the certification examination
It provides essential knowledge and skills that directly impact quality of work and outcomes (Correct answer)
It applies only to supervisory-level professionals

Correct answer: It provides essential knowledge and skills that directly impact quality of work and outcomes

System Administration & Configuration directly contributes to professional effectiveness by providing essential knowledge and skills that improve the quality of work and outcomes across all career levels.

Question 28: What is the recommended approach to staying current in Vulnerability Assessment & Penetration Testing?

Waiting for regulatory changes to force updates
Relying solely on past experience
Regular professional development, industry publications, and peer collaboration (Correct answer)
Reviewing initial training materials once per year

Correct answer: Regular professional development, industry publications, and peer collaboration

Staying current in Vulnerability Assessment & Penetration Testing requires ongoing professional development, reading industry publications, and collaborating with peers to share knowledge and best practices.

Question 29: What frequency band does Bluetooth Low Energy (BLE) operate on?

900 MHz
5 GHz
60 GHz
2.4 GHz (Correct answer)

Correct answer: 2.4 GHz

BLE operates in the 2.4 GHz ISM band using 40 channels of 2 MHz each, sharing the band with classic Bluetooth and Wi-Fi.

Question 30: Which risk response strategy involves reducing the likelihood or impact of a risk?

Risk mitigation (Correct answer)
Risk transfer
Risk escalation
Risk acceptance

Correct answer: Risk mitigation

Risk mitigation involves taking proactive steps to reduce either the probability of a risk occurring or its potential impact if it does occur.

Question 31: What is the primary benefit of using immutable infrastructure?

Reduced need for version control
Servers are never modified after deployment, improving consistency (Correct answer)
Faster developer onboarding
Lower cloud costs

Correct answer: Servers are never modified after deployment, improving consistency

Immutable infrastructure replaces servers rather than patching them in place, eliminating configuration drift and ensuring consistent, reproducible environments.

Question 32: What does a risk matrix assess?

The number of employees affected
The probability and impact of identified risks (Correct answer)
Only the financial cost of risks
The timeline for risk resolution

Correct answer: The probability and impact of identified risks

A risk matrix evaluates risks based on two dimensions: the probability (likelihood) of occurrence and the potential impact (severity) if the risk materializes.

Question 33: What is the relationship between Cryptography & Data Protection and ethical professional conduct?

Ethical considerations are integrated into all aspects of professional practice in this area (Correct answer)
Ethics applies only to separate, unrelated decisions
There is no connection between technical knowledge and ethics
Ethics is relevant only when legal issues arise

Correct answer: Ethical considerations are integrated into all aspects of professional practice in this area

Ethical considerations are deeply integrated into Cryptography & Data Protection, as professional conduct and integrity underpin all aspects of practice in this field.

Question 34: What common challenge do professionals face when applying Vulnerability Assessment & Penetration Testing principles?

The principles are too simple to present any challenge
Obtaining permission to use the principles
Balancing theoretical best practices with practical constraints and real-world conditions (Correct answer)
Finding the relevant textbook chapter

Correct answer: Balancing theoretical best practices with practical constraints and real-world conditions

Professionals commonly face the challenge of adapting theoretical best practices in Vulnerability Assessment & Penetration Testing to the practical constraints and varying conditions encountered in real-world settings.

Question 35: What is the recommended approach to staying current in Access Control & Identity Management?

Waiting for regulatory changes to force updates
Relying solely on past experience
Regular professional development, industry publications, and peer collaboration (Correct answer)
Reviewing initial training materials once per year

Correct answer: Regular professional development, industry publications, and peer collaboration

Staying current in Access Control & Identity Management requires ongoing professional development, reading industry publications, and collaborating with peers to share knowledge and best practices.

Question 36: Which security concern is most prevalent in IoT deployments?

High CPU utilization
Too many software updates
Excessive RAM usage
Use of default or hardcoded credentials (Correct answer)

Correct answer: Use of default or hardcoded credentials

Many IoT devices ship with default usernames and passwords that users never change, making them easy targets for botnet attacks like Mirai.

Question 37: What is the primary function of a firewall in network security?

To store network data backups
To increase network speed
To monitor and control incoming and outgoing network traffic based on security rules (Correct answer)
To manage email distribution

Correct answer: To monitor and control incoming and outgoing network traffic based on security rules

A firewall monitors and controls network traffic based on predetermined security rules, acting as a barrier between trusted and untrusted networks.

Question 38: Which AI technique enables IoT devices to collaboratively train a model without sharing raw data?

Reinforcement learning
Transfer learning
Federated learning (Correct answer)
Supervised batch learning

Correct answer: Federated learning

Federated learning trains a shared model across distributed devices by exchanging model updates rather than raw data, preserving privacy on each device.

Question 39: What is the primary function of a Wireless LAN Controller (WLC) in an enterprise network?

Authenticate users against Active Directory directly
Encrypt all wireless traffic end-to-end
Assign DHCP addresses to wireless clients
Centrally manage and configure multiple access points (Correct answer)

Correct answer: Centrally manage and configure multiple access points

A WLC centralizes management of lightweight access points, handling configuration, firmware updates, roaming, and policy enforcement across the enterprise wireless infrastructure.

Question 40: What is the primary purpose of a CI/CD pipeline in software development?

To manually review code before release
To automate building, testing, and deploying code changes (Correct answer)
To monitor production server uptime
To store source code in version control

Correct answer: To automate building, testing, and deploying code changes

A CI/CD pipeline automates the steps of integrating, testing, and deploying code so teams can release software faster and more reliably.

Question 41: What is quantum key distribution (QKD) used for?

Securely exchanging encryption keys using quantum mechanics principles (Correct answer)
Generating random numbers for IoT sensors
Distributing quantum computers globally
Speeding up RSA key generation

Correct answer: Securely exchanging encryption keys using quantum mechanics principles

QKD uses quantum physics properties to exchange cryptographic keys in a way that detects any eavesdropping attempt, providing theoretically unbreakable key exchange.

Question 42: What is the most important competency assessed in Operating Systems & Platforms for professionals in this field?

Years of experience without demonstrated skill
Memorization of textbook definitions only
Applied knowledge and practical problem-solving ability (Correct answer)
Academic credentials without practical application

Correct answer: Applied knowledge and practical problem-solving ability

Operating Systems & Platforms assessment focuses on applied knowledge and practical problem-solving ability, ensuring professionals can effectively perform in real-world situations.

Question 43: In infrastructure as code (IaC), what does Terraform primarily manage?

CI/CD pipeline stages
Container images
Cloud and on-premises infrastructure resources (Correct answer)
Application source code versions

Correct answer: Cloud and on-premises infrastructure resources

Terraform uses declarative configuration files to provision and manage infrastructure across multiple cloud providers.

Question 44: Which best describes the scope of Vulnerability Assessment & Penetration Testing in professional practice?

A comprehensive area covering both theoretical foundations and practical applications (Correct answer)
An outdated concept no longer relevant to modern practice
A narrow topic relevant only to entry-level professionals
A theoretical framework with no practical applications

Correct answer: A comprehensive area covering both theoretical foundations and practical applications

Vulnerability Assessment & Penetration Testing encompasses both theoretical foundations and practical applications that are essential to professional practice in this field.

Question 45: What is the role of a TPM (Trusted Platform Module) chip in IoT security?

Boosting CPU performance
Compressing sensor data before transmission
Securely storing cryptographic keys and device identity credentials in hardware (Correct answer)
Managing wireless radio frequencies

Correct answer: Securely storing cryptographic keys and device identity credentials in hardware

A TPM provides hardware-based storage for cryptographic keys, certificates, and measurements, enabling secure boot and device attestation.

Question 46: In Docker, what is the function of a Dockerfile?

Orchestrating multi-container deployments
Storing runtime container logs
Defining the instructions to build a container image (Correct answer)
Configuring network policies between containers

Correct answer: Defining the instructions to build a container image

A Dockerfile contains a series of instructions that Docker executes in order to build a repeatable, layered container image.

Question 47: What cybersecurity framework specifically addresses IoT device security requirements in the US?

PCI DSS
ISO 27001
SOC 2
NIST IR 8259 (Correct answer)

Correct answer: NIST IR 8259

NIST IR 8259 provides a baseline of cybersecurity activities for IoT device manufacturers to improve the security of their products sold in the US market.

Question 48: What does a digital twin represent in IoT?

A virtual replica of a physical device or system for simulation (Correct answer)
A backup cloud server
An encrypted copy of device firmware
A secondary IoT sensor for redundancy

Correct answer: A virtual replica of a physical device or system for simulation

A digital twin is a virtual model that mirrors a physical asset in real time, enabling simulation, monitoring, and predictive maintenance.

Question 49: How does Threat Detection & Incident Response contribute to overall professional effectiveness?

It applies only to supervisory-level professionals
It serves only as a credential requirement with no practical impact
It is relevant only during the certification examination
It provides essential knowledge and skills that directly impact quality of work and outcomes (Correct answer)

Correct answer: It provides essential knowledge and skills that directly impact quality of work and outcomes

Threat Detection & Incident Response directly contributes to professional effectiveness by providing essential knowledge and skills that improve the quality of work and outcomes across all career levels.

Question 50: What is the relationship between Access Control & Identity Management and ethical professional conduct?

Ethical considerations are integrated into all aspects of professional practice in this area (Correct answer)
Ethics is relevant only when legal issues arise
Ethics applies only to separate, unrelated decisions
There is no connection between technical knowledge and ethics

Correct answer: Ethical considerations are integrated into all aspects of professional practice in this area

Ethical considerations are deeply integrated into Access Control & Identity Management, as professional conduct and integrity underpin all aspects of practice in this field.

Question 51: What is the recommended approach to staying current in Cloud Computing & Virtualization?

Relying solely on past experience
Waiting for regulatory changes to force updates
Regular professional development, industry publications, and peer collaboration (Correct answer)
Reviewing initial training materials once per year

Correct answer: Regular professional development, industry publications, and peer collaboration

Staying current in Cloud Computing & Virtualization requires ongoing professional development, reading industry publications, and collaborating with peers to share knowledge and best practices.

Question 52: In a microservices architecture, what tool category handles service discovery and load balancing?

Log aggregator
Secret manager
Service mesh (Correct answer)
Object-relational mapper

Correct answer: Service mesh

A service mesh like Istio or Linkerd handles service-to-service communication, load balancing, and observability within a microservices environment.

Question 53: Which communication protocol is most commonly used for lightweight IoT messaging?

FTP
MQTT (Correct answer)
HTTP/1.1
SMTP

Correct answer: MQTT

MQTT is a lightweight publish-subscribe protocol designed for constrained devices and low-bandwidth, high-latency IoT networks.

Question 54: What does a VPN provide in terms of network security?

Encrypted communication tunnels over public networks (Correct answer)
Free internet access worldwide
Faster internet connection speeds
Automatic virus removal

Correct answer: Encrypted communication tunnels over public networks

A VPN (Virtual Private Network) creates encrypted communication tunnels over public networks, protecting data confidentiality during transmission.

Question 55: Which best describes the scope of Cloud Computing & Virtualization in professional practice?

A theoretical framework with no practical applications
An outdated concept no longer relevant to modern practice
A narrow topic relevant only to entry-level professionals
A comprehensive area covering both theoretical foundations and practical applications (Correct answer)

Correct answer: A comprehensive area covering both theoretical foundations and practical applications

Cloud Computing & Virtualization encompasses both theoretical foundations and practical applications that are essential to professional practice in this field.

Question 56: Why is regular risk reassessment important?

Because it provides work for risk management teams
Because initial assessments are always wrong
Because regulators require it exactly once per year
Because the risk landscape changes as conditions, activities, and environments evolve (Correct answer)

Correct answer: Because the risk landscape changes as conditions, activities, and environments evolve

Regular risk reassessment is essential because risks are dynamic — new threats emerge, existing risks change in severity, and the effectiveness of controls may vary over time.

Question 57: What is the principle of least privilege in network security?

New users should receive the same access as their managers
Access permissions should be updated annually
Users should have only the minimum access needed to perform their job functions (Correct answer)
All users should have administrator access for convenience

Correct answer: Users should have only the minimum access needed to perform their job functions

The principle of least privilege restricts user access to only the resources and permissions necessary for their specific job functions, minimizing potential damage from compromised accounts.

Question 58: What is the relationship between System Administration & Configuration and ethical professional conduct?

Ethics applies only to separate, unrelated decisions
There is no connection between technical knowledge and ethics
Ethical considerations are integrated into all aspects of professional practice in this area (Correct answer)
Ethics is relevant only when legal issues arise

Correct answer: Ethical considerations are integrated into all aspects of professional practice in this area

Ethical considerations are deeply integrated into System Administration & Configuration, as professional conduct and integrity underpin all aspects of practice in this field.

Question 59: What is the most important competency assessed in Cloud Computing & Virtualization for professionals in this field?

Academic credentials without practical application
Memorization of textbook definitions only
Years of experience without demonstrated skill
Applied knowledge and practical problem-solving ability (Correct answer)

Correct answer: Applied knowledge and practical problem-solving ability

Cloud Computing & Virtualization assessment focuses on applied knowledge and practical problem-solving ability, ensuring professionals can effectively perform in real-world situations.

Question 60: What is the primary advantage of using blockchain for IoT data integrity?

Lower power consumption on sensors
Simplified device provisioning
Faster data transmission speed
Tamper-evident, decentralized record of device transactions (Correct answer)

Correct answer: Tamper-evident, decentralized record of device transactions

Blockchain creates an immutable, distributed ledger of IoT transactions, making it extremely difficult to alter historical sensor records without detection.

Question 61: What is the most important competency assessed in System Administration & Configuration for professionals in this field?

Academic credentials without practical application
Years of experience without demonstrated skill
Memorization of textbook definitions only
Applied knowledge and practical problem-solving ability (Correct answer)

Correct answer: Applied knowledge and practical problem-solving ability

System Administration & Configuration assessment focuses on applied knowledge and practical problem-solving ability, ensuring professionals can effectively perform in real-world situations.

Question 62: How does Cloud Computing & Virtualization contribute to overall professional effectiveness?

It is relevant only during the certification examination
It applies only to supervisory-level professionals
It provides essential knowledge and skills that directly impact quality of work and outcomes (Correct answer)
It serves only as a credential requirement with no practical impact

Correct answer: It provides essential knowledge and skills that directly impact quality of work and outcomes

Cloud Computing & Virtualization directly contributes to professional effectiveness by providing essential knowledge and skills that improve the quality of work and outcomes across all career levels.

Question 63: In the context of BYOD policies, what does BYOD stand for?

Bring Your Own Device (Correct answer)
Build Your Own Device
Back Your Own Data
Bind Your Own Domain

Correct answer: Bring Your Own Device

BYOD (Bring Your Own Device) is a policy allowing employees to use personal devices for work purposes, requiring MDM solutions to balance productivity and security.

Question 64: What should be the first action when a new regulation is enacted that affects your practice?

Assume existing procedures already comply
Review the regulation, assess its impact, and develop an implementation plan (Correct answer)
Wait for enforcement before making changes
Delegate review to the newest team member

Correct answer: Review the regulation, assess its impact, and develop an implementation plan

When new regulations are enacted, professionals should promptly review them, assess their impact on current practices, and develop a structured implementation plan.

Question 65: What does SSID stand for in wireless networking?

System Security ID
Secure Signal Identifier
Subnet Segment Identifier
Service Set Identifier (Correct answer)

Correct answer: Service Set Identifier

SSID (Service Set Identifier) is the human-readable name that identifies a specific wireless network to clients scanning for access points.

Question 66: What is the relationship between Operating Systems & Platforms and ethical professional conduct?

Ethics is relevant only when legal issues arise
There is no connection between technical knowledge and ethics
Ethics applies only to separate, unrelated decisions
Ethical considerations are integrated into all aspects of professional practice in this area (Correct answer)

Correct answer: Ethical considerations are integrated into all aspects of professional practice in this area

Ethical considerations are deeply integrated into Operating Systems & Platforms, as professional conduct and integrity underpin all aspects of practice in this field.

Question 67: What is the role of documentation in regulatory compliance?

It is only necessary for international operations
It serves no practical purpose beyond record-keeping
It is optional if verbal confirmation is available
It provides verifiable evidence that standards are being met (Correct answer)

Correct answer: It provides verifiable evidence that standards are being met

Documentation provides verifiable evidence that regulatory requirements are being met and creates an audit trail for compliance verification.

Question 68: How does Database Management & Security contribute to overall professional effectiveness?

It provides essential knowledge and skills that directly impact quality of work and outcomes (Correct answer)
It is relevant only during the certification examination
It serves only as a credential requirement with no practical impact
It applies only to supervisory-level professionals

Correct answer: It provides essential knowledge and skills that directly impact quality of work and outcomes

Database Management & Security directly contributes to professional effectiveness by providing essential knowledge and skills that improve the quality of work and outcomes across all career levels.

Question 69: What is the first step in the risk management process?

Risk transfer — purchasing insurance immediately
Risk avoidance — canceling all activities
Risk identification — recognizing potential threats and vulnerabilities (Correct answer)
Risk acceptance — deciding to live with all risks

Correct answer: Risk identification — recognizing potential threats and vulnerabilities

Risk identification is the critical first step in risk management, involving systematic recognition and documentation of potential threats and vulnerabilities.

Question 70: Which wireless attack involves creating a fraudulent access point with the same SSID as a legitimate network to intercept traffic?

Packet sniffing
De-authentication flood
WPS brute force
Evil Twin attack (Correct answer)

Correct answer: Evil Twin attack

An Evil Twin attack deploys a rogue access point mimicking a trusted network's SSID to perform a man-in-the-middle attack and capture victim traffic.

Question 71: What is the most important competency assessed in Database Management & Security for professionals in this field?

Academic credentials without practical application
Memorization of textbook definitions only
Applied knowledge and practical problem-solving ability (Correct answer)
Years of experience without demonstrated skill

Correct answer: Applied knowledge and practical problem-solving ability

Database Management & Security assessment focuses on applied knowledge and practical problem-solving ability, ensuring professionals can effectively perform in real-world situations.

Question 72: In IoT security, what is firmware over-the-air (FOTA) update?

Wirelessly delivering firmware updates to IoT devices remotely (Correct answer)
Updating cloud dashboards without device changes
Sending firmware files via email attachment
Physically replacing device hardware in the field

Correct answer: Wirelessly delivering firmware updates to IoT devices remotely

FOTA allows manufacturers to remotely push security patches and feature updates to deployed IoT devices without physical access.

Question 73: What does MIMO technology provide in wireless networking?

Increased throughput by using multiple antennas simultaneously (Correct answer)
End-to-end encryption of wireless data
Reduced wireless interference through frequency separation
Client authentication via digital certificates

Correct answer: Increased throughput by using multiple antennas simultaneously

MIMO (Multiple Input Multiple Output) uses multiple antennas to transmit and receive several data streams at once, significantly increasing wireless throughput.

Question 74: What is the relationship between Application Security & Development and ethical professional conduct?

Ethics is relevant only when legal issues arise
Ethical considerations are integrated into all aspects of professional practice in this area (Correct answer)
Ethics applies only to separate, unrelated decisions
There is no connection between technical knowledge and ethics

Correct answer: Ethical considerations are integrated into all aspects of professional practice in this area

Ethical considerations are deeply integrated into Application Security & Development, as professional conduct and integrity underpin all aspects of practice in this field.

Question 75: Which strategy deploys a new version to a small subset of users before a full rollout?

Canary release (Correct answer)
Blue-green deployment
Shadow deployment
Rolling deployment

Correct answer: Canary release

A canary release routes a small percentage of traffic to the new version, allowing teams to validate it in production before exposing all users.

Question 76: What does 'mean time to recovery' (MTTR) measure in DevOps?

Average number of deployments per week
Average time to review a pull request
Average time to build a container image
Average time to restore service after a failure (Correct answer)

Correct answer: Average time to restore service after a failure

MTTR measures how quickly a team can restore a system to normal operation after an incident, indicating operational resilience.

Question 77: What is the recommended approach to staying current in Cryptography & Data Protection?

Waiting for regulatory changes to force updates
Regular professional development, industry publications, and peer collaboration (Correct answer)
Reviewing initial training materials once per year
Relying solely on past experience

Correct answer: Regular professional development, industry publications, and peer collaboration

Staying current in Cryptography & Data Protection requires ongoing professional development, reading industry publications, and collaborating with peers to share knowledge and best practices.

Question 78: What is the role of an artifact repository like JFrog Artifactory or Nexus in a CI/CD pipeline?

Storing and versioning built packages and dependencies (Correct answer)
Managing cloud infrastructure state
Running automated unit tests
Monitoring application performance

Correct answer: Storing and versioning built packages and dependencies

Artifact repositories store compiled binaries, libraries, and Docker images so they can be versioned, shared, and promoted through deployment stages.

Question 79: Which machine learning deployment technique runs AI models directly on IoT devices?

Federated learning only
Batch processing
Cloud inference
TinyML / on-device inference (Correct answer)

Correct answer: TinyML / on-device inference

TinyML optimizes machine learning models to run on microcontrollers and low-power chips, enabling real-time AI inference without cloud connectivity.

Question 80: In augmented reality (AR), what is a 'spatial anchor'?

A network endpoint for AR streaming
A GPU optimization technique for AR rendering
A physical weight that stabilizes AR glasses
A persistent coordinate in the real world where AR content is attached (Correct answer)

Correct answer: A persistent coordinate in the real world where AR content is attached

A spatial anchor is a real-world coordinate saved in a shared space so multiple devices or sessions can display AR content at the exact same physical location.

Question 81: How does Application Security & Development contribute to overall professional effectiveness?

It is relevant only during the certification examination
It serves only as a credential requirement with no practical impact
It applies only to supervisory-level professionals
It provides essential knowledge and skills that directly impact quality of work and outcomes (Correct answer)

Correct answer: It provides essential knowledge and skills that directly impact quality of work and outcomes

Application Security & Development directly contributes to professional effectiveness by providing essential knowledge and skills that improve the quality of work and outcomes across all career levels.

Question 82: What is the relationship between Cloud Computing & Virtualization and ethical professional conduct?

There is no connection between technical knowledge and ethics
Ethical considerations are integrated into all aspects of professional practice in this area (Correct answer)
Ethics applies only to separate, unrelated decisions
Ethics is relevant only when legal issues arise

Correct answer: Ethical considerations are integrated into all aspects of professional practice in this area

Ethical considerations are deeply integrated into Cloud Computing & Virtualization, as professional conduct and integrity underpin all aspects of practice in this field.

Question 83: What is the consequence of non-compliance with mandatory regulations?

Automatic extension of compliance deadline
A verbal warning with no further consequences
Reduced insurance premiums
Penalties including fines, license revocation, and potential legal action (Correct answer)

Correct answer: Penalties including fines, license revocation, and potential legal action

Non-compliance with mandatory regulations can result in serious consequences including financial penalties, loss of licensure, and legal proceedings.

Question 84: What is the recommended approach to staying current in Operating Systems & Platforms?

Relying solely on past experience
Regular professional development, industry publications, and peer collaboration (Correct answer)
Waiting for regulatory changes to force updates
Reviewing initial training materials once per year

Correct answer: Regular professional development, industry publications, and peer collaboration

Staying current in Operating Systems & Platforms requires ongoing professional development, reading industry publications, and collaborating with peers to share knowledge and best practices.

Question 85: What is the primary purpose of industry regulations in this field?

To limit competition in the marketplace
To generate revenue for regulatory bodies
To protect the public and ensure consistent professional standards (Correct answer)
To create barriers to entry for new professionals

Correct answer: To protect the public and ensure consistent professional standards

Industry regulations are primarily designed to protect the public by ensuring professionals meet consistent standards of competence and conduct.

Question 86: What is edge computing in the context of IoT?

Storing all IoT data in a central cloud data center
Using edge routers to block IoT traffic from the internet
Processing data closer to the device rather than sending everything to the cloud (Correct answer)
Connecting IoT devices via Bluetooth only

Correct answer: Processing data closer to the device rather than sending everything to the cloud

Edge computing moves processing and storage closer to where data is generated, reducing latency and bandwidth usage compared to centralized cloud processing.

Question 87: Which approach to compliance is considered most effective?

Focusing compliance efforts only on areas that have been cited previously
A reactive approach that addresses issues only after violations
Hiring a consultant once a year for a brief review
A proactive approach that integrates compliance into daily operations (Correct answer)

Correct answer: A proactive approach that integrates compliance into daily operations

A proactive compliance approach that integrates regulatory requirements into daily operations is most effective at preventing violations and maintaining standards.

Question 88: How does Cryptography & Data Protection contribute to overall professional effectiveness?

It applies only to supervisory-level professionals
It serves only as a credential requirement with no practical impact
It provides essential knowledge and skills that directly impact quality of work and outcomes (Correct answer)
It is relevant only during the certification examination

Correct answer: It provides essential knowledge and skills that directly impact quality of work and outcomes

Cryptography & Data Protection directly contributes to professional effectiveness by providing essential knowledge and skills that improve the quality of work and outcomes across all career levels.

Question 89: What is the purpose of CSMA/CA in IEEE 802.11 wireless networks?

Assign dynamic IP addresses to joining clients
Encrypt wireless frames before transmission
Avoid packet collisions on the shared wireless medium (Correct answer)
Authenticate access points to wireless controllers

Correct answer: Avoid packet collisions on the shared wireless medium

CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance) reduces collisions by sensing the channel before transmitting and using random backoff timers when the medium is busy.

Question 90: What is the purpose of a risk register?

To document, track, and manage all identified risks throughout a project or operation (Correct answer)
To assign blame when problems occur
To satisfy audit requirements only
To eliminate all risks before starting work

Correct answer: To document, track, and manage all identified risks throughout a project or operation

A risk register is a living document that records all identified risks, their assessments, response plans, and status updates throughout the lifecycle of a project or operation.

CompTIA Security+ (SY0-701)

CompTIA Security+ is a globally recognized entry-level cybersecurity certification that validates foundational skills in network security, risk management, access control, cryptography, and security operations. It covers five core domains including threats & vulnerabilities, security architecture, security operations, and security program management.

Questions

90 min

Time Limit

83%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds