CompTIA Security+ (SY0-601) Certification Exam — Questions and Answers

Question 1: Which firewall type can inspect the full HTTP request and response content, including payload, to block application-layer attacks like XSS and SQL injection?

Web Application Firewall (WAF) (Correct answer)
Stateful inspection firewall
Circuit-level gateway
Packet filtering firewall

Correct answer: Web Application Firewall (WAF)

A WAF operates at Layer 7 and inspects HTTP/HTTPS content to detect and block application-layer attacks targeting web applications.

Question 2: An attacker gains access to a system and installs software that hides the attacker's presence and maintains access. What type of malware is this?

Spyware
Adware
Rootkit (Correct answer)
Trojan horse

Correct answer: Rootkit

A rootkit conceals an attacker's presence on a compromised system and maintains persistent access by modifying OS components.

Question 3: An attacker gains access to a low-privilege account on a system and then exploits a vulnerability to gain administrative access. What is this technique called?

Credential dumping
Persistence
Lateral movement
Privilege escalation (Correct answer)

Correct answer: Privilege escalation

Privilege escalation is the process of gaining higher-level permissions than initially granted, moving from limited to administrative access.

Question 4: A company's payroll system can tolerate losing no more than 4 hours of transaction data in the event of a disaster. Which metric does this describe?

Recovery Time Objective (RTO)
Mean Time Between Failures (MTBF)
Maximum Tolerable Downtime (MTD)
Recovery Point Objective (RPO) (Correct answer)

Correct answer: Recovery Point Objective (RPO)

Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss, measured in time, that an organization can tolerate.

Question 5: Which threat actor type is typically motivated by financial gain and operates as a professional criminal organization?

Nation-state actor
Hacktivist
Organized crime (Correct answer)
Script kiddie

Correct answer: Organized crime

Organized crime groups are primarily financially motivated, conducting activities like ransomware campaigns and fraud for profit.

Question 6: Which foundational principle is MOST important for success in CompTIA Security+ IT Certification?

Maximizing financial returns
Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)
Maintaining minimum certification requirements
Specializing in only one narrow area

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Success requires continuous learning, ethical practice, and focus on quality outcomes.

Question 7: An architect is designing an ICS environment for a power utility. To prevent any digital communication path between the operational network and the internet, which control should be implemented?

Air gap (Correct answer)
Stateful firewall with ACLs
Network access control (NAC)
IDS/IPS inline deployment

Correct answer: Air gap

An air gap physically isolates the ICS network from all external networks, including the internet, eliminating any digital attack path.

Question 8: What is DMZ in network design?

Database layer
VPN zone
Internal network
Isolated network zone (Correct answer)

Correct answer: Isolated network zone

A DMZ (Demilitarized Zone) in network design is an isolated network zone that acts as a buffer between an organization's internal network and an untrusted external network, like the internet. It hosts public-facing services such as web servers or email servers, protecting the internal network from direct attacks. If a DMZ server is compromised, the attacker still cannot directly access the more sensitive internal systems.

Question 9: During a Business Impact Analysis, which metric defines the maximum length of time a critical business function can be unavailable before causing unacceptable harm to the organization?

Recovery Point Objective (RPO)
Recovery Time Objective (RTO)
Mean Time to Recover (MTTR)
Maximum Tolerable Downtime (MTD) (Correct answer)

Correct answer: Maximum Tolerable Downtime (MTD)

Maximum Tolerable Downtime (MTD) defines the absolute outer limit of downtime before the impact becomes unacceptable to the business.

Question 10: A cloud architect needs to encrypt data so that it can still be searched and queried without full decryption. Which encryption concept supports this requirement?

Envelope encryption
Homomorphic encryption (Correct answer)
Full-disk encryption
Symmetric key encryption

Correct answer: Homomorphic encryption

Homomorphic encryption allows computations to be performed on ciphertext, producing encrypted results that match operations on the plaintext.

Question 11: What does WPA3 secure?

Email clients
Wired networks
VPNs
Wireless networks (Correct answer)

Correct answer: Wireless networks

WPA3 (Wi-Fi Protected Access 3) is the latest security standard for wireless networks, designed to provide stronger encryption and more robust authentication than its predecessors. It offers enhanced protection against brute-force attacks and improves privacy for users on public Wi-Fi networks. WPA3 secures the data transmitted over Wi-Fi, making it much harder for unauthorized parties to intercept or decrypt communications.

Question 12: An organization's policy requires all email records to be stored for 7 years to satisfy legal and regulatory requirements. In which type of policy is this defined?

Change Management Policy
Incident Response Policy
Data Retention Policy (Correct answer)
Acceptable Use Policy

Correct answer: Data Retention Policy

A data retention policy specifies how long different categories of data must be stored and the procedures for their eventual secure disposal.

Question 13: How frequently should ongoing assessments be conducted in CompTIA Security+ IT Certification practice?

Only when problems are reported
Once annually regardless of circumstances
At regular intervals and as conditions change (Correct answer)
Only when required by external auditors

Correct answer: At regular intervals and as conditions change

Ongoing assessments should follow established protocols and also respond to changing conditions.

Question 14: An attacker targets the CEO specifically with a highly sophisticated phishing email crafted to appear as a legitimate board communication. What is this attack called?

Vishing
Business email compromise
Whaling (Correct answer)
Spear phishing

Correct answer: Whaling

Whaling is a form of spear phishing specifically targeting high-profile executives (the 'big fish') within an organization.

Question 15: What is the MOST effective way for new SY0-601 professionals to build competency?

Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Focusing solely on advanced topics
Studying certification materials exclusively
Learning through trial and error

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building competency requires formal education, mentored practice, and ongoing development.

Question 16: A user receives a phone call from someone claiming to be IT support and is tricked into revealing their password. Which social engineering technique is this?

Smishing
Spear phishing
Watering hole attack
Vishing (Correct answer)

Correct answer: Vishing

Vishing (voice phishing) uses phone calls to manipulate victims into disclosing sensitive information.

Question 17: What does the term 'chain of custody' mean in digital forensics?

The order in which systems are patched after an incident
A blockchain-based evidence storage system
Encrypting evidence before storage
Documentation tracking who handled evidence and when (Correct answer)

Correct answer: Documentation tracking who handled evidence and when

Chain of custody is a documented record showing who collected, handled, transferred, and analyzed evidence to ensure its integrity in legal proceedings.

Question 18: A security team implements a system that automatically revokes and rotates credentials when anomalous API usage is detected. This is an example of which security architecture principle?

Manual incident response
Role-based access control
Fail open
Automated response and orchestration (Correct answer)

Correct answer: Automated response and orchestration

Automated response and orchestration (SOAR) reduces dwell time by triggering remediation actions such as credential rotation without human intervention.

Question 19: Which protocol secures LDAP directory communications by wrapping them in a TLS tunnel, using port 636?

LDAPS (LDAP over SSL/TLS) (Correct answer)
Kerberos over LDAP
LDAP with SASL
SNMP v3

Correct answer: LDAPS (LDAP over SSL/TLS)

LDAPS wraps standard LDAP communications in a TLS/SSL tunnel on port 636, encrypting all directory queries and responses.

Question 20: Which term describes a cyberattack where the attacker secretly positions themselves between two communicating parties to intercept and possibly alter messages?

Replay attack
On-path (man-in-the-middle) attack (Correct answer)
Smurf attack
Amplification attack

Correct answer: On-path (man-in-the-middle) attack

An on-path (MitM) attack intercepts communications between two parties without their knowledge, allowing eavesdropping or data manipulation.

Question 21: A company purchases cyber insurance to offset potential financial losses from a data breach. Which risk response strategy does this represent?

Risk transfer (Correct answer)
Risk mitigation
Risk acceptance
Risk avoidance

Correct answer: Risk transfer

Risk transfer shifts the financial burden of a risk to a third party, such as through purchasing cyber insurance.

Question 22: What distinguishes a CompTIA Security+ IT Certification certified professional from a non-certified practitioner?

Certified professionals always have more experience
Certification validates competency through standardized assessment against benchmarks (Correct answer)
Certified professionals only work in larger organizations
There is no meaningful difference

Correct answer: Certification validates competency through standardized assessment against benchmarks

Certification provides objective validation of competency through standardized assessment.

Question 23: An enterprise CISO wants to ensure that cloud-hosted workloads adhere to security baselines continuously, not just at deployment time. Which tool category addresses this requirement?

Cloud Security Posture Management (CSPM) (Correct answer)
Cloud Access Security Broker (CASB)
Web Application Firewall (WAF)
Security Information and Event Management (SIEM)

Correct answer: Cloud Security Posture Management (CSPM)

CSPM tools continuously monitor cloud environments for configuration drift and compliance violations against defined security baselines.

Question 24: Why test an incident response plan?

Skip response
Avoid panic
Ensure effectiveness (Correct answer)
Reduce cost

Correct answer: Ensure effectiveness

Testing an incident response plan is crucial to ensure its effectiveness and identify any weaknesses or gaps before a real incident occurs. Regular drills and simulations help the incident response team practice their roles, refine procedures, and improve coordination. This preparedness ensures that when an actual incident happens, the team can respond quickly and efficiently, minimizing damage and recovery time.

Question 25: A network administrator wants to prevent rogue DHCP servers on a LAN. Which switch security feature should be enabled?

Port security
DHCP snooping (Correct answer)
Dynamic ARP inspection
802.1X

Correct answer: DHCP snooping

DHCP snooping filters DHCP messages by designating trusted and untrusted ports, blocking rogue DHCP servers on untrusted ports.

Question 26: Which attack exploits trust relationships to move from a compromised system to other systems within the network?

Lateral movement (Correct answer)
Exfiltration
Persistence
Privilege escalation

Correct answer: Lateral movement

Lateral movement techniques allow attackers to progressively move through a network by exploiting trust relationships between systems.

Question 27: What is a secure protocol for file transfer?

Telnet
SMTP
FTP
SFTP (Correct answer)

Correct answer: SFTP

SFTP (SSH File Transfer Protocol) is a secure protocol for transferring files over an encrypted SSH (Secure Shell) connection. Unlike FTP, which sends data in plaintext, SFTP encrypts both the data and the authentication information, protecting them from eavesdropping and tampering. This makes SFTP a much safer choice for transferring sensitive files over a network, ensuring confidentiality and integrity.

Question 28: What is phishing?

Fraudulent email scam (Correct answer)
Computer virus
Firewall breach
Data backup

Correct answer: Fraudulent email scam

Phishing is a type of cyberattack where attackers attempt to trick individuals into revealing sensitive information, such as usernames, passwords, or credit card details. This is typically done by disguising themselves as a trustworthy entity in electronic communication, most commonly through fraudulent emails. The goal is to deceive the recipient into clicking malicious links or providing confidential data.

Question 29: What is spyware?

Blocks spam
Speeds up PC
Gathers info secretly (Correct answer)
Encrypts data

Correct answer: Gathers info secretly

Spyware is a type of malicious software designed to secretly gather information about a user's activities without their knowledge or consent. This can include monitoring keystrokes, capturing screenshots, tracking browsing history, or collecting personal data. Its primary purpose is to covertly transmit this collected information to an unauthorized third party, often for advertising or malicious purposes.

Question 30: Which statement BEST describes the relationship between CompTIA Security+ IT Certification certification and industry evolution?

Changes only occur when government mandates them
Requirements evolve periodically to reflect advances in knowledge and practice (Correct answer)
Requirements become less stringent over time
Certification requirements never change

Correct answer: Requirements evolve periodically to reflect advances in knowledge and practice

Certification requirements evolve to keep pace with professional and technological advances.

Question 31: How does the SY0-601 body of knowledge relate to daily professional practice?

It only applies during exams
It is theoretical with limited application
It is only for academic research
It provides the foundational framework guiding decision-making and standard practices (Correct answer)

Correct answer: It provides the foundational framework guiding decision-making and standard practices

The body of knowledge provides the framework guiding daily decision-making and practices.

Question 32: A security analyst observes repeated failed SSH login attempts from a single IP address. What type of attack is most likely occurring?

Brute force (Correct answer)
Phishing
SQL injection
Man-in-the-middle

Correct answer: Brute force

Repeated failed login attempts from one source are characteristic of a brute force attack trying to guess credentials.

Question 33: A developer stores secrets such as API keys and database passwords directly in application configuration files checked into source control. Which secure design practice should be enforced instead?

Restrict repository access to senior developers only
Hash all secrets before storing them in config files
Encrypt the configuration files with AES-256
Use environment variables or a secrets management vault (Correct answer)

Correct answer: Use environment variables or a secrets management vault

Secrets should be stored in a dedicated secrets manager or injected via environment variables, never hardcoded in source-controlled files.

Question 34: A security analyst is tasked with determining whether a JPEG file contains hidden data. Which technique should be used?

Steganography analysis (Correct answer)
Password cracking
Fuzzing
Port scanning

Correct answer: Steganography analysis

Steganography analysis tools detect and extract data hidden within image, audio, or other files that appear normal on the surface.

Question 35: Which of the following BEST describes a tabletop exercise?

Penetration testing against production systems
Automated red team scanning
A live simulation where systems are actually attacked
A discussion-based walkthrough of an incident scenario (Correct answer)

Correct answer: A discussion-based walkthrough of an incident scenario

A tabletop exercise is a discussion-based session where stakeholders walk through a hypothetical incident to evaluate their response plan without actual system disruption.

Question 36: How does the SY0-601 body of knowledge relate to daily professional practice?

It only applies during exams
It is theoretical with limited application
It is only for academic research
It provides the foundational framework guiding decision-making and standard practices (Correct answer)

Correct answer: It provides the foundational framework guiding decision-making and standard practices

The body of knowledge provides the framework guiding daily decision-making and practices.

Question 37: An organization deploys an application that processes payment data. The security architect recommends a deception technology to detect attackers who have already breached the network. What is this technology called?

SIEM correlation rule
Web application firewall
Honeypot (Correct answer)
IDS sensor

Correct answer: Honeypot

A honeypot is a decoy system designed to lure and detect attackers who have already gained internal network access.

Question 38: What is containment in incident response?

Change passwords
Limit damage (Correct answer)
Reboot systems
Erase logs

Correct answer: Limit damage

Containment is a critical phase in incident response that focuses on limiting the scope and impact of a security incident. This involves taking immediate actions to stop the spread of the attack, such as isolating affected systems, disconnecting networks, or blocking malicious IP addresses. The goal is to prevent further damage and minimize the overall harm to the organization's assets and operations, allowing for controlled remediation.

Question 39: A healthcare organization must store patient records for 7 years per HIPAA requirements. Which architectural component should be designed to enforce this retention policy automatically?

DLP gateway
Data lifecycle management / object lock (Correct answer)
SIEM log retention policy
Backup rotation schedule

Correct answer: Data lifecycle management / object lock

Data lifecycle management with object lock (WORM) enforces retention policies automatically, preventing records from being deleted before the mandated retention period expires.

Question 40: An application is designed so that if the authentication service becomes unavailable, all access to the system is denied rather than allowed. Which design concept does this reflect?

Fail open
Fail secure (fail closed) (Correct answer)
High availability
Defense in depth

Correct answer: Fail secure (fail closed)

Fail secure ensures that a system defaults to a secure, restricted state when a component fails, preventing unauthorized access during outages.

Question 41: What distinguishes a CompTIA Security+ IT Certification certified professional from a non-certified practitioner?

Certified professionals only work in larger organizations
There is no meaningful difference
Certified professionals always have more experience
Certification validates competency through standardized assessment against benchmarks (Correct answer)

Correct answer: Certification validates competency through standardized assessment against benchmarks

Certification provides objective validation of competency through standardized assessment.

Question 42: What distinguishes a CompTIA Security+ IT Certification certified professional from a non-certified practitioner?

Certified professionals always have more experience
There is no meaningful difference
Certified professionals only work in larger organizations
Certification validates competency through standardized assessment against benchmarks (Correct answer)

Correct answer: Certification validates competency through standardized assessment against benchmarks

Certification provides objective validation of competency through standardized assessment.

Question 43: Which secure coding practice directly mitigates SQL injection vulnerabilities by separating SQL code from user-supplied data?

Parameterized queries (prepared statements) (Correct answer)
Output encoding
Input length validation
Error message suppression

Correct answer: Parameterized queries (prepared statements)

Parameterized queries treat user input strictly as data parameters, preventing it from being interpreted as SQL commands.

Question 44: A multinational company is legally required to store all European customers' data on servers physically located within the European Union. This requirement reflects which concept?

Data classification
Data minimization
Data sovereignty (Correct answer)
Data masking

Correct answer: Data sovereignty

Data sovereignty means that data is subject to the laws and governance of the nation where it physically resides, often dictating where data must be stored.

Question 45: What is the MOST important factor when selecting assessment tools for SY0-601 certification work?

Validity, reliability, and appropriateness for the specific context (Correct answer)
How quickly the tool can be administered
Personal familiarity with the tool
The cost of the assessment tool

Correct answer: Validity, reliability, and appropriateness for the specific context

Assessment tools must be valid, reliable, and appropriate for the specific context.

Question 46: An attacker registers a domain name with a common typo of a popular website (e.g., 'googie.com') to capture accidental visitors. What is this called?

DNS spoofing
Pharming
Domain hijacking
URL hijacking / typosquatting (Correct answer)

Correct answer: URL hijacking / typosquatting

Typosquatting (URL hijacking) registers misspelled versions of popular domains to capture traffic from users who mistype URLs.

Question 47: When assessment results for a CompTIA Security+ IT Certification evaluation are inconclusive, the BEST practice is to:

Conduct additional assessment using alternative methods (Correct answer)
Delay reporting until results are favorable
Discard the results and start over
Report the results as definitive anyway

Correct answer: Conduct additional assessment using alternative methods

Inconclusive results require additional assessment using alternative methods for triangulation.

Question 48: Which DNS attack involves corrupting the DNS cache to redirect users to malicious IP addresses without their knowledge?

DNS spoofing / cache poisoning (Correct answer)
DNS hijacking
Domain kiting
NXDOMAIN attack

Correct answer: DNS spoofing / cache poisoning

DNS cache poisoning injects false DNS records into a resolver's cache, redirecting users to attacker-controlled servers.

Question 49: Which wireless security protocol uses Simultaneous Authentication of Equals (SAE) to replace the Pre-Shared Key handshake and prevent offline dictionary attacks?

WPA2-Personal
WPA3-Personal (Correct answer)
WEP
WPA2-Enterprise

Correct answer: WPA3-Personal

WPA3-Personal uses SAE (also called Dragonfly handshake) which prevents offline dictionary attacks against captured handshakes.

Question 50: What are access control lists (ACLs)?

Password vaults
Encryption protocols
User directories
Traffic control rules (Correct answer)

Correct answer: Traffic control rules

Access Control Lists (ACLs) are sets of rules used to filter network traffic and control access to network resources. They specify which users or system processes are granted access to objects, as well as what operations are allowed on those objects. ACLs are crucial for enforcing security policies on routers, switches, and firewalls, determining whether packets should be forwarded or dropped based on criteria like source/destination IP addresses or port numbers.

Question 51: When documenting assessment findings in SY0-601 practice, which approach is MOST appropriate?

Summarize verbally without written documentation
Include only positive findings
Record objective findings, measurements, and observations factually (Correct answer)
Use jargon only experts understand

Correct answer: Record objective findings, measurements, and observations factually

Assessment documentation must be objective, factual, and comprehensive.

Question 52: How should a SY0-601 professional manager address underperformance?

Ignore it until formal reviews
Address publicly in team meetings
Immediately reassign the individual
Provide timely, specific feedback with support and a clear improvement plan (Correct answer)

Correct answer: Provide timely, specific feedback with support and a clear improvement plan

Timely, specific feedback with support gives individuals a fair opportunity to improve.

Question 53: An attacker sends a specially crafted URL to a victim that, when clicked, causes the victim's browser to execute malicious scripts on a trusted website. What type of attack is this?

Cross-site request forgery (CSRF)
Cross-site scripting (XSS) (Correct answer)
SQL injection
Command injection

Correct answer: Cross-site scripting (XSS)

Reflected XSS attacks embed malicious scripts in URLs that execute in the victim's browser in the context of a trusted site.

Question 54: During a forensic investigation, an analyst needs to preserve evidence from a compromised system. Which action should be performed FIRST?

Delete suspicious processes immediately
Reboot the system to apply patches
Capture a memory dump before powering off (Correct answer)
Run antivirus to clean the system

Correct answer: Capture a memory dump before powering off

Memory is volatile and will be lost on power-off, so capturing a RAM dump first preserves critical evidence like running processes and encryption keys.

Question 55: Which type of threat intelligence sharing model allows organizations to exchange structured threat data using a standard format?

SNMP/MIB
SMTP/DMARC
LDAP/AD
STIX/TAXII (Correct answer)

Correct answer: STIX/TAXII

STIX (Structured Threat Information eXpression) defines the format and TAXII (Trusted Automated eXchange of Intelligence Information) is the transport protocol for sharing threat intelligence.

Question 56: An organization labels its most sensitive data as 'Confidential' and its public-facing data as 'Public.' What security concept is being applied?

Data masking
Data sovereignty
Data classification (Correct answer)
Data retention

Correct answer: Data classification

Data classification categorizes data based on its sensitivity level so that appropriate security controls can be applied.

Question 57: An organization requires all employees to take a consecutive two-week vacation and prohibits remote access to systems during that time. Which security principle does this policy support?

Separation of duties
Mandatory vacation (Correct answer)
Least privilege
Job rotation

Correct answer: Mandatory vacation

Mandatory vacation policies help detect fraud or policy violations by requiring employees to step away, allowing others to discover irregularities in their absence.

Question 58: Which attack targets the weakest link by sending malicious emails to specific, named individuals within an organization using personalized information?

Whaling
Pretexting
Vishing
Spear phishing (Correct answer)

Correct answer: Spear phishing

Spear phishing targets specific individuals using personalized information to make the deceptive communication more convincing.

Question 59: What is the MOST important leadership quality for a SY0-601 certified professional managing a team?

Demonstrating integrity, clear communication, and ability to develop team members (Correct answer)
Avoiding all conflict
Maintaining strict control over all decisions
Achieving highest personal metrics

Correct answer: Demonstrating integrity, clear communication, and ability to develop team members

Effective leadership requires integrity, clear communication, and developing team members.

Question 60: A company adopts a BYOD policy and wants to ensure that corporate data on personal devices is wiped remotely if a device is lost, without affecting personal data. Which technology supports this?

VPN split tunneling
Host-based DLP agent installation
Containerization / MAM with selective wipe (Correct answer)
Full-device MDM enrollment with remote wipe

Correct answer: Containerization / MAM with selective wipe

Mobile Application Management (MAM) with containerization separates corporate data into a managed container that can be selectively wiped without touching personal data.

Question 61: What is threat hunting?

Proactive threat search (Correct answer)
Fix printers
Backup files
Send emails

Correct answer: Proactive threat search

Threat hunting is a proactive security activity where cybersecurity professionals actively search for unknown or undetected threats within an organization's network. Unlike traditional security measures that react to alerts, threat hunting assumes that a breach may have already occurred and seeks to uncover sophisticated attacks that have bypassed automated defenses. This helps organizations discover and mitigate threats before they cause significant damage, improving overall resilience.

Question 62: A forensic investigator receives a hard drive image. Which hashing algorithm should be used to verify the image's integrity matches the original?

DES
RSA-2048
MD5 or SHA-256 (Correct answer)
AES-256

Correct answer: MD5 or SHA-256

Hashing the original and the image with MD5 or SHA-256 and comparing the values confirms the image is an exact, unaltered copy.

Question 63: What is ransomware?

Data backup
Free antivirus
System update
Data locked for ransom (Correct answer)

Correct answer: Data locked for ransom

Ransomware is a type of malicious software that encrypts a victim's files, rendering them inaccessible. The attacker then demands a ransom payment, typically in cryptocurrency, in exchange for the decryption key. If the ransom is not paid, the data may remain encrypted or be permanently lost, making it a highly disruptive form of cyberattack.

Question 64: Which technique do attackers use to bypass application blacklists by disguising malicious input using encoding or alternative representations?

Refactoring
Shimming
Obfuscation/camouflage (Correct answer)
Pivoting

Correct answer: Obfuscation/camouflage

Obfuscation disguises malicious code or input (e.g., URL encoding, Unicode escapes) to evade detection by security controls.

Question 65: An analyst needs to identify all active network connections and listening ports on a compromised Windows host. Which command is MOST appropriate?

ping localhost
tracert 8.8.8.8
ipconfig /all
netstat -ano (Correct answer)

Correct answer: netstat -ano

`netstat -ano` shows all active TCP/UDP connections with associated process IDs, helping identify suspicious listening services or outbound connections.

Question 66: What is the PRIMARY purpose of obtaining SY0-601 certification in CompTIA Security+ IT Certification?

To bypass educational requirements
To satisfy a personal achievement goal
To demonstrate verified competency and adherence to professional standards (Correct answer)
To guarantee employment

Correct answer: To demonstrate verified competency and adherence to professional standards

Certification demonstrates verified competency and adherence to professional standards.

Question 67: A newly released software patch notes that a vulnerability was being exploited before the vendor was aware of it. What category does this vulnerability fall under?

Zero-day vulnerability (Correct answer)
Known exploit
Legacy vulnerability
Disclosed vulnerability

Correct answer: Zero-day vulnerability

A zero-day vulnerability is one that is exploited before the vendor knows about it, leaving zero days to develop a fix.

Question 68: How should a SY0-601 professional manager address underperformance?

Provide timely, specific feedback with support and a clear improvement plan (Correct answer)
Immediately reassign the individual
Ignore it until formal reviews
Address publicly in team meetings

Correct answer: Provide timely, specific feedback with support and a clear improvement plan

Timely, specific feedback with support gives individuals a fair opportunity to improve.

Question 69: An organization is implementing endpoint protection and wants behavioral-based detection rather than relying on signature databases. Which technology should they deploy?

Antivirus with daily signature updates
Host-based Intrusion Detection System (HIDS) with anomaly detection (Correct answer)
Full disk encryption
Application whitelisting only

Correct answer: Host-based Intrusion Detection System (HIDS) with anomaly detection

A HIDS with anomaly/behavioral detection monitors activity patterns and flags deviations from baseline without requiring known malware signatures.

Question 70: A company needs employees to prove their identity using something they know, something they have, and something they are before accessing sensitive systems. This is an example of:

Multi-factor authentication (MFA) (Correct answer)
Federated identity
Role-based access control (RBAC)
Single sign-on (SSO)

Correct answer: Multi-factor authentication (MFA)

MFA combines multiple authentication factors—knowledge, possession, and inherence—to significantly reduce the risk of unauthorized access.

Question 71: Which implementation approach ensures that a user's browser only connects to a site using a specific certificate or public key, preventing impersonation even with a valid CA-issued cert?

HSTS (HTTP Strict Transport Security)
Certificate transparency logs
OCSP stapling
Certificate pinning (Correct answer)

Correct answer: Certificate pinning

Certificate pinning hardcodes the expected certificate or public key in the application, rejecting connections even with legitimately CA-signed alternative certificates.

Question 72: Which function of the NIST Cybersecurity Framework focuses on developing organizational understanding of cybersecurity risks to systems, assets, and data?

Detect
Protect
Identify (Correct answer)
Respond

Correct answer: Identify

The NIST CSF 'Identify' function helps organizations understand their cybersecurity risk environment, including assets, data, and current governance practices.

Question 73: Which vulnerability scanning result indicates a flaw is reported but does not actually exist in the target system?

False positive (Correct answer)
True negative
True positive
False negative

Correct answer: False positive

A false positive occurs when a scanner reports a vulnerability that is not actually present, wasting remediation effort.

Question 74: An attacker uses a precomputed table of hash values to quickly reverse password hashes. What type of attack is this?

Pass-the-hash attack
Collision attack
Rainbow table attack (Correct answer)
Brute force attack

Correct answer: Rainbow table attack

Rainbow table attacks use precomputed tables of plaintext-to-hash mappings to quickly crack password hashes without recalculating them.

Question 75: An attacker compromises a website frequently visited by members of a target organization and embeds malware there. What type of attack is this?

Watering hole attack (Correct answer)
Drive-by download
Spear phishing
Typosquatting

Correct answer: Watering hole attack

A watering hole attack infects a website known to be visited by the intended victims, exploiting their trust in that site.

Question 76: Which international standard specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS)?

NIST SP 800-53
ISO/IEC 27001 (Correct answer)
COBIT 2019
SOC 2

Correct answer: ISO/IEC 27001

ISO/IEC 27001 is the globally recognized standard that defines requirements for an ISMS, providing a systematic approach to managing sensitive information.

Question 77: Which security policy document defines the rules employees must follow when using company-owned computers, networks, and internet access?

Data Retention Policy
Clean Desk Policy
Acceptable Use Policy (AUP) (Correct answer)
Non-Disclosure Agreement (NDA)

Correct answer: Acceptable Use Policy (AUP)

An Acceptable Use Policy (AUP) outlines permitted and prohibited uses of organizational IT resources to govern employee behavior.

Question 78: Which of the following attack types is characterized by an adversary maintaining a presence in a network for months without detection?

Phishing campaign
Script kiddie attack
Advanced Persistent Threat (APT) (Correct answer)
Denial of Service

Correct answer: Advanced Persistent Threat (APT)

APTs are sophisticated, long-term intrusions where attackers remain stealthy to conduct espionage or data exfiltration over extended periods.

Question 79: An attacker exploits a vulnerability in a web application to manipulate database queries and extract unauthorized data. What is this attack called?

LDAP injection
Command injection
XML injection
SQL injection (Correct answer)

Correct answer: SQL injection

SQL injection inserts malicious SQL statements into input fields to manipulate or extract database content.

Question 80: What is the recovery phase?

Ignore alerts
Restore systems (Correct answer)
Shut down servers
Isolate users

Correct answer: Restore systems

The recovery phase in incident response focuses on restoring affected systems and services to their normal operational state after an incident has been contained and eradicated. This typically involves restoring data from backups, rebuilding compromised systems, and verifying that all vulnerabilities have been patched. The goal is to bring the business back to full functionality securely and efficiently, minimizing long-term disruption.

Question 81: What does redundancy do?

Add complexity
Reduce access
Increase availability (Correct answer)
Improve UI

Correct answer: Increase availability

Redundancy involves duplicating critical components or functions within a system to ensure that if one component fails, another can take over seamlessly. This design principle is crucial for high availability, as it minimizes downtime and ensures continuous operation of services. By having backup systems or data paths, the overall reliability and uptime of the infrastructure are significantly improved, preventing single points of failure.

Question 82: Which network architecture concept uses software to dynamically provision and configure virtual network functions (firewalls, load balancers) without dedicated physical hardware?

Spanning Tree Protocol
MPLS traffic engineering
Software-Defined Networking (SDN) (Correct answer)
Link aggregation (LACP)

Correct answer: Software-Defined Networking (SDN)

SDN decouples the control plane from the data plane, allowing network functions to be provisioned and configured programmatically through software.

Question 83: A hospital must implement safeguards to protect the privacy and security of patients' electronic medical records. Which U.S. regulation applies?

FERPA
HIPAA (Correct answer)
GLBA
COPPA

Correct answer: HIPAA

HIPAA (Health Insurance Portability and Accountability Act) requires healthcare entities to protect the privacy and security of Protected Health Information (PHI).

Question 84: Which of the following is an example of a technical control used during the recovery phase of incident response?

Restoring systems from clean backups (Correct answer)
Conducting a lessons-learned meeting
Updating the incident response policy
Notifying affected customers

Correct answer: Restoring systems from clean backups

Restoring from clean backups is a technical recovery action that returns systems to a known-good state after eradication.

Question 85: What does vulnerability mean?

Update feature
System upgrade
Access log
Weakness in system (Correct answer)

Correct answer: Weakness in system

In cybersecurity, a vulnerability refers to a weakness or flaw in a system, application, or network that can be exploited by an attacker. These weaknesses could be in software code, configurations, or even human processes. Identifying and patching vulnerabilities is crucial to prevent unauthorized access, data breaches, and other security incidents.

Question 86: Which regulation requires organizations processing EU citizens' personal data to notify authorities of a breach within 72 hours and obtain explicit consent before collection?

HIPAA
SOX
PCI-DSS
GDPR (Correct answer)

Correct answer: GDPR

GDPR (General Data Protection Regulation) mandates 72-hour breach notification and explicit consent for processing EU citizens' personal data.

Question 87: What is the BEST strategy for resource allocation in CompTIA Security+ IT Certification management?

Focus resources only on largest tasks
Match resources to priorities based on needs, risks, and strategic goals (Correct answer)
Allocate all resources equally
Keep significant reserves without deployment

Correct answer: Match resources to priorities based on needs, risks, and strategic goals

Effective resource allocation matches resources to priorities based on assessment of needs.

Question 88: When documenting assessment findings in SY0-601 practice, which approach is MOST appropriate?

Summarize verbally without written documentation
Record objective findings, measurements, and observations factually (Correct answer)
Include only positive findings
Use jargon only experts understand

Correct answer: Record objective findings, measurements, and observations factually

Assessment documentation must be objective, factual, and comprehensive.

Question 89: A company runs criminal background checks on all job applicants who will handle sensitive financial data before making a hiring decision. What type of security control is this?

Corrective control
Preventive control (Correct answer)
Detective control
Compensating control

Correct answer: Preventive control

Background checks are preventive controls because they are designed to prevent potential security incidents before they can occur by screening personnel in advance.

Question 90: During a threat model, the team identifies that an attacker could intercept communications between internal microservices. Which control directly mitigates this east-west traffic threat?

Mutual TLS (mTLS) between all microservices (Correct answer)
Network-level IDS signatures
HTTPS only for external-facing APIs
Perimeter TLS termination at the load balancer

Correct answer: Mutual TLS (mTLS) between all microservices

Mutual TLS (mTLS) ensures that both the client and server microservices authenticate each other and encrypt the channel, protecting east-west traffic from interception or spoofing.

Question 91: What is the main goal of social engineering?

Install patches
Trick people for data (Correct answer)
Fix bugs
Change system settings

Correct answer: Trick people for data

The main goal of social engineering is to trick people into divulging confidential information or performing actions that compromise security. Unlike technical attacks, social engineering exploits human psychology, such as trust, fear, or curiosity, rather than system vulnerabilities. Attackers manipulate individuals to gain unauthorized access to systems or data.

CompTIA Security+ (SY0-601) Certification Exam

This certification validates the baseline skills necessary to perform core security functions and pursue an IT security career, covering threat management, risk management, and security architecture.

Questions

90 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds