CompTIA Security+ (SY0-601) Certification Exam — Questions and Answers

Question 1: Which DNS attack involves corrupting the DNS cache to redirect users to malicious IP addresses without their knowledge?

DNS hijacking
Domain kiting
NXDOMAIN attack
DNS spoofing / cache poisoning (Correct answer)

Correct answer: DNS spoofing / cache poisoning

DNS cache poisoning injects false DNS records into a resolver's cache, redirecting users to attacker-controlled servers.

Question 2: What is the benefit of cloud architecture?

Manual updates
Scalability (Correct answer)
High cost
Fixed access

Correct answer: Scalability

The primary benefit of cloud architecture is scalability, which allows resources to be easily adjusted up or down based on demand. Organizations can quickly provision or de-provision computing power, storage, and network bandwidth as needed, without significant upfront investment. This flexibility enables businesses to handle fluctuating workloads efficiently and cost-effectively.

Question 3: A server failure has an Annual Rate of Occurrence (ARO) of 2 and a Single Loss Expectancy (SLE) of $15,000. What is the Annual Loss Expectancy (ALE)?

$7,500
$30,000 (Correct answer)
$45,000
$15,000

Correct answer: $30,000

ALE = SLE × ARO = $15,000 × 2 = $30,000, representing the expected annual financial loss from this specific risk.

Question 4: An organization uses containers for its microservices. A security review finds that all containers run as root. Which remediation BEST reduces risk?

Run containers with a non-root user and read-only filesystem (Correct answer)
Implement network policies between pods
Encrypt container images at rest
Switch from Docker to Kubernetes

Correct answer: Run containers with a non-root user and read-only filesystem

Running containers as non-root with a read-only filesystem limits the damage an attacker can do if they exploit a vulnerability inside the container.

Question 5: An attacker uses a precomputed table of hash values to quickly reverse password hashes. What type of attack is this?

Rainbow table attack (Correct answer)
Pass-the-hash attack
Brute force attack
Collision attack

Correct answer: Rainbow table attack

Rainbow table attacks use precomputed tables of plaintext-to-hash mappings to quickly crack password hashes without recalculating them.

Question 6: Which type of malware is specifically designed to record keystrokes and transmit them to an attacker?

Worm
Ransomware
Rootkit
Keylogger (Correct answer)

Correct answer: Keylogger

A keylogger captures keyboard input to steal credentials and sensitive information and sends it to the attacker.

Question 7: A company's IRP requires notifying affected users within 72 hours of a confirmed breach. This requirement is MOST likely driven by:

Internal IT policy
NIST SP 800-61 recommendations
The organization's SLA with its ISP
GDPR or similar data breach notification regulations (Correct answer)

Correct answer: GDPR or similar data breach notification regulations

The 72-hour breach notification window is a specific legal requirement under GDPR and similar data protection regulations, not just a best-practice recommendation.

Question 8: Which U.S. state law grants residents the right to know what personal information is collected about them, the right to opt out of its sale, and the right to request its deletion?

CCPA (Correct answer)
HIPAA
SOX
FERPA

Correct answer: CCPA

The California Consumer Privacy Act (CCPA) provides California residents with rights over the collection, sale, and deletion of their personal data.

Question 9: What is the PRIMARY purpose of obtaining SY0-601 certification in CompTIA Security+ IT Certification?

To guarantee employment
To demonstrate verified competency and adherence to professional standards (Correct answer)
To bypass educational requirements
To satisfy a personal achievement goal

Correct answer: To demonstrate verified competency and adherence to professional standards

Certification demonstrates verified competency and adherence to professional standards.

Question 10: When planning a project in CompTIA Security+ IT Certification, which element should be established FIRST?

Team member assignments
Project timeline
Budget allocation
Clear objectives, scope, and success criteria (Correct answer)

Correct answer: Clear objectives, scope, and success criteria

Clear objectives and success criteria form the foundation for all other planning decisions.

Question 11: What is the MOST effective way for new SY0-601 professionals to build competency?

Focusing solely on advanced topics
Learning through trial and error
Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Studying certification materials exclusively

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building competency requires formal education, mentored practice, and ongoing development.

Question 12: Which attack exploits trust relationships to move from a compromised system to other systems within the network?

Persistence
Privilege escalation
Lateral movement (Correct answer)
Exfiltration

Correct answer: Lateral movement

Lateral movement techniques allow attackers to progressively move through a network by exploiting trust relationships between systems.

Question 13: Which of the following BEST describes the purpose of an after-action report (AAR) following an incident?

To prosecute the attacker
To document findings and recommend improvements to the IR process (Correct answer)
To notify regulators of the breach
To restore systems from backup

Correct answer: To document findings and recommend improvements to the IR process

An after-action report captures what happened, what worked, what failed, and provides recommendations to improve future incident response.

Question 14: Which is a type of malware?

VPN
Firewall
Patch
Trojan (Correct answer)

Correct answer: Trojan

A Trojan, or Trojan horse, is a type of malware that disguises itself as legitimate software to trick users into installing it. Once inside a system, it can create backdoors, steal data, or launch other attacks without the user's knowledge. Trojans are dangerous because they appear harmless, making them difficult to detect until they execute their malicious payload.

Question 15: Which type of encryption uses the same key for both encryption and decryption and is generally faster than its counterpart?

Hashing
Steganography
Symmetric encryption (Correct answer)
Asymmetric encryption

Correct answer: Symmetric encryption

Symmetric encryption uses a single shared key for both operations and is computationally faster than asymmetric encryption.

Question 16: Which stakeholder engagement strategy is MOST effective for SY0-601 professionals?

Identify stakeholders early, understand their interests, and maintain regular communication (Correct answer)
Engage only when approval is needed
Inform stakeholders only after decisions are made
Limit engagement to senior leadership

Correct answer: Identify stakeholders early, understand their interests, and maintain regular communication

Early stakeholder identification with regular communication builds support and prevents surprises.

Question 17: A company is deploying a cloud workload and wants to ensure network microsegmentation between individual virtual machines. Which technology enables this?

Software-Defined Networking (SDN) with security groups (Correct answer)
Traditional VLANs
MAC address filtering
Physical firewalls between each VM

Correct answer: Software-Defined Networking (SDN) with security groups

SDN security groups apply policy-based rules at the virtual network interface level, enabling microsegmentation between individual cloud workloads.

Question 18: A penetration tester signs a legal agreement promising not to disclose the findings, network diagrams, or vulnerabilities discovered during an engagement to unauthorized parties. What document is this?

Memorandum of Understanding (MOU)
Service Level Agreement (SLA)
Business Associate Agreement (BAA)
Non-Disclosure Agreement (NDA) (Correct answer)

Correct answer: Non-Disclosure Agreement (NDA)

An NDA (Non-Disclosure Agreement) legally binds parties to maintain the confidentiality of sensitive information, commonly required before security assessments.

Question 19: Which foundational principle is MOST important for success in CompTIA Security+ IT Certification?

Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)
Maintaining minimum certification requirements
Specializing in only one narrow area
Maximizing financial returns

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Success requires continuous learning, ethical practice, and focus on quality outcomes.

Question 20: What are access control lists (ACLs)?

Password vaults
Encryption protocols
Traffic control rules (Correct answer)
User directories

Correct answer: Traffic control rules

Access Control Lists (ACLs) are sets of rules used to filter network traffic and control access to network resources. They specify which users or system processes are granted access to objects, as well as what operations are allowed on those objects. ACLs are crucial for enforcing security policies on routers, switches, and firewalls, determining whether packets should be forwarded or dropped based on criteria like source/destination IP addresses or port numbers.

Question 21: What is phishing?

Fraudulent email scam (Correct answer)
Data backup
Firewall breach
Computer virus

Correct answer: Fraudulent email scam

Phishing is a type of cyberattack where attackers attempt to trick individuals into revealing sensitive information, such as usernames, passwords, or credit card details. This is typically done by disguising themselves as a trustworthy entity in electronic communication, most commonly through fraudulent emails. The goal is to deceive the recipient into clicking malicious links or providing confidential data.

Question 22: When assessment results for a CompTIA Security+ IT Certification evaluation are inconclusive, the BEST practice is to:

Delay reporting until results are favorable
Discard the results and start over
Report the results as definitive anyway
Conduct additional assessment using alternative methods (Correct answer)

Correct answer: Conduct additional assessment using alternative methods

Inconclusive results require additional assessment using alternative methods for triangulation.

Question 23: During eradication, a responder discovers malware persistence via a scheduled task. What is the BEST next step?

Notify law enforcement
Reboot the server immediately
Delete the scheduled task and scan for additional persistence mechanisms (Correct answer)
Disable the network card

Correct answer: Delete the scheduled task and scan for additional persistence mechanisms

Removing the malicious scheduled task and then scanning for other persistence methods ensures the threat is fully eradicated before recovery begins.

Question 24: A hospital must implement safeguards to protect the privacy and security of patients' electronic medical records. Which U.S. regulation applies?

FERPA
COPPA
HIPAA (Correct answer)
GLBA

Correct answer: HIPAA

HIPAA (Health Insurance Portability and Accountability Act) requires healthcare entities to protect the privacy and security of Protected Health Information (PHI).

Question 25: Which compliance standard specifically governs the protection of payment card data and requires quarterly external vulnerability scans of cardholder data environments?

HIPAA
GLBA
SOX
PCI-DSS (Correct answer)

Correct answer: PCI-DSS

PCI-DSS (Payment Card Industry Data Security Standard) mandates security controls for cardholder data environments, including quarterly vulnerability scans.

Question 26: What is the MOST important leadership quality for a SY0-601 certified professional managing a team?

Maintaining strict control over all decisions
Achieving highest personal metrics
Avoiding all conflict
Demonstrating integrity, clear communication, and ability to develop team members (Correct answer)

Correct answer: Demonstrating integrity, clear communication, and ability to develop team members

Effective leadership requires integrity, clear communication, and developing team members.

Question 27: When hardening a new server, a technician should disable unnecessary services. Which principle does this practice reflect?

Reducing attack surface (Correct answer)
Least privilege
Defense in depth
Separation of duties

Correct answer: Reducing attack surface

Disabling unneeded services reduces the attack surface by eliminating potential entry points that attackers could exploit.

Question 28: Which term describes software that appears legitimate but contains hidden malicious functionality?

Spyware
Virus
Trojan horse (Correct answer)
Worm

Correct answer: Trojan horse

A Trojan horse disguises itself as legitimate software to trick users into installing it, then executes its malicious payload.

Question 29: A security team implements a system that automatically revokes and rotates credentials when anomalous API usage is detected. This is an example of which security architecture principle?

Manual incident response
Role-based access control
Automated response and orchestration (Correct answer)
Fail open

Correct answer: Automated response and orchestration

Automated response and orchestration (SOAR) reduces dwell time by triggering remediation actions such as credential rotation without human intervention.

Question 30: What is the first step in incident response?

Containment
Eradication
Identification (Correct answer)
Recovery

Correct answer: Identification

The first step in any incident response process is identification. This involves detecting a security incident, determining its nature, scope, and severity, and gathering initial information about the event. Without proper identification, an organization cannot effectively move to subsequent steps like containment, eradication, or recovery, as it wouldn't fully understand the problem at hand.

Question 31: An organization labels its most sensitive data as 'Confidential' and its public-facing data as 'Public.' What security concept is being applied?

Data sovereignty
Data masking
Data retention
Data classification (Correct answer)

Correct answer: Data classification

Data classification categorizes data based on its sensitivity level so that appropriate security controls can be applied.

Question 32: What is DMZ in network design?

Database layer
VPN zone
Isolated network zone (Correct answer)
Internal network

Correct answer: Isolated network zone

A DMZ (Demilitarized Zone) in network design is an isolated network zone that acts as a buffer between an organization's internal network and an untrusted external network, like the internet. It hosts public-facing services such as web servers or email servers, protecting the internal network from direct attacks. If a DMZ server is compromised, the attacker still cannot directly access the more sensitive internal systems.

Question 33: Which stakeholder engagement strategy is MOST effective for SY0-601 professionals?

Inform stakeholders only after decisions are made
Identify stakeholders early, understand their interests, and maintain regular communication (Correct answer)
Limit engagement to senior leadership
Engage only when approval is needed

Correct answer: Identify stakeholders early, understand their interests, and maintain regular communication

Early stakeholder identification with regular communication builds support and prevents surprises.

Question 34: What is a security information and event management (SIEM) system?

Disable firewalls
Encrypt data
Generate backups
Analyze security alerts (Correct answer)

Correct answer: Analyze security alerts

A Security Information and Event Management (SIEM) system collects, aggregates, and analyzes security-related data from various sources across an organization's IT infrastructure. Its primary function is to provide real-time analysis of security alerts generated by network devices, servers, and applications. This helps security teams detect, prioritize, and respond to potential security incidents more effectively by correlating events and identifying threats.

Question 35: What is log analysis?

Delete logs
Review logs (Correct answer)
Change settings
Ignore alerts

Correct answer: Review logs

Log analysis involves systematically reviewing and interpreting log data generated by systems, applications, and network devices. This process helps identify patterns, anomalies, and potential security incidents that might otherwise go unnoticed. By examining logs, security professionals can detect malicious activity, troubleshoot issues, and gain insights into system behavior, which is crucial for forensic investigations and proactive threat detection.

Question 36: Which function of the NIST Cybersecurity Framework focuses on developing organizational understanding of cybersecurity risks to systems, assets, and data?

Detect
Protect
Respond
Identify (Correct answer)

Correct answer: Identify

The NIST CSF 'Identify' function helps organizations understand their cybersecurity risk environment, including assets, data, and current governance practices.

Question 37: An attacker targets the CEO specifically with a highly sophisticated phishing email crafted to appear as a legitimate board communication. What is this attack called?

Whaling (Correct answer)
Spear phishing
Vishing
Business email compromise

Correct answer: Whaling

Whaling is a form of spear phishing specifically targeting high-profile executives (the 'big fish') within an organization.

Question 38: What is the MOST effective way for new SY0-601 professionals to build competency?

Focusing solely on advanced topics
Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Learning through trial and error
Studying certification materials exclusively

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building competency requires formal education, mentored practice, and ongoing development.

Question 39: What does vulnerability mean?

Access log
Update feature
Weakness in system (Correct answer)
System upgrade

Correct answer: Weakness in system

In cybersecurity, a vulnerability refers to a weakness or flaw in a system, application, or network that can be exploited by an attacker. These weaknesses could be in software code, configurations, or even human processes. Identifying and patching vulnerabilities is crucial to prevent unauthorized access, data breaches, and other security incidents.

Question 40: An analyst is reviewing logs and notices an internal host is connecting to a known C2 IP every five minutes. What stage of the kill chain does this BEST represent?

Command and Control (Correct answer)
Exploitation
Delivery
Reconnaissance

Correct answer: Command and Control

Regular beaconing to a known command-and-control server indicates the attacker is maintaining persistent communication with the compromised host.

Question 41: What is the PRIMARY purpose of a Security Information and Event Management (SIEM) system?

Block malware in real time
Aggregate and correlate log data from multiple sources for threat detection (Correct answer)
Encrypt data at rest
Replace firewalls with AI-driven filtering

Correct answer: Aggregate and correlate log data from multiple sources for threat detection

A SIEM collects, normalizes, and correlates log data from across the environment to detect suspicious patterns and generate alerts.

Question 42: A company uses Infrastructure as Code (IaC) to provision cloud resources. Which security practice should be integrated into the IaC pipeline to catch misconfigurations before deployment?

Static analysis / policy-as-code scanning of IaC templates (Correct answer)
Runtime CSPM monitoring after deployment
Penetration testing of deployed infrastructure
Manual peer code review of every template

Correct answer: Static analysis / policy-as-code scanning of IaC templates

Static IaC scanning (policy-as-code) analyzes templates before deployment to catch misconfigurations such as open S3 buckets or overly permissive IAM policies.

Question 43: What is the PRIMARY purpose of obtaining SY0-601 certification in CompTIA Security+ IT Certification?

To demonstrate verified competency and adherence to professional standards (Correct answer)
To bypass educational requirements
To guarantee employment
To satisfy a personal achievement goal

Correct answer: To demonstrate verified competency and adherence to professional standards

Certification demonstrates verified competency and adherence to professional standards.

Question 44: An organization wants to ensure that after a major incident, lessons are documented to prevent recurrence. Which phase covers this?

Post-Incident Activity (Lessons Learned) (Correct answer)
Containment
Eradication
Preparation

Correct answer: Post-Incident Activity (Lessons Learned)

Post-Incident Activity includes the lessons-learned meeting where teams review what happened and improve processes to prevent recurrence.

Question 45: How frequently should ongoing assessments be conducted in CompTIA Security+ IT Certification practice?

At regular intervals and as conditions change (Correct answer)
Only when problems are reported
Only when required by external auditors
Once annually regardless of circumstances

Correct answer: At regular intervals and as conditions change

Ongoing assessments should follow established protocols and also respond to changing conditions.

Question 46: Which international standard specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS)?

COBIT 2019
NIST SP 800-53
ISO/IEC 27001 (Correct answer)
SOC 2

Correct answer: ISO/IEC 27001

ISO/IEC 27001 is the globally recognized standard that defines requirements for an ISMS, providing a systematic approach to managing sensitive information.

Question 47: What is a DDoS attack?

Password cracking
Flooding service with traffic (Correct answer)
Traffic routing
Data encryption

Correct answer: Flooding service with traffic

A Distributed Denial of Service (DDoS) attack aims to make an online service unavailable by overwhelming it with a flood of traffic from multiple compromised computer systems. This excessive traffic consumes the target's resources, preventing legitimate users from accessing the service. The goal is to disrupt operations and cause service outages.

Question 48: A forensic investigator receives a hard drive image. Which hashing algorithm should be used to verify the image's integrity matches the original?

DES
RSA-2048
MD5 or SHA-256 (Correct answer)
AES-256

Correct answer: MD5 or SHA-256

Hashing the original and the image with MD5 or SHA-256 and comparing the values confirms the image is an exact, unaltered copy.

Question 49: A risk manager assigns risk levels using descriptive ratings such as 'Low,' 'Medium,' and 'High' rather than calculating specific dollar amounts. Which type of risk analysis is being performed?

Qualitative risk analysis (Correct answer)
Quantitative risk analysis
Inherent risk analysis
Residual risk analysis

Correct answer: Qualitative risk analysis

Qualitative risk analysis uses descriptive, subjective ratings (e.g., Low/Medium/High) rather than exact numerical or monetary values to assess risk.

Question 50: An organization wants to implement data loss prevention (DLP) that scans files leaving the network via email. At which layer of security controls does this primarily operate?

Endpoint physical lockdown
Physical security controls
Network-based DLP at the email gateway (Correct answer)
Perimeter patching

Correct answer: Network-based DLP at the email gateway

Network-based DLP solutions inspect data in transit at the email gateway to detect and block unauthorized transmission of sensitive information.

Question 51: When documenting assessment findings in SY0-601 practice, which approach is MOST appropriate?

Use jargon only experts understand
Summarize verbally without written documentation
Include only positive findings
Record objective findings, measurements, and observations factually (Correct answer)

Correct answer: Record objective findings, measurements, and observations factually

Assessment documentation must be objective, factual, and comprehensive.

Question 52: A security engineer is evaluating a third-party vendor's API integration. The vendor authenticates using a long-lived shared secret embedded in each request header. Which improvement should the engineer recommend?

Encode the shared secret in Base64 before transmission
Use HTTP Basic Auth over HTTPS instead
Store the shared secret in a cookie with the HttpOnly flag
Switch to OAuth 2.0 with short-lived access tokens (Correct answer)

Correct answer: Switch to OAuth 2.0 with short-lived access tokens

OAuth 2.0 with short-lived access tokens limits the window of exposure if a token is compromised and eliminates the need to share long-lived static secrets.

Question 53: Which key exchange algorithm allows two parties to establish a shared secret over an insecure channel without transmitting the secret itself?

MD5 hashing
Diffie-Hellman (DH) (Correct answer)
AES key wrapping
RSA key exchange

Correct answer: Diffie-Hellman (DH)

Diffie-Hellman allows two parties to independently compute the same shared secret using public values exchanged over an insecure channel.

Question 54: A procurement team reviews a cloud vendor's SOC 2 Type II report before signing a contract. What type of assessment does this represent?

Penetration test
Internal risk assessment
Third-party audit (Correct answer)
Vulnerability scan

Correct answer: Third-party audit

A SOC 2 Type II report is produced by an independent third-party auditor, making its review part of third-party risk and audit evaluation.

Question 55: A newly released software patch notes that a vulnerability was being exploited before the vendor was aware of it. What category does this vulnerability fall under?

Known exploit
Legacy vulnerability
Zero-day vulnerability (Correct answer)
Disclosed vulnerability

Correct answer: Zero-day vulnerability

A zero-day vulnerability is one that is exploited before the vendor knows about it, leaving zero days to develop a fix.

Question 56: Which document defines the roles, responsibilities, and procedures that an organization follows when a security incident occurs?

Business Continuity Plan
Disaster Recovery Plan
Incident Response Plan (Correct answer)
Change Management Policy

Correct answer: Incident Response Plan

An Incident Response Plan (IRP) outlines who does what and how when a security incident is detected and handled.

Question 57: What is the PRIMARY benefit of data-driven decision making in CompTIA Security+ IT Certification?

It provides objective evidence to support decisions, reduce bias, and track outcomes (Correct answer)
It guarantees positive results
It eliminates need for professional judgment
It simplifies decisions to one approach

Correct answer: It provides objective evidence to support decisions, reduce bias, and track outcomes

Data-driven decisions provide objective evidence that reduces bias and enables outcome tracking.

Question 58: A security engineer is configuring a site-to-site VPN between two offices. Which protocol operates at Layer 3 and provides both authentication and encryption in tunnel mode?

L2TP
IPSec (Correct answer)
SSL/TLS
PPTP

Correct answer: IPSec

IPSec operates at Layer 3 and in tunnel mode provides authentication and encryption for the entire original IP packet.

Question 59: An organization's policy requires all email records to be stored for 7 years to satisfy legal and regulatory requirements. In which type of policy is this defined?

Acceptable Use Policy
Data Retention Policy (Correct answer)
Change Management Policy
Incident Response Policy

Correct answer: Data Retention Policy

A data retention policy specifies how long different categories of data must be stored and the procedures for their eventual secure disposal.

Question 60: A multinational company is legally required to store all European customers' data on servers physically located within the European Union. This requirement reflects which concept?

Data minimization
Data classification
Data masking
Data sovereignty (Correct answer)

Correct answer: Data sovereignty

Data sovereignty means that data is subject to the laws and governance of the nation where it physically resides, often dictating where data must be stored.

Question 61: A company purchases cyber insurance to offset potential financial losses from a data breach. Which risk response strategy does this represent?

Risk transfer (Correct answer)
Risk acceptance
Risk avoidance
Risk mitigation

Correct answer: Risk transfer

Risk transfer shifts the financial burden of a risk to a third party, such as through purchasing cyber insurance.

Question 62: A threat actor uses a fraudulent website that looks identical to a bank's login page to steal credentials. Which attack technique is being used?

Vishing
Phishing (Correct answer)
Typosquatting
Pharming

Correct answer: Phishing

Phishing uses deceptive websites or communications mimicking legitimate entities to harvest user credentials.

Question 63: Which log source would BEST help identify a successful privilege escalation on a Windows system?

Windows Security Event Logs (Event ID 4672) (Correct answer)
DHCP lease logs
DNS query logs
Web server access logs

Correct answer: Windows Security Event Logs (Event ID 4672)

Windows Security Event ID 4672 (Special Logon) is generated when a user logs on with administrative or sensitive privileges, indicating privilege escalation.

Question 64: What is spyware?

Gathers info secretly (Correct answer)
Encrypts data
Speeds up PC
Blocks spam

Correct answer: Gathers info secretly

Spyware is a type of malicious software designed to secretly gather information about a user's activities without their knowledge or consent. This can include monitoring keystrokes, capturing screenshots, tracking browsing history, or collecting personal data. Its primary purpose is to covertly transmit this collected information to an unauthorized third party, often for advertising or malicious purposes.

Question 65: A security architect recommends using an SDK that automatically enforces HTTPS, parameterized queries, and input sanitization for all new applications. This approach best exemplifies which principle?

Fail open design
Defense in depth
Security by obscurity
Secure by default (Correct answer)

Correct answer: Secure by default

Secure by default means that security controls are enabled out of the box, so developers must actively choose to weaken them rather than actively choose to enable them.

Question 66: Which wireless security protocol uses Simultaneous Authentication of Equals (SAE) to replace the Pre-Shared Key handshake and prevent offline dictionary attacks?

WEP
WPA3-Personal (Correct answer)
WPA2-Enterprise
WPA2-Personal

Correct answer: WPA3-Personal

WPA3-Personal uses SAE (also called Dragonfly handshake) which prevents offline dictionary attacks against captured handshakes.

Question 67: A healthcare organization must store patient records for 7 years per HIPAA requirements. Which architectural component should be designed to enforce this retention policy automatically?

Data lifecycle management / object lock (Correct answer)
DLP gateway
Backup rotation schedule
SIEM log retention policy

Correct answer: Data lifecycle management / object lock

Data lifecycle management with object lock (WORM) enforces retention policies automatically, preventing records from being deleted before the mandated retention period expires.

Question 68: Which firewall type can inspect the full HTTP request and response content, including payload, to block application-layer attacks like XSS and SQL injection?

Stateful inspection firewall
Packet filtering firewall
Web Application Firewall (WAF) (Correct answer)
Circuit-level gateway

Correct answer: Web Application Firewall (WAF)

A WAF operates at Layer 7 and inspects HTTP/HTTPS content to detect and block application-layer attacks targeting web applications.

Question 69: An organization requires that no single administrator can both create a privileged account AND approve access for that account. Which security principle does this implement?

Need to know
Least privilege
Separation of duties (Correct answer)
Job rotation

Correct answer: Separation of duties

Separation of duties divides critical tasks between multiple individuals so that no single person can commit fraud or error without collusion.

Question 70: Which authentication protocol sends credentials in plaintext and should be replaced in favor of more secure alternatives in enterprise environments?

NTLM v2
PAP (Correct answer)
CHAP
Kerberos

Correct answer: PAP

PAP (Password Authentication Protocol) transmits credentials in cleartext and is considered insecure for modern enterprise authentication.

Question 71: Which data security technique replaces sensitive data elements with non-sensitive placeholders that retain the format but have no exploitable value outside the specific system?

Tokenization (Correct answer)
Hashing
Encryption
Data masking

Correct answer: Tokenization

Tokenization substitutes sensitive data (e.g., a credit card number) with a token that is meaningless outside the tokenization system, reducing PCI DSS scope.

Question 72: How does the SY0-601 body of knowledge relate to daily professional practice?

It provides the foundational framework guiding decision-making and standard practices (Correct answer)
It is theoretical with limited application
It is only for academic research
It only applies during exams

Correct answer: It provides the foundational framework guiding decision-making and standard practices

The body of knowledge provides the framework guiding daily decision-making and practices.

Question 73: Why conduct root cause analysis?

Find source of issue (Correct answer)
Change password
Update software
Blame staff

Correct answer: Find source of issue

Root cause analysis (RCA) is a systematic process for identifying the underlying causes of a problem or incident, rather than just addressing its symptoms. In cybersecurity, RCA helps determine why a security incident occurred, what vulnerabilities were exploited, and what processes failed. By understanding the true source of an issue, organizations can implement effective preventative measures to avoid recurrence and strengthen their defenses.

Question 74: A developer stores secrets such as API keys and database passwords directly in application configuration files checked into source control. Which secure design practice should be enforced instead?

Restrict repository access to senior developers only
Encrypt the configuration files with AES-256
Use environment variables or a secrets management vault (Correct answer)
Hash all secrets before storing them in config files

Correct answer: Use environment variables or a secrets management vault

Secrets should be stored in a dedicated secrets manager or injected via environment variables, never hardcoded in source-controlled files.

Question 75: What is least privilege?

Minimum necessary access (Correct answer)
No access
Admin rights
Full access

Correct answer: Minimum necessary access

Least privilege is a fundamental security principle dictating that users, programs, or processes should be granted only the absolute minimum level of access or permissions required to perform their legitimate tasks. This approach significantly reduces the potential impact if an account or system is compromised, limiting what an attacker can do. By restricting unnecessary access, the overall security posture of a system is greatly enhanced.

Question 76: An admin needs to securely manage network devices from a remote location. Which protocol should replace Telnet to ensure encrypted management sessions?

FTP
SSH (Correct answer)
SNMP v1
HTTP

Correct answer: SSH

SSH (Secure Shell) encrypts the entire management session including credentials, replacing the plaintext Telnet protocol.

Question 77: Which vulnerability scanning result indicates a flaw is reported but does not actually exist in the target system?

True negative
True positive
False positive (Correct answer)
False negative

Correct answer: False positive

A false positive occurs when a scanner reports a vulnerability that is not actually present, wasting remediation effort.

Question 78: An attacker sends a specially crafted URL to a victim that, when clicked, causes the victim's browser to execute malicious scripts on a trusted website. What type of attack is this?

Cross-site scripting (XSS) (Correct answer)
Command injection
Cross-site request forgery (CSRF)
SQL injection

Correct answer: Cross-site scripting (XSS)

Reflected XSS attacks embed malicious scripts in URLs that execute in the victim's browser in the context of a trusted site.

Question 79: A network architect is designing a campus with multiple buildings. To prevent a broadcast storm in one building from affecting others, which design technique should be used?

Spanning tree protocol (STP) tuning
VLAN segmentation per building (Correct answer)
Static routing between buildings
MAC address filtering

Correct answer: VLAN segmentation per building

VLANs logically isolate broadcast domains so that a storm or failure in one VLAN does not propagate to VLANs in other buildings.

Question 80: Which type of attack sends forged ARP messages to associate the attacker's MAC address with the IP address of a legitimate host?

IP spoofing
MAC flooding
ARP spoofing (Correct answer)
DNS poisoning

Correct answer: ARP spoofing

ARP spoofing (poisoning) links the attacker's MAC address to a legitimate IP, redirecting LAN traffic through the attacker.

Question 81: What is malware?

Authentication tool
Encryption app
Firewall
Malicious software (Correct answer)

Correct answer: Malicious software

Malware is an umbrella term for 'malicious software' designed to disrupt, damage, or gain unauthorized access to a computer system. It encompasses various types of threats, including viruses, worms, Trojans, and ransomware. Malware can steal data, encrypt files, or simply make a system unusable, posing significant security risks.

Question 82: Which social engineering technique involves creating a fabricated scenario to manipulate a victim into providing information or access?

Tailgating
Quid pro quo
Baiting
Pretexting (Correct answer)

Correct answer: Pretexting

Pretexting involves fabricating a believable scenario (pretext) to gain the victim's trust and extract sensitive information.

Question 83: What is the recovery phase?

Shut down servers
Isolate users
Restore systems (Correct answer)
Ignore alerts

Correct answer: Restore systems

The recovery phase in incident response focuses on restoring affected systems and services to their normal operational state after an incident has been contained and eradicated. This typically involves restoring data from backups, rebuilding compromised systems, and verifying that all vulnerabilities have been patched. The goal is to bring the business back to full functionality securely and efficiently, minimizing long-term disruption.

Question 84: Which threat actor type is typically motivated by financial gain and operates as a professional criminal organization?

Hacktivist
Organized crime (Correct answer)
Script kiddie
Nation-state actor

Correct answer: Organized crime

Organized crime groups are primarily financially motivated, conducting activities like ransomware campaigns and fraud for profit.

Question 85: Why use secure baseline configuration?

Better UI
Consistency and security (Correct answer)
Faster updates
More bandwidth

Correct answer: Consistency and security

Using a secure baseline configuration ensures consistency and security across all systems within an organization. It establishes a minimum security standard, defining secure settings, installed software, and disabled services. This practice reduces the attack surface, minimizes misconfigurations, and ensures that all systems adhere to a known, secure state, making them less vulnerable to threats.

Question 86: An attacker registers a domain name with a common typo of a popular website (e.g., 'googie.com') to capture accidental visitors. What is this called?

Domain hijacking
Pharming
URL hijacking / typosquatting (Correct answer)
DNS spoofing

Correct answer: URL hijacking / typosquatting

Typosquatting (URL hijacking) registers misspelled versions of popular domains to capture traffic from users who mistype URLs.

Question 87: Which attack involves flooding a target system with traffic from multiple compromised hosts to make a service unavailable?

Distributed denial-of-service (DDoS) (Correct answer)
Smurf attack
Ping of death
Teardrop attack

Correct answer: Distributed denial-of-service (DDoS)

A DDoS attack uses a botnet of many compromised systems to overwhelm a target with traffic, denying service to legitimate users.

Question 88: How does the SY0-601 body of knowledge relate to daily professional practice?

It is theoretical with limited application
It is only for academic research
It only applies during exams
It provides the foundational framework guiding decision-making and standard practices (Correct answer)

Correct answer: It provides the foundational framework guiding decision-making and standard practices

The body of knowledge provides the framework guiding daily decision-making and practices.

Question 89: A security team wants to implement a solution that decrypts and inspects encrypted HTTPS traffic at the network perimeter. Which approach is being used?

MAC filtering
Port mirroring for all traffic
Deep packet inspection of unencrypted headers only
SSL/TLS inspection (SSL decryption proxy) (Correct answer)

Correct answer: SSL/TLS inspection (SSL decryption proxy)

SSL/TLS inspection uses a proxy that terminates the encrypted connection, inspects the plaintext, then re-encrypts it toward the destination.

Question 90: How does the SY0-601 body of knowledge relate to daily professional practice?

It is theoretical with limited application
It only applies during exams
It provides the foundational framework guiding decision-making and standard practices (Correct answer)
It is only for academic research

Correct answer: It provides the foundational framework guiding decision-making and standard practices

The body of knowledge provides the framework guiding daily decision-making and practices.

Question 91: Which is an example of insider threat?

Email phishing
Malware infection
Employee data theft (Correct answer)
Firewall misconfig

Correct answer: Employee data theft

An insider threat refers to a security risk that originates from within an organization, often from current or former employees, contractors, or business partners. Employee data theft is a prime example, where an individual with authorized access misuses their privileges to steal sensitive information. These threats are particularly challenging to detect and mitigate due to the trusted nature of the perpetrator.

CompTIA Security+ (SY0-601) Certification Exam

This certification validates the baseline skills necessary to perform core security functions and pursue an IT security career, covering threat management, risk management, and security architecture.

Questions

90 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds