CompTIA Security+ (SY0-601) Certification Exam — Questions and Answers

Question 1: What is the MOST effective way for new SY0-601 professionals to build competency?

Learning through trial and error
Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Focusing solely on advanced topics
Studying certification materials exclusively

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building competency requires formal education, mentored practice, and ongoing development.

Question 2: Which regulation requires organizations processing EU citizens' personal data to notify authorities of a breach within 72 hours and obtain explicit consent before collection?

PCI-DSS
SOX
HIPAA
GDPR (Correct answer)

Correct answer: GDPR

GDPR (General Data Protection Regulation) mandates 72-hour breach notification and explicit consent for processing EU citizens' personal data.

Question 3: What is least privilege?

No access
Minimum necessary access (Correct answer)
Full access
Admin rights

Correct answer: Minimum necessary access

Least privilege is a fundamental security principle dictating that users, programs, or processes should be granted only the absolute minimum level of access or permissions required to perform their legitimate tasks. This approach significantly reduces the potential impact if an account or system is compromised, limiting what an attacker can do. By restricting unnecessary access, the overall security posture of a system is greatly enhanced.

Question 4: What is ransomware?

Data locked for ransom (Correct answer)
Data backup
Free antivirus
System update

Correct answer: Data locked for ransom

Ransomware is a type of malicious software that encrypts a victim's files, rendering them inaccessible. The attacker then demands a ransom payment, typically in cryptocurrency, in exchange for the decryption key. If the ransom is not paid, the data may remain encrypted or be permanently lost, making it a highly disruptive form of cyberattack.

Question 5: Which foundational principle is MOST important for success in CompTIA Security+ IT Certification?

Maintaining minimum certification requirements
Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)
Maximizing financial returns
Specializing in only one narrow area

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Success requires continuous learning, ethical practice, and focus on quality outcomes.

Question 6: Which assessment method provides the MOST reliable data for SY0-601 professionals making critical decisions?

Single-source data from one stakeholder
Informal verbal feedback alone
Standardized tools combined with professional observation (Correct answer)
Social media reviews

Correct answer: Standardized tools combined with professional observation

Combining standardized tools with professional observation provides the most comprehensive data.

Question 7: How should a SY0-601 professional manager address underperformance?

Address publicly in team meetings
Ignore it until formal reviews
Provide timely, specific feedback with support and a clear improvement plan (Correct answer)
Immediately reassign the individual

Correct answer: Provide timely, specific feedback with support and a clear improvement plan

Timely, specific feedback with support gives individuals a fair opportunity to improve.

Question 8: Which software development concept involves running an application with only the permissions it needs to perform its function and no more?

Principle of least privilege (Correct answer)
Code signing
Secure defaults
Input validation

Correct answer: Principle of least privilege

The principle of least privilege limits an application's permissions to the minimum required, reducing the blast radius if the application is compromised.

Question 9: How does the SY0-601 body of knowledge relate to daily professional practice?

It only applies during exams
It is only for academic research
It provides the foundational framework guiding decision-making and standard practices (Correct answer)
It is theoretical with limited application

Correct answer: It provides the foundational framework guiding decision-making and standard practices

The body of knowledge provides the framework guiding daily decision-making and practices.

Question 10: What is the main goal of social engineering?

Change system settings
Fix bugs
Trick people for data (Correct answer)
Install patches

Correct answer: Trick people for data

The main goal of social engineering is to trick people into divulging confidential information or performing actions that compromise security. Unlike technical attacks, social engineering exploits human psychology, such as trust, fear, or curiosity, rather than system vulnerabilities. Attackers manipulate individuals to gain unauthorized access to systems or data.

Question 11: A security team implements a system that automatically revokes and rotates credentials when anomalous API usage is detected. This is an example of which security architecture principle?

Fail open
Role-based access control
Manual incident response
Automated response and orchestration (Correct answer)

Correct answer: Automated response and orchestration

Automated response and orchestration (SOAR) reduces dwell time by triggering remediation actions such as credential rotation without human intervention.

Question 12: Which statement BEST describes the relationship between CompTIA Security+ IT Certification certification and industry evolution?

Requirements evolve periodically to reflect advances in knowledge and practice (Correct answer)
Changes only occur when government mandates them
Requirements become less stringent over time
Certification requirements never change

Correct answer: Requirements evolve periodically to reflect advances in knowledge and practice

Certification requirements evolve to keep pace with professional and technological advances.

Question 13: A security engineer is evaluating a third-party vendor's API integration. The vendor authenticates using a long-lived shared secret embedded in each request header. Which improvement should the engineer recommend?

Store the shared secret in a cookie with the HttpOnly flag
Switch to OAuth 2.0 with short-lived access tokens (Correct answer)
Encode the shared secret in Base64 before transmission
Use HTTP Basic Auth over HTTPS instead

Correct answer: Switch to OAuth 2.0 with short-lived access tokens

OAuth 2.0 with short-lived access tokens limits the window of exposure if a token is compromised and eliminates the need to share long-lived static secrets.

Question 14: During a threat model, the team identifies that an attacker could intercept communications between internal microservices. Which control directly mitigates this east-west traffic threat?

Mutual TLS (mTLS) between all microservices (Correct answer)
Perimeter TLS termination at the load balancer
HTTPS only for external-facing APIs
Network-level IDS signatures

Correct answer: Mutual TLS (mTLS) between all microservices

Mutual TLS (mTLS) ensures that both the client and server microservices authenticate each other and encrypt the channel, protecting east-west traffic from interception or spoofing.

Question 15: Which foundational principle is MOST important for success in CompTIA Security+ IT Certification?

Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)
Specializing in only one narrow area
Maximizing financial returns
Maintaining minimum certification requirements

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Success requires continuous learning, ethical practice, and focus on quality outcomes.

Question 16: What is the goal of network hardening?

Reduce vulnerabilities (Correct answer)
Speed up devices
Optimize bandwidth
Create backups

Correct answer: Reduce vulnerabilities

Network hardening is the process of securing a network by reducing its attack surface and eliminating potential vulnerabilities. This involves implementing various security measures, such as disabling unnecessary services, applying security patches, configuring strong authentication, and segmenting networks. The ultimate goal is to make the network more resilient against cyber threats and unauthorized access, thereby enhancing its overall security posture.

Question 17: A healthcare organization must store patient records for 7 years per HIPAA requirements. Which architectural component should be designed to enforce this retention policy automatically?

DLP gateway
SIEM log retention policy
Backup rotation schedule
Data lifecycle management / object lock (Correct answer)

Correct answer: Data lifecycle management / object lock

Data lifecycle management with object lock (WORM) enforces retention policies automatically, preventing records from being deleted before the mandated retention period expires.

Question 18: What is segmentation?

Network separation (Correct answer)
Block IPs
Password change
Join networks

Correct answer: Network separation

Segmentation in network design involves dividing a computer network into smaller, isolated subnetworks or segments. This separation helps to contain security breaches by limiting the lateral movement of attackers within the network. If one segment is compromised, the damage is confined, preventing the entire network from being affected and enhancing overall security.

Question 19: A developer stores secrets such as API keys and database passwords directly in application configuration files checked into source control. Which secure design practice should be enforced instead?

Encrypt the configuration files with AES-256
Restrict repository access to senior developers only
Use environment variables or a secrets management vault (Correct answer)
Hash all secrets before storing them in config files

Correct answer: Use environment variables or a secrets management vault

Secrets should be stored in a dedicated secrets manager or injected via environment variables, never hardcoded in source-controlled files.

Question 20: What is a DDoS attack?

Flooding service with traffic (Correct answer)
Data encryption
Password cracking
Traffic routing

Correct answer: Flooding service with traffic

A Distributed Denial of Service (DDoS) attack aims to make an online service unavailable by overwhelming it with a flood of traffic from multiple compromised computer systems. This excessive traffic consumes the target's resources, preventing legitimate users from accessing the service. The goal is to disrupt operations and cause service outages.

Question 21: Which statement BEST describes the relationship between CompTIA Security+ IT Certification certification and industry evolution?

Changes only occur when government mandates them
Certification requirements never change
Requirements evolve periodically to reflect advances in knowledge and practice (Correct answer)
Requirements become less stringent over time

Correct answer: Requirements evolve periodically to reflect advances in knowledge and practice

Certification requirements evolve to keep pace with professional and technological advances.

Question 22: When assessment results for a CompTIA Security+ IT Certification evaluation are inconclusive, the BEST practice is to:

Report the results as definitive anyway
Delay reporting until results are favorable
Conduct additional assessment using alternative methods (Correct answer)
Discard the results and start over

Correct answer: Conduct additional assessment using alternative methods

Inconclusive results require additional assessment using alternative methods for triangulation.

Question 23: Why test an incident response plan?

Skip response
Ensure effectiveness (Correct answer)
Avoid panic
Reduce cost

Correct answer: Ensure effectiveness

Testing an incident response plan is crucial to ensure its effectiveness and identify any weaknesses or gaps before a real incident occurs. Regular drills and simulations help the incident response team practice their roles, refine procedures, and improve coordination. This preparedness ensures that when an actual incident happens, the team can respond quickly and efficiently, minimizing damage and recovery time.

Question 24: What distinguishes a CompTIA Security+ IT Certification certified professional from a non-certified practitioner?

There is no meaningful difference
Certified professionals always have more experience
Certification validates competency through standardized assessment against benchmarks (Correct answer)
Certified professionals only work in larger organizations

Correct answer: Certification validates competency through standardized assessment against benchmarks

Certification provides objective validation of competency through standardized assessment.

Question 25: What is containment in incident response?

Reboot systems
Change passwords
Limit damage (Correct answer)
Erase logs

Correct answer: Limit damage

Containment is a critical phase in incident response that focuses on limiting the scope and impact of a security incident. This involves taking immediate actions to stop the spread of the attack, such as isolating affected systems, disconnecting networks, or blocking malicious IP addresses. The goal is to prevent further damage and minimize the overall harm to the organization's assets and operations, allowing for controlled remediation.

Question 26: What is the PRIMARY purpose of obtaining SY0-601 certification in CompTIA Security+ IT Certification?

To demonstrate verified competency and adherence to professional standards (Correct answer)
To bypass educational requirements
To satisfy a personal achievement goal
To guarantee employment

Correct answer: To demonstrate verified competency and adherence to professional standards

Certification demonstrates verified competency and adherence to professional standards.

Question 27: What is port security?

Disable internet
Restrict MAC address access (Correct answer)
Encrypt traffic
Boost port speed

Correct answer: Restrict MAC address access

Port security is a Layer 2 security feature on network switches that restricts which devices can connect to a specific switch port. It typically works by limiting the number of MAC addresses that can be learned on a port and can be configured to allow only specific MAC addresses. This prevents unauthorized devices from connecting to the network by plugging into an available port, thereby enhancing physical and network access control.

Question 28: What is the first step in incident response?

Eradication
Containment
Recovery
Identification (Correct answer)

Correct answer: Identification

The first step in any incident response process is identification. This involves detecting a security incident, determining its nature, scope, and severity, and gathering initial information about the event. Without proper identification, an organization cannot effectively move to subsequent steps like containment, eradication, or recovery, as it wouldn't fully understand the problem at hand.

Question 29: What is the PRIMARY purpose of obtaining SY0-601 certification in CompTIA Security+ IT Certification?

To guarantee employment
To satisfy a personal achievement goal
To demonstrate verified competency and adherence to professional standards (Correct answer)
To bypass educational requirements

Correct answer: To demonstrate verified competency and adherence to professional standards

Certification demonstrates verified competency and adherence to professional standards.

Question 30: How frequently should ongoing assessments be conducted in CompTIA Security+ IT Certification practice?

At regular intervals and as conditions change (Correct answer)
Once annually regardless of circumstances
Only when problems are reported
Only when required by external auditors

Correct answer: At regular intervals and as conditions change

Ongoing assessments should follow established protocols and also respond to changing conditions.

Question 31: An organization labels its most sensitive data as 'Confidential' and its public-facing data as 'Public.' What security concept is being applied?

Data sovereignty
Data retention
Data masking
Data classification (Correct answer)

Correct answer: Data classification

Data classification categorizes data based on its sensitivity level so that appropriate security controls can be applied.

Question 32: Why is documentation important in IR?

Avoid delays
Track actions and improve (Correct answer)
Share passwords
Delete evidence

Correct answer: Track actions and improve

Documentation is vital throughout the incident response process. It provides a detailed record of all actions taken, observations made, and decisions reached during an incident. This documentation is crucial for post-incident analysis, helping to identify lessons learned, improve future response plans, and potentially serve as legal evidence. It ensures accountability and continuous improvement of security operations.

Question 33: How frequently should ongoing assessments be conducted in CompTIA Security+ IT Certification practice?

At regular intervals and as conditions change (Correct answer)
Once annually regardless of circumstances
Only when problems are reported
Only when required by external auditors

Correct answer: At regular intervals and as conditions change

Ongoing assessments should follow established protocols and also respond to changing conditions.

Question 34: When planning a project in CompTIA Security+ IT Certification, which element should be established FIRST?

Clear objectives, scope, and success criteria (Correct answer)
Team member assignments
Budget allocation
Project timeline

Correct answer: Clear objectives, scope, and success criteria

Clear objectives and success criteria form the foundation for all other planning decisions.

Question 35: What is the BEST strategy for resource allocation in CompTIA Security+ IT Certification management?

Match resources to priorities based on needs, risks, and strategic goals (Correct answer)
Focus resources only on largest tasks
Keep significant reserves without deployment
Allocate all resources equally

Correct answer: Match resources to priorities based on needs, risks, and strategic goals

Effective resource allocation matches resources to priorities based on assessment of needs.

Question 36: An enterprise CISO wants to ensure that cloud-hosted workloads adhere to security baselines continuously, not just at deployment time. Which tool category addresses this requirement?

Security Information and Event Management (SIEM)
Cloud Security Posture Management (CSPM) (Correct answer)
Cloud Access Security Broker (CASB)
Web Application Firewall (WAF)

Correct answer: Cloud Security Posture Management (CSPM)

CSPM tools continuously monitor cloud environments for configuration drift and compliance violations against defined security baselines.

Question 37: Which function of the NIST Cybersecurity Framework focuses on developing organizational understanding of cybersecurity risks to systems, assets, and data?

Detect
Identify (Correct answer)
Protect
Respond

Correct answer: Identify

The NIST CSF 'Identify' function helps organizations understand their cybersecurity risk environment, including assets, data, and current governance practices.

Question 38: Why use secure baseline configuration?

Faster updates
More bandwidth
Better UI
Consistency and security (Correct answer)

Correct answer: Consistency and security

Using a secure baseline configuration ensures consistency and security across all systems within an organization. It establishes a minimum security standard, defining secure settings, installed software, and disabled services. This practice reduces the attack surface, minimizes misconfigurations, and ensures that all systems adhere to a known, secure state, making them less vulnerable to threats.

Question 39: Which secure network architecture concept places resources that must be publicly accessible in an isolated zone separate from the internal network?

DMZ (Demilitarized Zone) (Correct answer)
Zero trust overlay
Air gap
VLAN hopping prevention

Correct answer: DMZ (Demilitarized Zone)

A DMZ is a buffer zone between the internet and the internal network where public-facing servers are isolated so that a compromise does not directly expose internal systems.

Question 40: What is malware?

Encryption app
Malicious software (Correct answer)
Firewall
Authentication tool

Correct answer: Malicious software

Malware is an umbrella term for 'malicious software' designed to disrupt, damage, or gain unauthorized access to a computer system. It encompasses various types of threats, including viruses, worms, Trojans, and ransomware. Malware can steal data, encrypt files, or simply make a system unusable, posing significant security risks.

Question 41: Which security policy document defines the rules employees must follow when using company-owned computers, networks, and internet access?

Clean Desk Policy
Data Retention Policy
Non-Disclosure Agreement (NDA)
Acceptable Use Policy (AUP) (Correct answer)

Correct answer: Acceptable Use Policy (AUP)

An Acceptable Use Policy (AUP) outlines permitted and prohibited uses of organizational IT resources to govern employee behavior.

Question 42: What is phishing?

Fraudulent email scam (Correct answer)
Firewall breach
Computer virus
Data backup

Correct answer: Fraudulent email scam

Phishing is a type of cyberattack where attackers attempt to trick individuals into revealing sensitive information, such as usernames, passwords, or credit card details. This is typically done by disguising themselves as a trustworthy entity in electronic communication, most commonly through fraudulent emails. The goal is to deceive the recipient into clicking malicious links or providing confidential data.

Question 43: A company needs employees to prove their identity using something they know, something they have, and something they are before accessing sensitive systems. This is an example of:

Federated identity
Role-based access control (RBAC)
Single sign-on (SSO)
Multi-factor authentication (MFA) (Correct answer)

Correct answer: Multi-factor authentication (MFA)

MFA combines multiple authentication factors—knowledge, possession, and inherence—to significantly reduce the risk of unauthorized access.

Question 44: What is the MOST important factor when selecting assessment tools for SY0-601 certification work?

How quickly the tool can be administered
The cost of the assessment tool
Personal familiarity with the tool
Validity, reliability, and appropriateness for the specific context (Correct answer)

Correct answer: Validity, reliability, and appropriateness for the specific context

Assessment tools must be valid, reliable, and appropriate for the specific context.

Question 45: When planning a project in CompTIA Security+ IT Certification, which element should be established FIRST?

Team member assignments
Project timeline
Clear objectives, scope, and success criteria (Correct answer)
Budget allocation

Correct answer: Clear objectives, scope, and success criteria

Clear objectives and success criteria form the foundation for all other planning decisions.

Question 46: What is a secure protocol for file transfer?

Telnet
FTP
SMTP
SFTP (Correct answer)

Correct answer: SFTP

SFTP (SSH File Transfer Protocol) is a secure protocol for transferring files over an encrypted SSH (Secure Shell) connection. Unlike FTP, which sends data in plaintext, SFTP encrypts both the data and the authentication information, protecting them from eavesdropping and tampering. This makes SFTP a much safer choice for transferring sensitive files over a network, ensuring confidentiality and integrity.

Question 47: In CompTIA Security+ IT Certification, what is the PRIMARY purpose of conducting an initial assessment?

To generate documentation for billing
To fulfill administrative requirements
To establish a baseline and identify needs for appropriate action (Correct answer)
To demonstrate the assessor's expertise

Correct answer: To establish a baseline and identify needs for appropriate action

The initial assessment establishes a baseline and identifies specific needs to guide subsequent decisions.

Question 48: When assessment results for a CompTIA Security+ IT Certification evaluation are inconclusive, the BEST practice is to:

Report the results as definitive anyway
Delay reporting until results are favorable
Discard the results and start over
Conduct additional assessment using alternative methods (Correct answer)

Correct answer: Conduct additional assessment using alternative methods

Inconclusive results require additional assessment using alternative methods for triangulation.

Question 49: During a Business Impact Analysis, which metric defines the maximum length of time a critical business function can be unavailable before causing unacceptable harm to the organization?

Recovery Time Objective (RTO)
Mean Time to Recover (MTTR)
Recovery Point Objective (RPO)
Maximum Tolerable Downtime (MTD) (Correct answer)

Correct answer: Maximum Tolerable Downtime (MTD)

Maximum Tolerable Downtime (MTD) defines the absolute outer limit of downtime before the impact becomes unacceptable to the business.

Question 50: When documenting assessment findings in SY0-601 practice, which approach is MOST appropriate?

Summarize verbally without written documentation
Include only positive findings
Use jargon only experts understand
Record objective findings, measurements, and observations factually (Correct answer)

Correct answer: Record objective findings, measurements, and observations factually

Assessment documentation must be objective, factual, and comprehensive.

Question 51: What is a security information and event management (SIEM) system?

Analyze security alerts (Correct answer)
Generate backups
Encrypt data
Disable firewalls

Correct answer: Analyze security alerts

A Security Information and Event Management (SIEM) system collects, aggregates, and analyzes security-related data from various sources across an organization's IT infrastructure. Its primary function is to provide real-time analysis of security alerts generated by network devices, servers, and applications. This helps security teams detect, prioritize, and respond to potential security incidents more effectively by correlating events and identifying threats.

Question 52: Why conduct root cause analysis?

Update software
Blame staff
Find source of issue (Correct answer)
Change password

Correct answer: Find source of issue

Root cause analysis (RCA) is a systematic process for identifying the underlying causes of a problem or incident, rather than just addressing its symptoms. In cybersecurity, RCA helps determine why a security incident occurred, what vulnerabilities were exploited, and what processes failed. By understanding the true source of an issue, organizations can implement effective preventative measures to avoid recurrence and strengthen their defenses.

Question 53: How does the SY0-601 body of knowledge relate to daily professional practice?

It only applies during exams
It is theoretical with limited application
It is only for academic research
It provides the foundational framework guiding decision-making and standard practices (Correct answer)

Correct answer: It provides the foundational framework guiding decision-making and standard practices

The body of knowledge provides the framework guiding daily decision-making and practices.

Question 54: What does vulnerability mean?

System upgrade
Weakness in system (Correct answer)
Access log
Update feature

Correct answer: Weakness in system

In cybersecurity, a vulnerability refers to a weakness or flaw in a system, application, or network that can be exploited by an attacker. These weaknesses could be in software code, configurations, or even human processes. Identifying and patching vulnerabilities is crucial to prevent unauthorized access, data breaches, and other security incidents.

Question 55: What is the benefit of cloud architecture?

High cost
Fixed access
Scalability (Correct answer)
Manual updates

Correct answer: Scalability

The primary benefit of cloud architecture is scalability, which allows resources to be easily adjusted up or down based on demand. Organizations can quickly provision or de-provision computing power, storage, and network bandwidth as needed, without significant upfront investment. This flexibility enables businesses to handle fluctuating workloads efficiently and cost-effectively.

Question 56: A company's serverless functions are triggered by events and execute in ephemeral containers. Which cloud security concept describes ensuring these workloads are protected even though they have no persistent OS to harden?

Serverless security / function-level isolation (Correct answer)
Container escape prevention
Infrastructure as code (IaC) scanning
VM-based hypervisor hardening

Correct answer: Serverless security / function-level isolation

Serverless security focuses on securing function code, permissions, and event sources rather than the underlying OS, which is managed by the provider.

Question 57: A network architect is designing a campus with multiple buildings. To prevent a broadcast storm in one building from affecting others, which design technique should be used?

Static routing between buildings
Spanning tree protocol (STP) tuning
MAC address filtering
VLAN segmentation per building (Correct answer)

Correct answer: VLAN segmentation per building

VLANs logically isolate broadcast domains so that a storm or failure in one VLAN does not propagate to VLANs in other buildings.

Question 58: What is the MOST effective way for new SY0-601 professionals to build competency?

Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Studying certification materials exclusively
Learning through trial and error
Focusing solely on advanced topics

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building competency requires formal education, mentored practice, and ongoing development.

Question 59: A cloud provider offers a shared responsibility model. For a SaaS application, which security domain is the customer primarily responsible for?

User access management and data governance (Correct answer)
Physical security of data centers
Hypervisor patching
Network infrastructure redundancy

Correct answer: User access management and data governance

In the SaaS model, the provider manages infrastructure through the application layer; the customer is responsible for managing user identities, access controls, and the data they store.

Question 60: In CompTIA Security+ IT Certification, what is the PRIMARY purpose of conducting an initial assessment?

To fulfill administrative requirements
To establish a baseline and identify needs for appropriate action (Correct answer)
To demonstrate the assessor's expertise
To generate documentation for billing

Correct answer: To establish a baseline and identify needs for appropriate action

The initial assessment establishes a baseline and identifies specific needs to guide subsequent decisions.

Question 61: A security engineer recommends enabling Secure Boot on all enterprise endpoints. What threat does Secure Boot primarily mitigate?

Ransomware encrypting user files
Bootkit and rootkit infections that persist below the OS (Correct answer)
Brute-force attacks on local user accounts
Phishing emails that deliver malware

Correct answer: Bootkit and rootkit infections that persist below the OS

Secure Boot uses cryptographic signatures to verify that the bootloader and OS kernel have not been tampered with, preventing bootkits from loading before the OS.

Question 62: What is the MOST effective way for new SY0-601 professionals to build competency?

Studying certification materials exclusively
Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Focusing solely on advanced topics
Learning through trial and error

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building competency requires formal education, mentored practice, and ongoing development.

Question 63: A security architect wants to prevent a single vulnerability from compromising an entire system by implementing multiple, independent security controls. Which design principle does this represent?

Separation of duties
Fail secure
Least functionality
Defense in depth (Correct answer)

Correct answer: Defense in depth

Defense in depth layers multiple security controls so that if one fails, others continue to protect the system.

Question 64: An organization deploys an application that processes payment data. The security architect recommends a deception technology to detect attackers who have already breached the network. What is this technology called?

Honeypot (Correct answer)
IDS sensor
SIEM correlation rule
Web application firewall

Correct answer: Honeypot

A honeypot is a decoy system designed to lure and detect attackers who have already gained internal network access.

Question 65: Which assessment method provides the MOST reliable data for SY0-601 professionals making critical decisions?

Standardized tools combined with professional observation (Correct answer)
Informal verbal feedback alone
Social media reviews
Single-source data from one stakeholder

Correct answer: Standardized tools combined with professional observation

Combining standardized tools with professional observation provides the most comprehensive data.

Question 66: What is the purpose of multifactor authentication?

Single password
Require multiple credentials (Correct answer)
Faster login
Automatic logout

Correct answer: Require multiple credentials

Multifactor authentication (MFA) enhances security by requiring users to provide two or more different types of credentials from independent categories to verify their identity. These categories typically include something you know (like a password), something you have (like a phone or token), and something you are (like a fingerprint). This layered approach significantly reduces the risk of unauthorized access, even if one factor is compromised, making it much harder for attackers to gain entry.

Question 67: How should a SY0-601 professional manager address underperformance?

Provide timely, specific feedback with support and a clear improvement plan (Correct answer)
Immediately reassign the individual
Ignore it until formal reviews
Address publicly in team meetings

Correct answer: Provide timely, specific feedback with support and a clear improvement plan

Timely, specific feedback with support gives individuals a fair opportunity to improve.

Question 68: What is the PRIMARY benefit of data-driven decision making in CompTIA Security+ IT Certification?

It simplifies decisions to one approach
It guarantees positive results
It provides objective evidence to support decisions, reduce bias, and track outcomes (Correct answer)
It eliminates need for professional judgment

Correct answer: It provides objective evidence to support decisions, reduce bias, and track outcomes

Data-driven decisions provide objective evidence that reduces bias and enables outcome tracking.

Question 69: What is threat hunting?

Proactive threat search (Correct answer)
Send emails
Backup files
Fix printers

Correct answer: Proactive threat search

Threat hunting is a proactive security activity where cybersecurity professionals actively search for unknown or undetected threats within an organization's network. Unlike traditional security measures that react to alerts, threat hunting assumes that a breach may have already occurred and seeks to uncover sophisticated attacks that have bypassed automated defenses. This helps organizations discover and mitigate threats before they cause significant damage, improving overall resilience.

Question 70: A security architect recommends using an SDK that automatically enforces HTTPS, parameterized queries, and input sanitization for all new applications. This approach best exemplifies which principle?

Defense in depth
Security by obscurity
Secure by default (Correct answer)
Fail open design

Correct answer: Secure by default

Secure by default means that security controls are enabled out of the box, so developers must actively choose to weaken them rather than actively choose to enable them.

Question 71: What is spyware?

Blocks spam
Gathers info secretly (Correct answer)
Speeds up PC
Encrypts data

Correct answer: Gathers info secretly

Spyware is a type of malicious software designed to secretly gather information about a user's activities without their knowledge or consent. This can include monitoring keystrokes, capturing screenshots, tracking browsing history, or collecting personal data. Its primary purpose is to covertly transmit this collected information to an unauthorized third party, often for advertising or malicious purposes.

Question 72: What is log analysis?

Change settings
Delete logs
Ignore alerts
Review logs (Correct answer)

Correct answer: Review logs

Log analysis involves systematically reviewing and interpreting log data generated by systems, applications, and network devices. This process helps identify patterns, anomalies, and potential security incidents that might otherwise go unnoticed. By examining logs, security professionals can detect malicious activity, troubleshoot issues, and gain insights into system behavior, which is crucial for forensic investigations and proactive threat detection.

Question 73: Which statement BEST describes the relationship between CompTIA Security+ IT Certification certification and industry evolution?

Requirements become less stringent over time
Certification requirements never change
Changes only occur when government mandates them
Requirements evolve periodically to reflect advances in knowledge and practice (Correct answer)

Correct answer: Requirements evolve periodically to reflect advances in knowledge and practice

Certification requirements evolve to keep pace with professional and technological advances.

Question 74: When documenting assessment findings in SY0-601 practice, which approach is MOST appropriate?

Include only positive findings
Record objective findings, measurements, and observations factually (Correct answer)
Use jargon only experts understand
Summarize verbally without written documentation

Correct answer: Record objective findings, measurements, and observations factually

Assessment documentation must be objective, factual, and comprehensive.

Question 75: Which architecture pattern improves resilience by designing systems to continue operating in a degraded but functional state when a component fails, rather than failing completely?

Graceful degradation (Correct answer)
Active-active failover
High availability clustering
Load balancing

Correct answer: Graceful degradation

Graceful degradation ensures that a system continues to provide core functionality even when non-critical components fail.

Question 76: What distinguishes a CompTIA Security+ IT Certification certified professional from a non-certified practitioner?

Certified professionals only work in larger organizations
Certified professionals always have more experience
There is no meaningful difference
Certification validates competency through standardized assessment against benchmarks (Correct answer)

Correct answer: Certification validates competency through standardized assessment against benchmarks

Certification provides objective validation of competency through standardized assessment.

Question 77: What is the PRIMARY purpose of obtaining SY0-601 certification in CompTIA Security+ IT Certification?

To bypass educational requirements
To demonstrate verified competency and adherence to professional standards (Correct answer)
To guarantee employment
To satisfy a personal achievement goal

Correct answer: To demonstrate verified competency and adherence to professional standards

Certification demonstrates verified competency and adherence to professional standards.

Question 78: What distinguishes a CompTIA Security+ IT Certification certified professional from a non-certified practitioner?

Certified professionals always have more experience
Certification validates competency through standardized assessment against benchmarks (Correct answer)
There is no meaningful difference
Certified professionals only work in larger organizations

Correct answer: Certification validates competency through standardized assessment against benchmarks

Certification provides objective validation of competency through standardized assessment.

Question 79: What is the recovery phase?

Isolate users
Shut down servers
Restore systems (Correct answer)
Ignore alerts

Correct answer: Restore systems

The recovery phase in incident response focuses on restoring affected systems and services to their normal operational state after an incident has been contained and eradicated. This typically involves restoring data from backups, rebuilding compromised systems, and verifying that all vulnerabilities have been patched. The goal is to bring the business back to full functionality securely and efficiently, minimizing long-term disruption.

Question 80: What is the PRIMARY benefit of data-driven decision making in CompTIA Security+ IT Certification?

It eliminates need for professional judgment
It simplifies decisions to one approach
It provides objective evidence to support decisions, reduce bias, and track outcomes (Correct answer)
It guarantees positive results

Correct answer: It provides objective evidence to support decisions, reduce bias, and track outcomes

Data-driven decisions provide objective evidence that reduces bias and enables outcome tracking.

Question 81: A company purchases cyber insurance to offset potential financial losses from a data breach. Which risk response strategy does this represent?

Risk acceptance
Risk avoidance
Risk transfer (Correct answer)
Risk mitigation

Correct answer: Risk transfer

Risk transfer shifts the financial burden of a risk to a third party, such as through purchasing cyber insurance.

Question 82: Which is a type of malware?

Trojan (Correct answer)
Firewall
VPN
Patch

Correct answer: Trojan

A Trojan, or Trojan horse, is a type of malware that disguises itself as legitimate software to trick users into installing it. Once inside a system, it can create backdoors, steal data, or launch other attacks without the user's knowledge. Trojans are dangerous because they appear harmless, making them difficult to detect until they execute their malicious payload.

Question 83: What is the main function of a firewall?

Speed up network
Store files
Control traffic (Correct answer)
Generate traffic

Correct answer: Control traffic

A firewall acts as a security barrier, monitoring and controlling incoming and outgoing network traffic based on predefined security rules. Its main function is to permit or deny data packets, protecting a private network from unauthorized access and malicious attacks. By filtering traffic according to established policies, firewalls enforce security boundaries and prevent unwanted communication.

Question 84: What is defense in depth?

Layered security (Correct answer)
Minimal access
Single firewall
Open access

Correct answer: Layered security

Defense in depth is a cybersecurity strategy that employs multiple layers of security controls to protect information and systems. Instead of relying on a single point of defense, it creates redundancy, meaning if one security measure fails, others are in place to prevent a breach. This layered approach significantly enhances overall security posture by making it harder for attackers to penetrate a system.

Question 85: During a design review, a security engineer recommends that all internal services authenticate each request independently rather than relying on network location. This is a core principle of which model?

Zero trust architecture (Correct answer)
Defense in depth
Least privilege access
Perimeter security model

Correct answer: Zero trust architecture

Zero trust architecture operates on the principle of 'never trust, always verify,' requiring authentication and authorization for every request regardless of network origin.

Question 86: What is the MOST effective way for new SY0-601 professionals to build competency?

Focusing solely on advanced topics
Learning through trial and error
Studying certification materials exclusively
Combining formal education, mentored practice, and ongoing professional development (Correct answer)

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building competency requires formal education, mentored practice, and ongoing development.

Question 87: A company's payroll system can tolerate losing no more than 4 hours of transaction data in the event of a disaster. Which metric does this describe?

Recovery Point Objective (RPO) (Correct answer)
Recovery Time Objective (RTO)
Maximum Tolerable Downtime (MTD)
Mean Time Between Failures (MTBF)

Correct answer: Recovery Point Objective (RPO)

Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss, measured in time, that an organization can tolerate.

Question 88: How does the SY0-601 body of knowledge relate to daily professional practice?

It provides the foundational framework guiding decision-making and standard practices (Correct answer)
It is theoretical with limited application
It only applies during exams
It is only for academic research

Correct answer: It provides the foundational framework guiding decision-making and standard practices

The body of knowledge provides the framework guiding daily decision-making and practices.

Question 89: What protocol is used to securely browse websites?

HTTP
HTTPS (Correct answer)
FTP
SMTP

Correct answer: HTTPS

HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP, the protocol over which data is sent between your browser and the website you are connecting to. It encrypts the communication between the client and the server using SSL/TLS, protecting data from eavesdropping and tampering. This ensures the confidentiality and integrity of information exchanged, making it safe for sensitive transactions like online banking or shopping.

Question 90: What does WPA3 secure?

Wireless networks (Correct answer)
Wired networks
Email clients
VPNs

Correct answer: Wireless networks

WPA3 (Wi-Fi Protected Access 3) is the latest security standard for wireless networks, designed to provide stronger encryption and more robust authentication than its predecessors. It offers enhanced protection against brute-force attacks and improves privacy for users on public Wi-Fi networks. WPA3 secures the data transmitted over Wi-Fi, making it much harder for unauthorized parties to intercept or decrypt communications.

Question 91: Which is an example of insider threat?

Email phishing
Firewall misconfig
Employee data theft (Correct answer)
Malware infection

Correct answer: Employee data theft

An insider threat refers to a security risk that originates from within an organization, often from current or former employees, contractors, or business partners. Employee data theft is a prime example, where an individual with authorized access misuses their privileges to steal sensitive information. These threats are particularly challenging to detect and mitigate due to the trusted nature of the perpetrator.

CompTIA Security+ (SY0-601) Certification Exam

This certification validates the baseline skills necessary to perform core security functions and pursue an IT security career, covering threat management, risk management, and security architecture.

Questions

90 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

comptia.org — Exam format, passing score, time limit, eligibility, exam information · verified Oct 2026