8140.study

Security+ practice questions (SY0-701)

By 8140.study · Published 2026-09-15 · Last updated 2026-09-15

Ten practice questions for the CompTIA Security+ SY0-701 exam, spread across all five exam domains. Choose your answer, then open the explanation to check your reasoning.

These are original questions written by 8140.study to help you practice. They are not real exam questions. For every exam detail and renewal rule, see our Security+ certification page.

  1. Question 1 · General security concepts

    A company posts signs at its data center entrance warning that all activity is recorded and violators will be prosecuted. Which type of security control is the sign?

    1. A.Preventive
    2. B.Deterrent
    3. C.Detective
    4. D.Corrective
    Show answer

    Answer: B. Deterrent

    A deterrent control discourages someone from attempting an attack by making the consequences clear. The sign does not physically stop entry, which would make it preventive, and it does not identify or record an incident itself, which would make it detective.

  2. Question 2 · Threats, vulnerabilities, and mitigations

    Employees receive text messages that appear to come from the company bank, asking them to confirm their account details through a link. What is this attack called?

    1. A.Vishing
    2. B.Whaling
    3. C.Smishing
    4. D.Pharming
    Show answer

    Answer: C. Smishing

    Smishing is phishing delivered by SMS text message. Vishing uses voice calls, whaling targets senior executives specifically, and pharming redirects users to a fake site by tampering with DNS or host settings.

  3. Question 3 · Threats, vulnerabilities, and mitigations

    A login page builds its database query by joining user input directly into the SQL statement. An attacker enters ' OR '1'='1 in the username field and is logged in. Which fix most directly addresses the root cause?

    1. A.Place a web application firewall in front of the site
    2. B.Lock accounts after three failed login attempts
    3. C.Use parameterized queries so input is never treated as SQL code
    4. D.Require TLS for all connections to the login page
    Show answer

    Answer: C. Use parameterized queries so input is never treated as SQL code

    This is SQL injection, and its root cause is input being executed as part of the query. Parameterized queries keep data and code separate, which removes the vulnerability. A web application firewall can help as an extra layer, but it filters known patterns rather than fixing the flawed query.

  4. Question 4 · Security architecture

    An organization wants to make sure a compromised web server in its DMZ cannot be used to reach internal database servers freely. Which approach best achieves this?

    1. A.Place the web server and the database servers on the same VLAN
    2. B.Segment the networks and allow only the specific connections the web server needs
    3. C.Enable full-disk encryption on the web server
    4. D.Put a load balancer in front of the web server
    Show answer

    Answer: B. Segment the networks and allow only the specific connections the web server needs

    Network segmentation with tightly scoped firewall rules limits what an attacker can reach after compromising one system. Encryption protects stored data but does nothing to stop lateral movement, and a load balancer spreads traffic without restricting it.

  5. Question 5 · Security architecture

    A payment system replaces each stored credit card number with a random value that can be mapped back to the real number only through a separately secured lookup service. What is this technique?

    1. A.Hashing
    2. B.Tokenization
    3. C.Data masking
    4. D.Salting
    Show answer

    Answer: B. Tokenization

    Tokenization swaps sensitive data for a token that can be reversed only through the secured token vault. Hashing is one-way and cannot be reversed, masking hides part of a value when it is displayed, and salting adds random data before hashing.

  6. Question 6 · Security operations

    A security analyst confirms that malware is actively spreading across several workstations. What should the analyst do next in the incident response process?

    1. A.Remove the malware from every affected workstation
    2. B.Isolate the affected workstations to stop the spread
    3. C.Restore the workstations from known-good backups
    4. D.Hold a lessons learned meeting
    Show answer

    Answer: B. Isolate the affected workstations to stop the spread

    Once an incident is confirmed, containment comes before eradication and recovery. Isolating affected systems stops the damage from growing while the team works out how to remove the malware safely. Removing it first risks missing systems that are still being infected.

  7. Question 7 · Security operations

    Which combination of authentication factors is true multifactor authentication?

    1. A.A password and a PIN
    2. B.A smart card and an ID badge
    3. C.A password and a fingerprint
    4. D.A password and a security question
    Show answer

    Answer: C. A password and a fingerprint

    Multifactor authentication requires factors from different categories. A password is something you know and a fingerprint is something you are. A password with a PIN or a security question is two things you know, and a smart card with a badge is two things you have.

  8. Question 8 · Security operations

    A vulnerability scan reports a critical flaw in a service on a server, but the analyst confirms that the service is not installed on that server. What is this result?

    1. A.True positive
    2. B.False positive
    3. C.True negative
    4. D.False negative
    Show answer

    Answer: B. False positive

    A false positive is a reported problem that does not actually exist. A false negative is the more dangerous opposite: a real vulnerability the scan failed to report. Validating findings before acting on them is part of vulnerability management.

  9. Question 9 · Security program management and oversight

    A company buys cybersecurity insurance to cover financial losses from a potential data breach. Which risk management strategy is this?

    1. A.Avoidance
    2. B.Acceptance
    3. C.Mitigation
    4. D.Transference
    Show answer

    Answer: D. Transference

    Buying insurance transfers the financial impact of a risk to a third party. It does not reduce the chance of a breach, which would be mitigation, and the company remains accountable for protecting its data.

  10. Question 10 · Security program management and oversight

    Which metric states the maximum amount of data, measured in time, that an organization can afford to lose after a disruption?

    1. A.Recovery time objective (RTO)
    2. B.Recovery point objective (RPO)
    3. C.Mean time to repair (MTTR)
    4. D.Mean time between failures (MTBF)
    Show answer

    Answer: B. Recovery point objective (RPO)

    The recovery point objective defines how much data loss is tolerable, which drives how often backups must run. The recovery time objective is how quickly systems must be restored, a different question. MTTR and MTBF describe repair speed and reliability, not data loss.

Want more than ten? The first module of our Security+ course, General Security Concepts, is free.