CompTIA SY0-701 Exam Dumps

CompTIA Security+ Exam 2026

CompTIA SY0-701 Sample Questions

Question # 1

The management team reports employees are missing features on company-provided tablets, causing productivity issues. The team directs IT to resolve the issue within 48 hours. Which of the following is the best solution?

A. EDR 
B. COPE 
C. MDM 
D. FDE

Show Answer

Question # 2

The Chief Information Security Officer (CISO) has determined the company is noncompliant with local data privacy regulations. The CISO needs to justify the budget request for more resources. Which of the following should the CISO present to the board as the direct consequence of non-compliance? 

A. Fines 
B. Reputational damage 
C. Sanctions 
D. Contractual implications 

Show Answer

Question # 3

Which of the following threat actors would most likely target an organization by using a logic bomb within an internally-developed application?

A. Nation-state 
B. Trusted insider 
C. Organized crime group 
D. Hacktivist 

Show Answer

Question # 4

An organization is evaluating new regulatory requirements associated with the implementation of corrective controls on a group of interconnected financial systems. Which of the following is the most likely reason for the new requirement?

A. To defend against insider threats altering banking details 
B. To ensure that errors are not passed to other systems 
C. To allow for business insurance to be purchased
 D. To prevent unauthorized changes to financial data

Show Answer

Question # 5

Which of the following activities would involve members of the incident response team and other stakeholders simul-ating an event?

A. Lessons learned 
B. Digital forensics 
C. Tabletop exercise 
D. Root cause analysis 

Show Answer

Question # 6

Which of the following methods will most likely be used to identify legacy systems?

A. Bug bounty program 
B. Vulnerability scan 
C. Package monitoring
 D. Dynamic analysis 

Show Answer

Question # 7

Which of the following actions would reduce the number of false positives for an analyst to manually review?

A. Create playbooks as part of a SOAR platform 
B. Redefine the patch management process 
C. Replace an EDR tool with an XDR solution 
D. Disable AV heuristics scanning 

Show Answer

Question # 8

Which of the following should an internal auditor check for first when conducting an audit of the organization’s risk management program? 

A. Policies and procedures 
B. Asset management 
C. Vulnerability assessment 
D. Business impact analysis 

Show Answer

Question # 9

Which of the following attacks primarily targets insecure networks?

A. Evil twin 
B. Impersonation 
C. Watering hole 
D. Pretexting 

Show Answer

Question # 10

Which of the following explains how organizations benefit from SCAP?

A. The configurations defined as part of established baselines allow organizations to deploy well-tested security solutions quickly and easily. 
B. The consolidated reporting layout makes it easier for technicians to communicate incident response to senior decision-makers. 
C. The common format for vulnerability scanning and reporting enables greater interoperability between security tools from different vendors. 
D. The strict compliance to international standards reduces overall cost and risk to organizations when a security breach occurs. 

Show Answer

Question # 11

A software company currently secures access using a combination of traditional username/password configurations and one-time passwords for MFA. However, employees still struggle to maintain both a password manager and the authenticator application. The company wants to migrate to a single, integrated authentication solution that is more secure and provides a smoother login experience for its employees. Which of the following solutions will best satisfy the company's needs?

A. Migrating to FIDO2 passkeys, utilizing built-in device biometrics for user authentication 
B. Implementing SMS-based one-time passwords as the primary second factor for all logins 
C. Implementing SAML federation across authentication servers so employees can use SSO to access applications 
D. Deploying a PKI system that requires all employees to use smart cards for login access

Show Answer

Question # 12

A penetration tester visits a client’s website and downloads the site's content. Which of the following actions is the penetration tester performing? 

A. Unknown environment testing 
B. Vulnerability scan 
C. Due diligence 
D. Passive reconnaissance 

Show Answer

Question # 13

A company experiences a data loss event due to a stolen laptop. In order to prevent future similar events, a security analyst must implement a scalable solution to ensure all data on company laptops remains secure in the event of theft or loss. Which of the following should the analyst do next? 

A. Configure the HSM for each device and store recovery keys centrally. 
B. Implement LAPS to ensure secure password rotation for administrative accounts. 
C. Use an MDM platform to manage the devices and force security configurations. 
D. Ensure that each laptop has the secure enclave properly initialized in the BIOS. 

Show Answer

Question # 14

Which of the following should a security analyst consider when prioritizing remediation efforts against known vulnerabilities? 

A. The impact of reporting to executive management 
B. The overall organizational risk tolerance 
C. Information gathered from open sources 
D. The source of the reported risk 

Show Answer

Question # 15

A staff member finds a USB drive in the office's parking lot. Which of the following should the staff member do?

A. Notify the file owner after reviewing the contents of the drive. 
B. Use an air-gapped system to open the files without exposing the network. 
C. Wipe the drive immediately using a secure method. 
D. Submit the device to the security team without connecting it

Show Answer

Question # 16

A few weeks after deploying additional email servers, a company begins to receive complaints that messages are going into recipients’ spam folders. Which of the following needs to be updated?

A. CNAME 
B. SMTP 
C. DLP 
D. SPF 

Show Answer

Question # 17

A security analyst receives an alert that there was an attempt to download known malware. Which of the following actions would allow the best chance to analyze the malware?

A. Review the IPS logs and determine which command-and-control IPs were blocked.
 B. Analyze application logs to see how the malware attempted to maintain persistence.
 C. Run vulnerability scans to check for systems and applications that are vulnerable to the malware. 
D. Obtain and execute the malware in a sandbox environment and perform packet captures. 

Show Answer

Question # 18

A store is setting up wireless access for employees. Management wants to limit the number of access points while ensuring full coverage. Which tool will help determine how many access points are needed? 

A. Signal locator 
B. WPA3 
C. Heat map 
D. Site survey

Show Answer

Question # 19

A company expects its provider to ensure servers and networks maintain 97% uptime. Which of the following would most likely list this expectation? 

A. BPA 
B. MOU 
C. NDA 
D. SLA

Show Answer

Question # 20

During a routine audit, an analyst discovers that a department at a high school uses a simul-ation program that was not properly vetted before deployment. Which of the following threats is this an example of?

A. Espionage 
B. Data exfiltration 
C. Shadow IT D
. Zero-day 

Show Answer

Question # 21

A security manager needs an automated solution that will take immediate action to protect an organization against inbound malicious traffic. Which of the following is the best solution?

A. UEM 
B. IPS 
C. WAF 
D. VPN 

Show Answer

Question # 22

Which of the following would most likely prevent exploitation of an end-of-life, businesscritical system?

A. Monitoring 
B. Isolation 
C. Decommissioning 
D. Encryption 

Show Answer

Question # 23

Which of the following risk management strategies is being used when a Chief Information Security Officer ignores known vulnerabilities identified during a risk assessment?

A. Transfer
 B. Avoid
 C. Mitigate 
D. Accept 

Show Answer

Question # 24

Which of the following best describes the practice of preserving and documenting the handling of forensic evidence? 

A. Acquisition of evidence 
B. E-discovery 
C. Chain of custody 
D. Forensic tabletop exercises 

Show Answer

Question # 25

A systems administrator uses deception techniques to help detect and study attacks within a network. The administrator deploys a document filled with fake passwords and customer payment information. Which of the following techniques is the administrator using?

A. Honeytoken
 B. Honeypot 
C. Honeyfile 
D. Honeynet 

Show Answer

Question # 26

A company uses multiple providers to send its marketing, internal, and support emails. Many of the emails are marked as spam. Which of the following changes should the company make to ensure legitimate emails are validated? 

A. Disable DKIM to avoid signature conflicts. 
B. Implement DMARC with a "reject" policy to enforce sender validation. 
C. Replace the domain's MX record with the marketing provider's services. 
D. Update the SPF record to include all authorized sending sources. 

Show Answer

Question # 27

An analyst identifies that multiple users have the same passwords, but the hashes appear to be completely different. Which of the following most likely explains this issue?

A. Data masking 
B. Salting
 C. Key escrow 
D. Tokenization 

Show Answer

Question # 28

A company is experiencing issues with employees leaving the company for a competitor and taking customer contact information with them. Which of the following tools will help prevent this from reoccurring?

A. FIM 
B. NAC 
C. IDS 
D. UBA 

Show Answer

Question # 29

Which of the following is the best mitigation for a zero-day vulnerability found in missioncritical production servers that must be highly available?

A. Virtualizing and migrating to a containerized instance 
B. Removing and sandboxing to an isolated network 
C. Monitoring and implementing compensating controls 
D. Patching and redeploying to production as quickly as possible 

Show Answer

Question # 30

A security analyst is investigating an alert that was produced by endpoint protection software. The analyst determines this event was a false positive triggered by an employee who attempted to download a file. Which of the following is the most likely reason the download was blocked?

A. A misconfiguration in the endpoint protection software 
B. A zero-day vulnerability in the file 
C. A supply chain attack on the endpoint protection vendor 
D. Incorrect file permissions 

Show Answer

Question # 31

While investigating a possible incident, a security analyst discovers the following logentries:67.118.34.157 ----- [28/Jul|2022:10:26:59 -0300] "GET |query.php?qwireless%20headphones | HTTP|1.0" 200 12737132.18.222.103 ----[28|Jul|2022:10:27:10 -0300] "GET |query.php?q=123 INSERT INTOusers VALUES('temp', 'pass123')# | HTTP/1.0" 200 93512.45.101.121 ----- [28|Jul|2022:10:27:22 -0300] "GET |query.php?q=mp3%20players IHTTP|1.0" 200 14650Which of the following should the analyst do first?

A. Implement a WAF 
B. Disable the query .php script
C. Block brute-force attempts on temporary users
 D. Check the users table for new accounts 

Show Answer

Question # 32

A security officer observes that a software development team is not complying with its corporate security policy on encrypting confidential data. Which of the following categories refers to this type of non-compliance? 

A. External 
B. Standard 
C. Regulation 
D. Internal 

Show Answer

Question # 33

Which of the following is a directive managerial control? 

A. Acceptable use policy
 B. Login warning banner 
C. Master service agreement 
D. No trespassing sign 

Show Answer

Question # 34

Which of the following are the best methods for hardening end user devices? (Select two)

A. Full disk encryption 
B. Group-level permissions
 C. Account lockout
 D. Endpoint protection 
E. Proxy server
 F. Segmentation 

Show Answer

Question # 35

A security team wants to work with the development team to ensure WAF policies are automatically created when applications are deployed. Which concept describes this capability? 

A. IaC
 B. IoT 
C. IoC
 D. IaaS 

Show Answer

Question # 36

An organization has issues with deleted network share data and improper permissions. Which solution helps track and remediate these? 

A. DLP
 B. EDR 
C. FIM 
D. ACL

Show Answer

Question # 37

A security administrator wants to determine if the company's social engineering training is effective. Which of the following should the administrator do to complete this task?

A. Set up a honeypot. 
B. Send out a survey. 
C. Set up a focus group. 
D. Conduct a phishing campaign. 

Show Answer

Question # 38

An administrator discovers a cross-site scripting vulnerability on a company website. Which of the following will most likely remediate the issue?

A. Input validation 
B. NGFW 
C. Vulnerability scan 
D. WAF 

Show Answer

Question # 39

An administrator is estimating the cost associated with an attack that could result in the replacement of a physical server. Which of the following processes is the administrator performing?

A. Quantitative risk analysis 
B. Disaster recovery test 
C. Physical security controls review 
D. Threat modeling 

Show Answer

Question # 40

Which of the following will harden access to a new database system? (Select two) 

A. Jump server
 B. NIDS 
C. Monitoring 
D. Proxy server 
E. Host-based firewall 
F. WAF 

Show Answer

Question # 41

Which of the following is most likely in a responsibility matrix in a cloud computing environment?

A. The customer is responsible for information and data regardless of the cloud model used. 
B. The cloud provider is responsible for account and identity management for connected devices. 
C. The customer and the cloud provider share responsibility for the physical network infrastructure. 
D. The cloud provider is responsible for the security of endpoints connected to the infrastructure. 

Show Answer

Question # 42

An administrator must implement a solution that provides security and network connectivity between two companies. Which of the following infrastructure solutions is the best for this purpose?

A. UTM 
B. VPN 
C. NAC 
D. NGFW 

Show Answer

Question # 43

A security analyst must prevent remote users from accessing malicious URLs. The sites need to be checked inline for reputation, content, or categorization. Which of the following technologies will help secure the enterprise?

A. VPN 
B. SASE 
C. IDS 
D. SD-WAN 

Show Answer

Question # 44

The internal audit team determines a software application is no longer in scope for external reporting requirements. Which of the following will confirm management’s perspective that the application is no longer applicable?

A. Data inventory and retention 
B. Right to be forgotten 
C. Due care and due diligence 
D. Acknowledgement and attestation 

Show Answer

Question # 45

During a routine audit, an analyst discovers that a department uses software that was not vetted. Which threat is this?

A. Espionage 
B. Data exfiltration 
C. Shadow IT 
D. Zero-day 

Show Answer

Question # 46

Which of the following technologies can achieve microsegmentation? 

A. Next-generation firewalls 
B. Software-defined networking
 C. Embedded systems 
D. Air-gapped 

Show Answer

Question # 47

A company prepares for an upcoming regulatory audit. The company wants to perform a gap analysis in the most cost-effective way. Which of the following will help the company achieve this goal?

A. Internal self-assessment
 B. Active reconnaissance 
C. Red team penetration test 
D. Tabletop exercise 

Show Answer

Question # 48

Which of the following is most likely to be used as a just-in-time reference document within a security operations center?

A. Change management policy 
B. Risk profile 
C. Playbook 
D. SIEM profile

Show Answer

Question # 49

Which of the following describes the difference between encryption and hashing?

A. Encryption protects data in transit, while hashing protects data at rest. 
B. Encryption replaces cleartext with ciphertext, while hashing calculates a checksum. 
C. Encryption ensures data integrity, while hashing ensures data confidentiality. 
D. Encryption uses a public-key exchange, while hashing uses a private key. 

Show Answer

Question # 50

A site reliability engineer is designing a recovery strategy that requires quick failover to an identical site if the primary facility goes down. Which of the following types of sites should the engineer consider? 

A. Recovery site 
B. Hot site 
C. Cold site 
D. Warm site 

Show Answer

Question # 51

A manufacturing organization receives the results from a penetration test. According to the results, legacy devices that are critical to continued business function display vulnerabilities. The devices have minimal vendor support and should be segmented and monitored closely. Which of the following devices were most likely identified?

A. Workstations 
B. Embedded systems
 C. Core router 
D. DNS server 

Show Answer

Question # 52

An organization experiences a compromise in a cloud-hosted solution that contains customer information. Which of the following strategies will help determine the sensitivity level of the breach?

A. Permission restrictions 
B. Tabletop exercise 
C. Data classification
 D. Asset inventory 

Show Answer

Question # 53

A company's antivirus solution is effective in blocking malware but often has false positives. The security team has spent a significant amount of time on investigations but cannot determine a root cause. The company is looking for a heuristic solution. Which of the following should replace the antivirus solution?

A. SIEM 
B. EDR 
C. DLP 
D. IDS

Show Answer

Question # 54

A company is in the process of cutting jobs to manage costs. The Chief Information Security Officer is concerned about the increased risk of an insider threat. Which of the following will most likely help the security awareness team address this potential threat? 

A. Immediately disable the accounts of staff who are likely to be terminated. 
B. Train supervisors to identify and manage disgruntled employees. 
C. Configure DLP to monitor staff who will be terminated. 
D. Raise awareness for business leaders on social engineering techniques. 

Show Answer

Question # 55

Which of the following is a vulnerability concern for end-of-life hardware?

A. Failure to follow hardware disposal procedures could result in unintended data release. 
B. The supply chain may not have replacement hardware. 
C. Newly released software may require computing resources not available on legacy hardware. 
D. The vendor may stop providing patches and updates.

Show Answer

Question # 56

A penetration tester is testing the security of a building’s alarm system. Which type of penetration test is being conducted?

A. Physical 
B. Defensive
 C. Integrated
 D. Continuous 

Show Answer

Question # 57

A user sends an email that includes a digital signature for validation. Which of the following security concepts would ensure that a user cannot deny that they sent the email?

A. Non-repudiation 
B. Confidentiality 
C. Integrity 
D. Authentication 

Show Answer

Question # 58

Which of the following best explains how open service ports increase an organization's attack surface?

A. They are commonly overlooked by endpoint antivirus tools during scans. 
B. They can make the company’s remote entry point available to the internet. 
C. They enable automatic application updates to reduce vulnerability windows. 
D. They can expose unnecessary services to unauthorized access if not properly restricted. 

Show Answer

Question # 59

A company processes a large volume of business-to-business transactions and prioritizes data confidentiality over transaction availability. The company’s firewall administrator must configure a new hardware-based firewall to replace the current one. Which of the following should the administrator do to best align with the company requirements in case a security event occurs?

A. Ensure the firewall data plane moves to fail-closed mode. 
B. Implement a deny-all rule as the last firewall ACL rule. 
C. Prioritize business-critical application traffic through the firewall. 
D. Configure rate limiting between the firewall interfaces. 

Show Answer