Which of the following scenarios best demonstrates the principle of confidentiality?

Encrypting sensitive files before transmission

A malicious actor exploits a publicly readable cloud storage bucket to download sensitive files. What is the best immediate remediation?

Remove public access and enforce identity-based access control policies

An attacker exploits a vulnerability in a third-party library used by an application. What is the best way to mitigate this class of risk?

Use software composition analysis and dependency scanning tools

What is the best way to mitigate risks associated with shadow IT within an organization?

Establish and enforce a policy defining approved services, backed by discovery of unsanctioned use

In the CIA triad, availability ensures which of the following?

Resources are accessible when needed

Which of the following is the best way to secure containers in a production environment?

Implement image scanning to identify vulnerabilities before deployment

What is the primary benefit of implementing governance, risk, and compliance (GRC) tools?

Centralize the management, tracking, and reporting of risk and compliance activities

Free Practice · No Signup Required

30 Free CompTIA SY0-701 Practice Questions

Real practice questions for the CompTIA Security+ (SY0-701) exam, with answers and detailed explanations. Updated 2026.

Start Timed Exam Mode Unlock all 310+ Questions

Free questions

Passing score

750 out of 900

Exam time

90 minutes

Question pool

310+ Questions

Below are 30 real practice questions for the CompTIA Security+ (SY0-701) exam. Each question shows the correct answer and a detailed explanation when you reveal it. Use these to benchmark your readiness — if you score below 70% on these 30 questions, plan for at least 4 more weeks of study before booking.

SY0-701 Practice Questions

FreePracticeQuiz.questionLabelGeneral Security Concepts
Which of the following scenarios best demonstrates the principle of confidentiality?
A
Encrypting sensitive files before transmission
B
Ensuring servers are available during peak hours
C
Detecting unauthorized changes in a document
D
Creating redundant backups of critical data
FreePracticeQuiz.questionLabelThreats, Vulnerabilities & Mitigations
What type of malware disguises itself as legitimate software to gain unauthorized access?
A
Keylogger
B
Trojan
C
Worm
D
Rootkit
FreePracticeQuiz.questionLabelSecurity Architecture
A malicious actor exploits a publicly readable cloud storage bucket to download sensitive files. What is the best immediate remediation?
A
Use endpoint protection on systems accessing the bucket
B
Encrypt all files stored in the bucket
C
Remove public access and enforce identity-based access control policies
D
Enable logging to monitor access to the bucket
FreePracticeQuiz.questionLabelSecurity Operations
An attacker exploits a vulnerability in a third-party library used by an application. What is the best way to mitigate this class of risk?
A
Conduct regular code reviews of first-party code
B
Implement a web application firewall
C
Remove the library from the application
D
Use software composition analysis and dependency scanning tools
FreePracticeQuiz.questionLabelProgram Management & Oversight
What is the best way to mitigate risks associated with shadow IT within an organization?
A
Establish and enforce a policy defining approved services, backed by discovery of unsanctioned use
B
Monitor network traffic for unauthorized applications only
C
Block all unapproved software installations on endpoints
D
Conduct regular security awareness training
FreePracticeQuiz.questionLabelGeneral Security Concepts
In the CIA triad, availability ensures which of the following?
A
Only authorized users can access data
B
Resources are accessible when needed
C
Data remains accurate and trustworthy
D
Unauthorized users are denied access
FreePracticeQuiz.questionLabelThreats, Vulnerabilities & Mitigations
What type of malware modifies its own code to avoid detection by signature-based antivirus software?
A
Spyware
B
Rootkit
C
Polymorphic malware
D
Logic bomb
FreePracticeQuiz.questionLabelSecurity Architecture
Which of the following technologies is most effective at segmenting and isolating different workloads within a cloud environment?
A
VLANs
B
Firewalls
C
Zero Trust Architecture
D
Micro-segmentation
FreePracticeQuiz.questionLabelSecurity Operations
Which of the following is the best way to secure containers in a production environment?
A
Implement image scanning to identify vulnerabilities before deployment
B
Configure role-based access control for container administrators
C
Use a host-based intrusion prevention system
D
Encrypt all container data at rest
FreePracticeQuiz.questionLabelProgram Management & Oversight
What is the primary benefit of implementing governance, risk, and compliance (GRC) tools?
A
Automate vulnerability scanning
B
Centralize the management, tracking, and reporting of risk and compliance activities
C
Improve encryption mechanisms
D
Prevent all cyberattacks
FreePracticeQuiz.questionLabelGeneral Security Concepts
An attacker successfully alters a configuration file on a server without proper authorization. Which security principle has been violated?
A
Availability
B
Non-repudiation
C
Integrity
D
Confidentiality
FreePracticeQuiz.questionLabelThreats, Vulnerabilities & Mitigations
Which type of malware executes its payload only when specific conditions are met?
A
Keylogger
B
Trojan
C
Worm
D
Logic bomb
FreePracticeQuiz.questionLabelSecurity Architecture
What is the best way to protect API endpoints from unauthorized use?
A
Require strong authentication and authorization for every API call
B
Use multi-factor authentication for developers
C
Block traffic from all public IP addresses
D
Deploy static application security testing (SAST) tools
FreePracticeQuiz.questionLabelSecurity Operations
Which security practice best ensures that a developer's new code does not introduce vulnerabilities into an application?
A
Continuous monitoring
B
Secure coding practices with peer review
C
Patch management
D
Network segmentation
FreePracticeQuiz.questionLabelProgram Management & Oversight
What does the term "risk appetite" refer to in a security context?
A
The total number of identified vulnerabilities
B
The cost of implementing a risk mitigation strategy
C
The amount and type of risk an organization is willing to accept in pursuit of its objectives
D
The likelihood of a threat exploiting a vulnerability
FreePracticeQuiz.questionLabelGeneral Security Concepts
What does the principle of least privilege ensure?
A
All users must authenticate with multi-factor authentication
B
Data access is monitored continuously
C
Privileged accounts are disabled by default
D
Users have minimal access necessary to perform their tasks
FreePracticeQuiz.questionLabelThreats, Vulnerabilities & Mitigations
Which type of malware is designed to operate stealthily at the kernel level, granting attackers persistent privileged access?
A
Rootkit
B
Trojan
C
Spyware
D
Worm
FreePracticeQuiz.questionLabelSecurity Architecture
Which of the following best describes a demilitarized zone (DMZ)?
A
A firewall rule designed to block incoming traffic
B
A subnet that hosts public-facing services and isolates them from the internal network
C
A segment of a network used exclusively for storing sensitive data
D
A secure VPN tunnel between two sites
FreePracticeQuiz.questionLabelSecurity Operations
Which tool would best identify vulnerabilities in an application's source code before deployment?
A
Intrusion detection system
B
Network vulnerability scanner
C
Static Application Security Testing (SAST)
D
Security Information and Event Management (SIEM)
FreePracticeQuiz.questionLabelProgram Management & Oversight
What is the goal of a business impact analysis (BIA)?
A
Define roles in an incident response team
B
Calculate the cost of implementing new technology
C
Assess the effectiveness of security policies
D
Identify critical business functions and quantify the impact of their disruption
FreePracticeQuiz.questionLabelGeneral Security Concepts
Which access control model restricts access based on policies defined by the system administrator rather than by data owners?
A
Mandatory Access Control (MAC)
B
Discretionary Access Control (DAC)
C
Role-Based Access Control (RBAC)
D
Attribute-Based Access Control (ABAC)
FreePracticeQuiz.questionLabelThreats, Vulnerabilities & Mitigations
Which type of malware uses encryption to hold a victim's data hostage until a payment is made?
A
Rootkit
B
Ransomware
C
Worm
D
Spyware
FreePracticeQuiz.questionLabelSecurity Architecture
A company deploys a bastion host in its DMZ. What is the main purpose of this host?
A
Encrypt all inbound and outbound traffic
B
Act as a firewall for the internal network
C
Provide a single hardened, monitored access point for administering internal systems
D
Host public-facing applications
FreePracticeQuiz.questionLabelSecurity Operations
Which technology is most effective at detecting insider threats within an organization?
A
Endpoint Detection and Response (EDR)
B
Intrusion Prevention Systems (IPS)
C
Data Loss Prevention (DLP) systems
D
User and Entity Behavior Analytics (UEBA)
FreePracticeQuiz.questionLabelProgram Management & Oversight
Which metric defines the maximum acceptable time to restore a system after a failure?
A
Recovery Time Objective (RTO)
B
Recovery Point Objective (RPO)
C
Mean Time Between Failures (MTBF)
D
Mean Time To Detect (MTTD)
FreePracticeQuiz.questionLabelGeneral Security Concepts
What is the purpose of security labels in mandatory access control (MAC)?
A
Monitor access attempts in real-time
B
Enforce access policies based on data classification
C
Assign user roles dynamically based on context
D
Identify and classify system vulnerabilities
FreePracticeQuiz.questionLabelThreats, Vulnerabilities & Mitigations
Which of the following is an example of a ransomware attack?
A
Monitoring user activity through a spyware program
B
Redirecting traffic from a legitimate site to a malicious one
C
Locking the user's files and demanding payment for a decryption key
D
Exploiting a vulnerability to execute unauthorized code
FreePracticeQuiz.questionLabelSecurity Architecture
What does micro-segmentation achieve in network security?
A
Implements zero trust policies across an organization
B
Encrypts all traffic within the network
C
Consolidates network traffic for better monitoring
D
Isolates individual workloads to reduce lateral movement and attack surface
FreePracticeQuiz.questionLabelSecurity Operations
An attacker exploits a publicly known vulnerability in a company's software that had a patch available. What is the best preventive measure?
A
Conduct regular vulnerability scanning combined with disciplined patch management
B
Deploy multi-factor authentication
C
Implement a web application firewall (WAF)
D
Use strong passwords for all accounts
FreePracticeQuiz.questionLabelProgram Management & Oversight
Which quantitative metric is most useful for prioritizing which risks to mitigate first?
A
Recovery Point Objective (RPO)
B
Annualized Loss Expectancy (ALE)
C
Recovery Time Objective (RTO)
D
Mean Time Between Failures (MTBF)

Progress: 0 of 30 questions completed

Ready for the full SY0-701 exam?

Get all 310+ Questions, timed simulation, and weak-area analytics. Plans from $2.99 — credits never expire.

See pricing

Frequently Asked Questions

Are these real SY0-701 practice questions?+

Yes. These 30 questions are taken directly from our 310+ Questions pool, written and reviewed by certified practitioners. They mirror the style, difficulty, and scope of the official CompTIA SY0-701 exam.

Is the SY0-701 exam hard?+

The CompTIA Security+ (SY0-701) is considered a pass-mark exam (passing score: 750 out of 900). Most candidates need 4–8 weeks of focused preparation. Use these free questions to gauge where you stand before committing to a full study plan.

How many questions are on the real SY0-701 exam?+

The official SY0-701 exam has Maximum of 90 questions.

Do I need to sign up to use these questions?+

No. These 30 questions are free and require no signup. If you want timed simulation, performance analytics, and access to all 310+ Questions, our paid plans start at $2.99 per exam with credits that never expire.

Keep studying

Full exam

CompTIA Security+ (SY0-701) details

Free practice

Microsoft SC-900

Free practice

200-301 CCNA

Free practice

Microsoft AZ-500

Pass SY0-701 on your first try

Join candidates using DummyExams to practice with realistic timed exams, detailed explanations, and weak-area analytics.

Start full SY0-701 practice exam

30 Free CompTIA SY0-701 Practice Questions

SY0-701 Practice Questions

Which of the following scenarios best demonstrates the principle of confidentiality?

What type of malware disguises itself as legitimate software to gain unauthorized access?

A malicious actor exploits a publicly readable cloud storage bucket to download sensitive files. What is the best immediate remediation?

An attacker exploits a vulnerability in a third-party library used by an application. What is the best way to mitigate this class of risk?

What is the best way to mitigate risks associated with shadow IT within an organization?

In the CIA triad, availability ensures which of the following?

What type of malware modifies its own code to avoid detection by signature-based antivirus software?

Which of the following technologies is most effective at segmenting and isolating different workloads within a cloud environment?

Which of the following is the best way to secure containers in a production environment?

What is the primary benefit of implementing governance, risk, and compliance (GRC) tools?

An attacker successfully alters a configuration file on a server without proper authorization. Which security principle has been violated?

Which type of malware executes its payload only when specific conditions are met?

What is the best way to protect API endpoints from unauthorized use?

Which security practice best ensures that a developer's new code does not introduce vulnerabilities into an application?

What does the term "risk appetite" refer to in a security context?

What does the principle of least privilege ensure?

Which type of malware is designed to operate stealthily at the kernel level, granting attackers persistent privileged access?

Which of the following best describes a demilitarized zone (DMZ)?

Which tool would best identify vulnerabilities in an application's source code before deployment?

What is the goal of a business impact analysis (BIA)?

Which access control model restricts access based on policies defined by the system administrator rather than by data owners?

Which type of malware uses encryption to hold a victim's data hostage until a payment is made?

A company deploys a bastion host in its DMZ. What is the main purpose of this host?

Which technology is most effective at detecting insider threats within an organization?

Which metric defines the maximum acceptable time to restore a system after a failure?

What is the purpose of security labels in mandatory access control (MAC)?

Which of the following is an example of a ransomware attack?

What does micro-segmentation achieve in network security?

An attacker exploits a publicly known vulnerability in a company's software that had a patch available. What is the best preventive measure?

Which quantitative metric is most useful for prioritizing which risks to mitigate first?

Ready for the full SY0-701 exam?

Frequently Asked Questions

Keep studying

Pass SY0-701 on your first try