30 Free CompTIA SY0-701 Practice Questions

SY0-701 Practice Questions

1. Question 1.Which of the following scenarios best demonstrates the principle of confidentiality?

   • A.Encrypting sensitive files before transmission(correct answer)
   • B.Ensuring servers are available during peak hours
   • C.Detecting unauthorized changes in a document
   • D.Creating redundant backups of critical data
   Show answer & explanationHide answer

   Correct answer: A

   Encrypting sensitive files before transmission

   Explanation

   Confidentiality means keeping data readable only by authorized parties, which is exactly what encryption achieves. Detecting unauthorized changes is integrity, while availability during peak hours and redundant backups both support availability.

2. Question 2.What type of malware disguises itself as legitimate software to gain unauthorized access?

   • A.Keylogger
   • B.Trojan(correct answer)
   • C.Worm
   • D.Rootkit
   Show answer & explanationHide answer

   Correct answer: B

   Trojan

   Explanation

   A Trojan relies on the user willingly installing it because it appears useful or legitimate. A worm spreads without user action, a rootkit hides an existing compromise, and a keylogger captures keystrokes.

3. Question 3.A malicious actor exploits a publicly readable cloud storage bucket to download sensitive files. What is the best immediate remediation?

   • A.Use endpoint protection on systems accessing the bucket
   • B.Encrypt all files stored in the bucket
   • C.Remove public access and enforce identity-based access control policies(correct answer)
   • D.Enable logging to monitor access to the bucket
   Show answer & explanationHide answer

   Correct answer: C

   Remove public access and enforce identity-based access control policies

   Explanation

   The exposure is the permission model, so the fix is revoking anonymous access and requiring authenticated, authorized principals. Server-side encryption is transparent to an authorized-looking request and would not have prevented the download.

4. Question 4.An attacker exploits a vulnerability in a third-party library used by an application. What is the best way to mitigate this class of risk?

   • A.Conduct regular code reviews of first-party code
   • B.Implement a web application firewall
   • C.Remove the library from the application
   • D.Use software composition analysis and dependency scanning tools(correct answer)
   Show answer & explanationHide answer

   Correct answer: D

   Use software composition analysis and dependency scanning tools

   Explanation

   Dependency scanning inventories third-party components and flags those with known CVEs so they can be updated, which addresses the supply chain systematically. Reviewing your own code will not surface a flaw inside an imported package.

5. Question 5.What is the best way to mitigate risks associated with shadow IT within an organization?

   • A.Establish and enforce a policy defining approved services, backed by discovery of unsanctioned use(correct answer)
   • B.Monitor network traffic for unauthorized applications only
   • C.Block all unapproved software installations on endpoints
   • D.Conduct regular security awareness training
   Show answer & explanationHide answer

   Correct answer: A

   Establish and enforce a policy defining approved services, backed by discovery of unsanctioned use

   Explanation

   Shadow IT is a governance problem, so it needs a clear sanctioned-service policy plus the visibility to find deviations and a usable approved alternative. Pure blocking without a sanctioned path tends to push usage further underground.

6. Question 6.In the CIA triad, availability ensures which of the following?

   • A.Only authorized users can access data
   • B.Resources are accessible when needed(correct answer)
   • C.Data remains accurate and trustworthy
   • D.Unauthorized users are denied access
   Show answer & explanationHide answer

   Correct answer: B

   Resources are accessible when needed

   Explanation

   Availability guarantees that systems and data are reachable by authorized users whenever they are needed. Restricting access to authorized users is confidentiality, and keeping data accurate is integrity.

7. Question 7.What type of malware modifies its own code to avoid detection by signature-based antivirus software?

   • A.Spyware
   • B.Rootkit
   • C.Polymorphic malware(correct answer)
   • D.Logic bomb
   Show answer & explanationHide answer

   Correct answer: C

   Polymorphic malware

   Explanation

   Polymorphic malware rewrites or re-encrypts itself on each infection so no stable signature exists to match. Rootkits hide by subverting the operating system rather than by changing their own code.

8. Question 8.Which of the following technologies is most effective at segmenting and isolating different workloads within a cloud environment?

   • A.VLANs
   • B.Firewalls
   • C.Zero Trust Architecture
   • D.Micro-segmentation(correct answer)
   Show answer & explanationHide answer

   Correct answer: D

   Micro-segmentation

   Explanation

   Micro-segmentation applies policy per workload, so each virtual machine or container can only reach the specific peers it needs. Traditional VLANs are coarse and do not follow workloads as they move in a cloud environment.

9. Question 9.Which of the following is the best way to secure containers in a production environment?

   • A.Implement image scanning to identify vulnerabilities before deployment(correct answer)
   • B.Configure role-based access control for container administrators
   • C.Use a host-based intrusion prevention system
   • D.Encrypt all container data at rest
   Show answer & explanationHide answer

   Correct answer: A

   Implement image scanning to identify vulnerabilities before deployment

   Explanation

   Containers inherit every flaw in their base image, so scanning images in the build pipeline stops known vulnerabilities from ever reaching production. The other controls are useful but do not address vulnerable image contents.

10. Question 10.What is the primary benefit of implementing governance, risk, and compliance (GRC) tools?

    • A.Automate vulnerability scanning
    • B.Centralize the management, tracking, and reporting of risk and compliance activities(correct answer)
    • C.Improve encryption mechanisms
    • D.Prevent all cyberattacks
    Show answer & explanationHide answer

    Correct answer: B

    Centralize the management, tracking, and reporting of risk and compliance activities

    Explanation

    GRC platforms provide one system of record for policies, controls, risks, and audit evidence, replacing scattered spreadsheets. No tool prevents all attacks, and scanning is a separate technical function.

11. Question 11.An attacker successfully alters a configuration file on a server without proper authorization. Which security principle has been violated?

    • A.Availability
    • B.Non-repudiation
    • C.Integrity(correct answer)
    • D.Confidentiality
    Show answer & explanationHide answer

    Correct answer: C

    Integrity

    Explanation

    Integrity is the assurance that data has not been modified by unauthorized parties. The attacker did not prevent access (availability) or read protected data (confidentiality) — they changed it, which is an integrity violation.

12. Question 12.Which type of malware executes its payload only when specific conditions are met?

    • A.Keylogger
    • B.Trojan
    • C.Worm
    • D.Logic bomb(correct answer)
    Show answer & explanationHide answer

    Correct answer: D

    Logic bomb

    Explanation

    A logic bomb lies dormant until a trigger fires — a date, a file change, or an employee's account being removed from payroll. The delay is what makes it hard to associate with whoever planted it.

13. Question 13.What is the best way to protect API endpoints from unauthorized use?

    • A.Require strong authentication and authorization for every API call(correct answer)
    • B.Use multi-factor authentication for developers
    • C.Block traffic from all public IP addresses
    • D.Deploy static application security testing (SAST) tools
    Show answer & explanationHide answer

    Correct answer: A

    Require strong authentication and authorization for every API call

    Explanation

    Every endpoint must independently verify who is calling and whether they may perform that action, since attackers call APIs directly rather than through the UI. Blocking public addresses would break legitimate external consumers.

14. Question 14.Which security practice best ensures that a developer's new code does not introduce vulnerabilities into an application?

    • A.Continuous monitoring
    • B.Secure coding practices with peer review(correct answer)
    • C.Patch management
    • D.Network segmentation
    Show answer & explanationHide answer

    Correct answer: B

    Secure coding practices with peer review

    Explanation

    Preventing defects at authoring time through secure coding standards and review is the only control that acts before the vulnerability exists. Monitoring and patching react after code is already deployed.

15. Question 15.What does the term "risk appetite" refer to in a security context?

    • A.The total number of identified vulnerabilities
    • B.The cost of implementing a risk mitigation strategy
    • C.The amount and type of risk an organization is willing to accept in pursuit of its objectives(correct answer)
    • D.The likelihood of a threat exploiting a vulnerability
    Show answer & explanationHide answer

    Correct answer: C

    The amount and type of risk an organization is willing to accept in pursuit of its objectives

    Explanation

    Risk appetite is a governance statement set by leadership that guides which risks may be accepted and which must be treated. The likelihood of exploitation is a component of risk itself, not of appetite.

16. Question 16.What does the principle of least privilege ensure?

    • A.All users must authenticate with multi-factor authentication
    • B.Data access is monitored continuously
    • C.Privileged accounts are disabled by default
    • D.Users have minimal access necessary to perform their tasks(correct answer)
    Show answer & explanationHide answer

    Correct answer: D

    Users have minimal access necessary to perform their tasks

    Explanation

    Least privilege grants each user or process only the permissions required for its function, which shrinks the blast radius when an account is compromised. MFA is an authentication control and monitoring is a detective control; neither defines least privilege.

17. Question 17.Which type of malware is designed to operate stealthily at the kernel level, granting attackers persistent privileged access?

    • A.Rootkit(correct answer)
    • B.Trojan
    • C.Spyware
    • D.Worm
    Show answer & explanationHide answer

    Correct answer: A

    Rootkit

    Explanation

    A kernel-mode rootkit subverts the operating system itself, so the tools an administrator would use to find it report falsified results. This is why rootkit removal often requires booting from trusted external media.

18. Question 18.Which of the following best describes a demilitarized zone (DMZ)?

    • A.A firewall rule designed to block incoming traffic
    • B.A subnet that hosts public-facing services and isolates them from the internal network(correct answer)
    • C.A segment of a network used exclusively for storing sensitive data
    • D.A secure VPN tunnel between two sites
    Show answer & explanationHide answer

    Correct answer: B

    A subnet that hosts public-facing services and isolates them from the internal network

    Explanation

    A DMZ is a screened subnet where internet-reachable services live, so a compromise there does not immediately expose the internal network. Sensitive data belongs on the internal side, not in the DMZ.

19. Question 19.Which tool would best identify vulnerabilities in an application's source code before deployment?

    • A.Intrusion detection system
    • B.Network vulnerability scanner
    • C.Static Application Security Testing (SAST)(correct answer)
    • D.Security Information and Event Management (SIEM)
    Show answer & explanationHide answer

    Correct answer: C

    Static Application Security Testing (SAST)

    Explanation

    SAST analyses source or bytecode without running it, so it fits naturally into a build pipeline and catches flaws pre-release. A network scanner requires a running, reachable service and sees only its external surface.

20. Question 20.What is the goal of a business impact analysis (BIA)?

    • A.Define roles in an incident response team
    • B.Calculate the cost of implementing new technology
    • C.Assess the effectiveness of security policies
    • D.Identify critical business functions and quantify the impact of their disruption(correct answer)
    Show answer & explanationHide answer

    Correct answer: D

    Identify critical business functions and quantify the impact of their disruption

    Explanation

    A BIA determines which processes matter most and how quickly they must be restored, which is what produces RTO and RPO targets. Those targets then drive continuity and recovery investment.

21. Question 21.Which access control model restricts access based on policies defined by the system administrator rather than by data owners?

    • A.Mandatory Access Control (MAC)(correct answer)
    • B.Discretionary Access Control (DAC)
    • C.Role-Based Access Control (RBAC)
    • D.Attribute-Based Access Control (ABAC)
    Show answer & explanationHide answer

    Correct answer: A

    Mandatory Access Control (MAC)

    Explanation

    In MAC, access decisions are enforced by system-wide policy and security labels that ordinary users cannot override. DAC lets the data owner grant access at their discretion, RBAC keys off job roles, and ABAC evaluates attributes such as location or device.

22. Question 22.Which type of malware uses encryption to hold a victim's data hostage until a payment is made?

    • A.Rootkit
    • B.Ransomware(correct answer)
    • C.Worm
    • D.Spyware
    Show answer & explanationHide answer

    Correct answer: B

    Ransomware

    Explanation

    Ransomware encrypts files and withholds the decryption key pending payment, which is why tested offline backups are the primary defense. Spyware exfiltrates information quietly rather than denying access to it.

23. Question 23.A company deploys a bastion host in its DMZ. What is the main purpose of this host?

    • A.Encrypt all inbound and outbound traffic
    • B.Act as a firewall for the internal network
    • C.Provide a single hardened, monitored access point for administering internal systems(correct answer)
    • D.Host public-facing applications
    Show answer & explanationHide answer

    Correct answer: C

    Provide a single hardened, monitored access point for administering internal systems

    Explanation

    A bastion host, or jump box, funnels administrative access through one heavily hardened and audited system rather than exposing management interfaces directly. It is a control point for administrators, not a general application server.

24. Question 24.Which technology is most effective at detecting insider threats within an organization?

    • A.Endpoint Detection and Response (EDR)
    • B.Intrusion Prevention Systems (IPS)
    • C.Data Loss Prevention (DLP) systems
    • D.User and Entity Behavior Analytics (UEBA)(correct answer)
    Show answer & explanationHide answer

    Correct answer: D

    User and Entity Behavior Analytics (UEBA)

    Explanation

    Insiders use authorized access, so the detection signal is deviation from their established behavioural baseline, which is exactly what UEBA models. EDR and IPS are tuned for malicious code and network exploits rather than legitimate-looking misuse.

25. Question 25.Which metric defines the maximum acceptable time to restore a system after a failure?

    • A.Recovery Time Objective (RTO)(correct answer)
    • B.Recovery Point Objective (RPO)
    • C.Mean Time Between Failures (MTBF)
    • D.Mean Time To Detect (MTTD)
    Show answer & explanationHide answer

    Correct answer: A

    Recovery Time Objective (RTO)

    Explanation

    RTO is the target duration for restoring service, while RPO expresses how much data loss is tolerable measured backwards in time. MTBF is a reliability statistic rather than a recovery objective.

26. Question 26.What is the purpose of security labels in mandatory access control (MAC)?

    • A.Monitor access attempts in real-time
    • B.Enforce access policies based on data classification(correct answer)
    • C.Assign user roles dynamically based on context
    • D.Identify and classify system vulnerabilities
    Show answer & explanationHide answer

    Correct answer: B

    Enforce access policies based on data classification

    Explanation

    MAC attaches a classification label (for example Confidential or Secret) to each object and a clearance to each subject, and the system permits access only when the clearance dominates the label. Dynamic role assignment describes ABAC, not MAC.

27. Question 27.Which of the following is an example of a ransomware attack?

    • A.Monitoring user activity through a spyware program
    • B.Redirecting traffic from a legitimate site to a malicious one
    • C.Locking the user's files and demanding payment for a decryption key(correct answer)
    • D.Exploiting a vulnerability to execute unauthorized code
    Show answer & explanationHide answer

    Correct answer: C

    Locking the user's files and demanding payment for a decryption key

    Explanation

    The defining behaviour of ransomware is denying the owner access to their own data and demanding payment to restore it. The other options describe remote code execution, spyware, and redirection attacks respectively.

28. Question 28.What does micro-segmentation achieve in network security?

    • A.Implements zero trust policies across an organization
    • B.Encrypts all traffic within the network
    • C.Consolidates network traffic for better monitoring
    • D.Isolates individual workloads to reduce lateral movement and attack surface(correct answer)
    Show answer & explanationHide answer

    Correct answer: D

    Isolates individual workloads to reduce lateral movement and attack surface

    Explanation

    Micro-segmentation enforces policy at the workload level, so a compromised host cannot freely reach its neighbours. It is an enabler of zero trust rather than the whole model, and it provides no encryption by itself.

29. Question 29.An attacker exploits a publicly known vulnerability in a company's software that had a patch available. What is the best preventive measure?

    • A.Conduct regular vulnerability scanning combined with disciplined patch management(correct answer)
    • B.Deploy multi-factor authentication
    • C.Implement a web application firewall (WAF)
    • D.Use strong passwords for all accounts
    Show answer & explanationHide answer

    Correct answer: A

    Conduct regular vulnerability scanning combined with disciplined patch management

    Explanation

    Known vulnerabilities with available fixes are addressed by finding them through scanning and remediating them on a defined schedule. A WAF may block some exploit attempts but leaves the underlying flaw in place.

30. Question 30.Which quantitative metric is most useful for prioritizing which risks to mitigate first?

    • A.Recovery Point Objective (RPO)
    • B.Annualized Loss Expectancy (ALE)(correct answer)
    • C.Recovery Time Objective (RTO)
    • D.Mean Time Between Failures (MTBF)
    Show answer & explanationHide answer

    Correct answer: B

    Annualized Loss Expectancy (ALE)

    Explanation

    ALE combines the expected loss per incident with how often it is expected to occur, giving a comparable annual figure across dissimilar risks. RTO and RPO are recovery targets rather than prioritization metrics.

Frequently Asked Questions

Keep studying

Full exam

CompTIA CompTIA Security+ (SY0-701) details

Free practice

Microsoft SC-900

Free practice

200-301 CCNA

Free practice

Microsoft AZ-500