Free · no signup · instant results

Free CompTIA Security+ SY0-701 Practice Test

Answer 25 original questions across all five Security+ domains. Get your score, a domain-by-domain breakdown, explanations for every answer, and links to authoritative references.

Start the free test Study Security+ flashcards

No account or credit card required · Nothing is saved to an account

What you are practicing

A blueprint-weighted sample of the current SY0-701 objectives

The test covers General Security Concepts; Threats, Vulnerabilities, and Mitigations; Security Architecture; Security Operations; and Security Program Management and Oversight. Questions come from CertFlashCards' reviewed SY0-701 practice form and do not use recalled certification-exam content.

Reviewed September 2026

25-question practice test

Test your Security+ readiness

Choose one answer for each question. Submit whenever you are ready; unanswered questions count as incorrect.

0of 25 answered

Question 1 of 25General security concepts · Beginner
A security team reviews authentication logs after an alert to determine whether repeated failed sign-ins occurred. Which control function is the log review primarily performing?
Choose one answer for question 1ADetectiveBPreventiveCCorrectiveDDeterrent
Question 2 of 25General security concepts · Advanced
A critical internet-facing service is being actively exploited, and the normal change board will not meet for two days. Which action best reduces risk without abandoning change control?
Choose one answer for question 2AMake an undocumented production change and close the issue if the exploit stopsBWait for the normal meeting even if exploitation continuesCGive every administrator permanent authority to bypass approval during security eventsDUse the approved emergency-change process, document risk and rollback, validate the fix, and conduct retrospective review
Question 3 of 25General security concepts · Intermediate
A service must send a large confidential file to a recipient it has never contacted before. The recipient has a trusted public key. Which design provides efficient confidentiality and a secure way to protect the temporary encryption key?
Choose one answer for question 3AHash the file and send only the digestBEncrypt the file with a random symmetric key, then protect that key with the recipient's public keyCEncrypt the file with the sender's public key and publish the private keyDEncode the file and send the encoding method in the same message
Question 4 of 25Threats, vulnerabilities, and mitigations · Beginner
A database administrator who has legitimate privileged access copies customer records to a personal drive before resigning. Which threat-actor category best fits this event?
Choose one answer for question 4ANation-state actorBUnskilled attackerCHacktivistDInsider threat
Question 5 of 25Threats, vulnerabilities, and mitigations · Advanced
Attackers compromise a software vendor's build environment and insert malicious code into a legitimately signed update delivered to customers. Which vector best describes the customer exposure?
Choose one answer for question 5AShoulder surfingBRemovable mediaCWireless disassociationDSoftware supply chain
Question 6 of 25Threats, vulnerabilities, and mitigations · Intermediate
A web application builds database queries by concatenating untrusted form input. Which development change most directly mitigates the resulting vulnerability?
Choose one answer for question 6ARename the database serverBUse parameterized queries with bound valuesCCompress each query before executionDDisplay more detailed database errors to users
Question 7 of 25Threats, vulnerabilities, and mitigations · Intermediate
Authentication logs show one common password tried once against hundreds of different usernames. Which attack is most likely?
Choose one answer for question 7ACredential stuffingBPassword sprayingCBrute force against one accountDPass-the-hash
Question 8 of 25Threats, vulnerabilities, and mitigations · Intermediate
A workstation in the finance network is compromised. Which existing design most directly limits the attacker's ability to reach engineering systems?
Choose one answer for question 8ANetwork segmentation with restrictive inter-segment rulesBEndpoint isolation rules applied onlyCA flat network with host firewalls managed independently on each workstationDA monitoring-only VLAN design that records lateral traffic but does not restrict it
Question 9 of 25Threats, vulnerabilities, and mitigations · Beginner
Endpoint monitoring confirms that a laptop is actively communicating with a command-and-control server. What should be done first to limit further spread while preserving the system for response?
Choose one answer for question 9ABlock the known command-and-control destination at the perimeter while leaving the laptop on internal networksBTerminate the observed processCShut the laptop down immediately, losing volatile evidence that the response procedure may requireDIsolate the laptop from normal network communication
Question 10 of 25Security architecture · Intermediate
A company moves a managed database to a cloud provider. Which responsibility normally remains with the company under a shared-responsibility model?
Choose one answer for question 10AClassifying its data and configuring who may access itBReplacing failed disks in the provider's data centerCMaintaining the provider's physical perimeterDHiring the provider's facilities staff
Question 11 of 25Security architecture · Advanced
Remote administrators must manage production servers. Which design best protects the management path?
Choose one answer for question 11ARequire MFA to a hardened jump host on a restricted management networkBExpose management ports publicly with shared credentialsCPermit administration from any unmanaged device after validating the affected configurationDDisable session logging and timeouts after validating the affected configuration
Question 12 of 25Security architecture · Intermediate
An organization wants to stop employees from emailing files labeled confidential to personal addresses. Which control most directly addresses this requirement?
Choose one answer for question 12AData loss prevention policy inspecting outbound emailBA load balancer after validating the affected configurationCA UPS after validating the affected configurationDA public DNS resolver after validating the affected configuration
Question 13 of 25Security architecture · Intermediate
An organization is selecting an alternate processing site. It requires a facility that is already equipped with operational hardware and maintained with current or near-current data so that operations can resume fastest, and it accepts that this option carries the highest ongoing cost. Which alternate-site type meets this requirement?
Choose one answer for question 13ACold siteBWarm siteCHot siteDGeographic dispersion of a single site's backups
Question 14 of 25Security operations · Beginner
What is the primary purpose of a secure configuration baseline?
Choose one answer for question 14ADefine an approved, repeatable starting configurationBProve a system can never be compromised after validating the affected configurationCReplace continuous monitoring after validating the affected configurationDAllow every user to change security settings
Question 15 of 25Security operations · Advanced
Failed encrypted drives containing highly sensitive data are leaving organizational control and cannot be reliably overwritten. Which disposal method offers the strongest assurance?
Choose one answer for question 15ADelete the directory entries after validating the affected configuration with the documented prerequisites confirmedBRename the volumes after validating the affected configurationCRemove the asset labels only after validating the affected configurationDPhysically destroy the media through an approved process and retain evidence
Question 16 of 25Security operations · Intermediate
Why might an authenticated vulnerability scan provide more useful host findings than an unauthenticated scan?
Choose one answer for question 16AIt guarantees no false positives after validating the affected configuration with the documented prerequisites confirmedBIt can inspect local configuration, software, and patch state with authorized accessCIt automatically fixes every issue after validating the affected configurationDIt removes the need to protect scanner credentials after validating the affected configuration
Question 17 of 25Security operations · Intermediate
Why should security log sources synchronize time to an approved reference?
Choose one answer for question 17ATo correlate event sequences accurately across systemsBTo encrypt every log automatically after validating the affected configurationCTo eliminate retention requirements after validating the affected configurationDTo prevent all clock hardware failures
Question 18 of 25Security operations · Intermediate
What is the most important immediate identity action when an employee's termination becomes effective?
Choose one answer for question 18AWait for the account to expire naturally after validating the affected configuration with the documented prerequisites confirmedBTransfer the password to a coworker after validating the affected configurationCConvert the account into a shared administrator after validating the affected configurationDDisable access and revoke active sessions according to the approved offboarding workflow
Question 19 of 25Security operations · Advanced
A responder collects a drive for possible legal proceedings. What most directly demonstrates who possessed it from collection through analysis?
Choose one answer for question 19AA screenshot of the desktop wallpaperBAn unsigned verbal summaryCA renamed evidence fileDA complete chain-of-custody record
Question 20 of 25Security operations · Advanced
An analyst needs to verify the exact payload sent during a suspicious unencrypted session. Which data source is most useful if it was captured at the time?
Choose one answer for question 20AA monthly asset countBFull packet captureCA password policyDA building visitor log
Question 21 of 25Security program management and oversight · Intermediate
Who should be accountable for deciding the classification and acceptable use of a business dataset?
Choose one answer for question 21AAny user who downloads itBThe internet service providerCThe designated data ownerDThe building receptionist
Question 22 of 25Security program management and oversight · Advanced
What is the primary output of a business impact analysis for continuity planning?
Choose one answer for question 22AA list of every internet domain after validating the affected configuration with the documented prerequisites confirmedBPrioritized business functions, impact over time, dependencies, and recovery requirementsCA guarantee that no disruption will occur after validating the affected configurationDOnly a count of employee laptops after validating the affected configuration
Question 23 of 25Security program management and oversight · Intermediate
Which document should define authorized targets, test windows, prohibited actions, communications, and stop conditions before a third-party penetration test?
Choose one answer for question 23AMarketing brochureBEmployee vacation calendarCAsset depreciation scheduleDRules of engagement
Question 24 of 25Security program management and oversight · Advanced
A privacy requirement limits personal-data collection to what is necessary for a stated purpose. Which action best supports compliance?
Choose one answer for question 24ACollect every available field in case it becomes usefulBDocument the purpose and minimize collected fields to those neededCRetain all personal data forever after validating the affected configurationDShare the data broadly without tracking recipients after validating the affected configuration
Question 25 of 25Security program management and oversight · Intermediate
Which metric best measures whether a phishing exercise improved the desired employee behavior?
Choose one answer for question 25AThe number of slides in the training deck after validating the affected configurationBThe rate and speed of reporting suspicious messages, alongside interaction ratesCThe trainer's speaking time after validating the affected configurationDThe office temperature during training after validating the affected configuration

Ready to see your score?0 of 25 questions answered

After the test

Turn your result into a study plan

Use the domain breakdown to choose where to practice next. The free Security+ flashcard deck includes explanations and official learning links; Pro adds the complete 90-question practice exam in Learning and Simulator modes.

Study Security+ free Compare Free and Pro

Security+ practice test questions

Is this practice test really free?

Yes. All 25 questions, scoring, explanations, and reference links are available without an account or payment.

Does this reproduce real CompTIA exam questions?

No. These are original study questions written against the published SY0-701 objectives. CertFlashCards does not use brain dumps or recalled exam items.

Does my score predict whether I will pass Security+?

No. The score is study feedback from a short sample. Use it to identify domains that need review, not as a certification-exam guarantee.

Unofficial practice material. CompTIA and Security+ are trademarks of CompTIA, Inc. CertFlashCards is not affiliated with or endorsed by CompTIA.

A blueprint-weighted sample of the current SY0-701 objectives

Test your Security+ readiness

A security team reviews authentication logs after an alert to determine whether repeated failed sign-ins occurred. Which control function is the log review primarily performing?

A critical internet-facing service is being actively exploited, and the normal change board will not meet for two days. Which action best reduces risk without abandoning change control?

A service must send a large confidential file to a recipient it has never contacted before. The recipient has a trusted public key. Which design provides efficient confidentiality and a secure way to protect the temporary encryption key?

A database administrator who has legitimate privileged access copies customer records to a personal drive before resigning. Which threat-actor category best fits this event?

Attackers compromise a software vendor's build environment and insert malicious code into a legitimately signed update delivered to customers. Which vector best describes the customer exposure?

A web application builds database queries by concatenating untrusted form input. Which development change most directly mitigates the resulting vulnerability?

Authentication logs show one common password tried once against hundreds of different usernames. Which attack is most likely?

A workstation in the finance network is compromised. Which existing design most directly limits the attacker's ability to reach engineering systems?

Endpoint monitoring confirms that a laptop is actively communicating with a command-and-control server. What should be done first to limit further spread while preserving the system for response?

A company moves a managed database to a cloud provider. Which responsibility normally remains with the company under a shared-responsibility model?

Remote administrators must manage production servers. Which design best protects the management path?

An organization wants to stop employees from emailing files labeled confidential to personal addresses. Which control most directly addresses this requirement?

What is the primary purpose of a secure configuration baseline?

Failed encrypted drives containing highly sensitive data are leaving organizational control and cannot be reliably overwritten. Which disposal method offers the strongest assurance?

Why might an authenticated vulnerability scan provide more useful host findings than an unauthenticated scan?

Why should security log sources synchronize time to an approved reference?

What is the most important immediate identity action when an employee's termination becomes effective?

A responder collects a drive for possible legal proceedings. What most directly demonstrates who possessed it from collection through analysis?

An analyst needs to verify the exact payload sent during a suspicious unencrypted session. Which data source is most useful if it was captured at the time?

Who should be accountable for deciding the classification and acceptable use of a business dataset?

What is the primary output of a business impact analysis for continuity planning?

Which document should define authorized targets, test windows, prohibited actions, communications, and stop conditions before a third-party penetration test?

A privacy requirement limits personal-data collection to what is necessary for a stated purpose. Which action best supports compliance?

Which metric best measures whether a phishing exercise improved the desired employee behavior?

Turn your result into a study plan

Security+ practice test questions