Passing CompTIA Security+ requires recognizing security problems, selecting appropriate controls, and making defensible decisions when several answers appear correct. This 2026 practice test contains 100 original, scenario-based questions covering the SY0-701 exam objectives, with detailed explanations of the reasoning behind each answer. Security+ V8 (SY0-801) is expected in November 2026, so verify your examination version before studying. Use these scenarios to diagnose knowledge gaps, strengthen hands-on cybersecurity skills, improve technical interview performance, and build practical security expertise.
1) Security+ Practice Test 2026: Exam Blueprint, Scoring Strategy, and Decision-Making Framework
The CompTIA Security+ SY0-701 examination contains a maximum of 90 questions, combining multiple-choice and performance-based questions (PBQs). Candidates receive 90 minutes and need a scaled score of 750 on a 100–900 scale. CompTIA does not publish a direct conversion between percentage correct and the passing score.
This 100-question practice bank deliberately extends beyond the actual exam's maximum question count to provide broader coverage. Its distribution follows the official SY0-701 domain weights:
General Security Concepts (12%): Questions 1–12.
Threats, Vulnerabilities, and Mitigations (22%): Questions 13–34.
Security Architecture (18%): Questions 35–52.
Security Operations (28%): Questions 53–80.
Security Program Management and Oversight (20%): Questions 81–100.
For a diagnostic attempt, answer all 100 questions before reviewing the explanations. Allow approximately 100 minutes for the extended set. In a separate examination rehearsal, practise completing a 90-question mixed set within the official 90-minute limit, including performance-based exercises.
Record three things for every missed question: the technical concept you misunderstood, the clue you overlooked, and the condition that would make a different option correct. This method produces more meaningful improvement than memorizing answer letters.
Candidates struggling with network interpretation should strengthen their CCNA-level networking foundations. Those missing investigative questions should practise SOC analyst technical scenarios, build a beginner SOC home lab, and compare their approach against real SOC hiring expectations.
Before attempting the questions, study this 30-scenario decision matrix. It highlights distinctions that commonly cause candidates to select a technically plausible but less appropriate answer.
Security+ 2026: 30-Scenario Decision Matrix
Identify the decisive clue, choose the strongest control, and avoid the common examination trap.
| Scenario Signal | Best Response | Why It Works | Common Trap |
|---|---|---|---|
| 1. Stolen password used against another website | Credential-stuffing defenses | Checks leaked credentials against accounts | Confusing stuffing with spraying |
| 2. One common password tried against many accounts | Password-spraying detection | Identifies low-volume distributed attempts | Expecting repeated failures per account |
| 3. SQL query changed through user input | Parameterized queries | Separates executable SQL from supplied data | Relying only on input length restrictions |
| 4. Browser executes an attacker-supplied script | Context-aware output encoding | Prevents data from becoming browser code | Assuming a firewall fixes rendering flaws |
| 5. Authenticated browser sends a forged request | Anti-CSRF token | Validates request authorization context | Using encryption as the primary remedy |
| 6. Application fetches internal URLs for attacker | SSRF protections | Restricts destinations and outbound requests | Assuming all backend requests are trusted |
| 7. Compromised endpoint generates suspicious processes | EDR isolation | Limits spread while retaining telemetry | Wiping the system before collecting evidence |
| 8. Alerts require correlation across multiple sources | SIEM | Centralizes and correlates security events | Confusing collection with automated prevention |
| 9. Traffic must be blocked automatically on detection | IPS | Enforces network prevention decisions | Selecting passive IDS monitoring |
| 10. Device compliance checked before network admission | NAC | Evaluates endpoint access conditions | Using a VPN as a posture-checking substitute |
| 11. Unauthorized cloud application usage | CASB or SaaS security controls | Improves visibility and policy enforcement | Assuming traditional perimeter controls suffice |
| 12. Sensitive records leaving through email | DLP | Identifies and restricts protected data movement | Choosing malware detection alone |
| 13. Cloud storage publicly accessible | Permissions review and CSPM | Corrects exposure and detects misconfiguration | Blaming the physical cloud provider |
| 14. Lateral movement between internal workloads | Microsegmentation | Restricts unnecessary east-west access | Relying exclusively on perimeter firewalls |
| 15. Unknown devices connect to corporate Wi-Fi | 802.1X with NAC | Authenticates access and evaluates device posture | Depending only on a shared Wi-Fi password |
| 16. Privileged access required temporarily | Just-in-time PAM | Limits standing administrative privileges | Granting permanent administrator membership |
| 17. User permissions depend on department and duties | RBAC | Assigns permissions through defined roles | Creating unnecessary individual exceptions |
| 18. Access depends on device, location, and sensitivity | ABAC | Evaluates attributes and contextual conditions | Assuming roles alone cover all conditions |
| 19. Lost encrypted laptop | Full-disk encryption | Protects stored information when properly locked | Confusing encryption with remote deletion |
| 20. Production card numbers needed in testing | Tokenization or synthetic data | Reduces exposure of actual payment data | Copying unrestricted production datasets |
| 21. Maximum acceptable data loss | RPO | Defines recovery-point tolerance | Confusing data age with restoration time |
| 22. Maximum acceptable service outage | RTO | Defines the recovery-time target | Confusing service downtime with lost data |
| 23. Backups are vulnerable to ransomware | Immutable or offline copies | Limits attacker ability to alter recovery data | Assuming synchronization is backup protection |
| 24. Exploited vulnerability on an internet-facing server | Risk-prioritized remediation | Considers active exploitation and exposure | Using CVSS alone to determine urgency |
| 25. Incident evidence may enter litigation | Chain of custody | Documents handling, transfers, and integrity | Failing to record who accessed evidence |
| 26. Security alerts require repetitive response actions | SOAR playbooks | Orchestrates authorized response workflows | Automating destructive actions without safeguards |
| 27. Risk evaluated after safeguards are applied | Residual risk | Measures remaining exposure | Reporting inherent risk as the final result |
| 28. Vendor claims its controls operated effectively | SOC 2 Type II report | Examines controls over a defined period | Confusing design-at-a-date with operating history |
| 29. Staff repeatedly mishandle phishing messages | Targeted awareness training | Corrects observable decision-making weaknesses | Providing generic annual training only |
| 30. Security team must rehearse crisis decisions | Tabletop exercise | Tests roles, escalation, and response decisions | Assuming a vulnerability scan tests leadership |
Study tip: Identify the required security outcome before selecting a tool. Prevention, detection, containment, recovery, and governance solve different parts of the same incident.
2) Security+ Practice Questions 1–34: General Security Concepts, Threats, and Vulnerabilities
General Security Concepts (Questions 1–12)
Q1. A warehouse installs prominent signs warning visitors that security cameras monitor the facility. What type of security control do the signs represent?
A. Corrective
B. Deterrent
C. Detective
D. Compensating
Answer: B — Deterrent. Warning signs discourage unauthorized behavior before it occurs. Camera recordings are detective controls, while deterrence influences an attacker's decision. This distinction is important when evaluating security monitoring responsibilities and explaining preventive versus detective security measures.
Q2. An organization cannot patch a legacy financial application. Its security team isolates the application within a restricted network segment. Which control classification best describes this protection?
A. Compensating
B. Corrective
C. Deterrent
D. Directive
Answer: A — Compensating. Network isolation reduces exposure when the preferred control, patching, cannot be implemented. It does not eliminate the underlying vulnerability. Similar compensating safeguards appear in cybersecurity risk management and GRC security assessments.
Q3. An employee accidentally sends an encrypted database backup to an unauthorized recipient. The recipient cannot decrypt its contents. Which security objective was primarily protected?
A. Availability
B. Integrity
C. Confidentiality
D. Non-repudiation
Answer: C — Confidentiality. Proper encryption protects information from unauthorized disclosure, assuming the recipient lacks the decryption key. Encryption alone does not prove the backup's integrity or guarantee availability. This principle is foundational for privacy analysts and security policy professionals.
Q4. A software distributor publishes a SHA-256 digest through a trusted channel. Customers calculate the downloaded file's digest and compare the values. What are they primarily verifying?
A. File confidentiality
B. File integrity
C. User authentication
D. Service availability
Answer: B — File integrity. Matching cryptographic hashes provide strong evidence that the file matches the trusted reference. A hash alone does not authenticate its publisher; the reference must be trustworthy. Practising such validation supports technical cybersecurity assessments and verifiable security portfolio work.
Q5. A hospital experiences brief electricity outages that repeatedly interrupt access to patient records. Which solution provides the most immediate continuity?
A. A web application firewall
B. An uninterruptible power supply
C. Database tokenization
D. Multifactor authentication
Answer: B — An uninterruptible power supply. A UPS maintains temporary power during short interruptions, allowing continued operation or controlled shutdown. Longer outages require generators or alternate power arrangements. Understanding layered resilience matters in security engineering careers and operational risk management.
Q6. A company needs recipients to verify that a contract originated from an authorized executive and remained unchanged. Which mechanism best satisfies both requirements?
A. Symmetric encryption
B. Digital signature
C. Data compression
D. Network segmentation
Answer: B — Digital signature. The executive signs with a private key, and recipients verify using the associated public key. Proper certificate validation links the key to the signer. Digital signatures support integrity and non-repudiation, central concepts in cybersecurity compliance and digital identity management.
Q7. An employee authenticates successfully from an unfamiliar device. The organization requires device compliance and contextual verification before granting access to sensitive applications. Which principle is being applied?
A. Implicit network trust
B. Zero Trust
C. Open authentication
D. Security through obscurity
Answer: B — Zero Trust. Access decisions consider identity, device condition, and context rather than treating the internal network as inherently trustworthy. Continuous evaluation reduces exposure when credentials are compromised. This is relevant to identity security careers and digital identity specialist responsibilities.
Q8. An employee successfully logs into a payroll system but receives an access-denied message when opening executive salary records. Which process prevented access?
A. Authentication
B. Authorization
C. Accounting
D. Federation
Answer: B — Authorization. Authentication establishes identity; authorization determines permitted actions and resources. The login succeeded, but the user's permissions excluded executive records. Understanding this distinction helps with IAM career preparation and technical security interviews.
Q9. A firewall update unexpectedly blocks a critical payment gateway. The change request contains approved restoration instructions. What should the administrator use first to restore the previous working configuration?
A. Risk transfer plan
B. Backout plan
C. Disaster declaration
D. Annual audit
Answer: B — Backout plan. A backout plan identifies steps for reversing unsuccessful changes and restoring service. Testing rollback procedures before deployment limits operational disruption. This is a valuable competency for security automation engineers and senior security professionals.
Q10. A browser rejects an otherwise valid server certificate because the server fails to supply the required intermediate certificate. What should the administrator correct?
A. Disable certificate validation
B. Install the appropriate intermediate certificate chain
C. Replace TLS with HTTP
D. Reduce the encryption key length
Answer: B — Install the appropriate intermediate certificate chain. Clients need a valid certification path to a trusted root. Correcting the chain resolves incomplete trust-path configuration without weakening authentication. Certificate troubleshooting frequently appears in cybersecurity technical tests and security engineering portfolio projects.
Q11. An attacker obtains a database containing password hashes. Investigators discover that identical passwords produce different hashes across user accounts. Which protection most likely explains this?
A. Per-user random salts
B. Shared encryption keys
C. Network address translation
D. Data compression
Answer: A — Per-user random salts. Unique salts change the input to password hashing, disrupting precomputed rainbow-table attacks and hiding identical-password patterns. Salting does not make weak passwords safe against offline guessing. This distinction matters in technical interview preparation and hands-on cybersecurity learning.
Q12. A laptop containing confidential customer files is stolen while powered off. Which implemented control most directly protects its local stored data?
A. Full-disk encryption
B. Network intrusion detection
C. Email filtering
D. DNSSEC
Answer: A — Full-disk encryption. Properly configured full-disk encryption protects data on a powered-off device against unauthorized storage access. Its protection can be weakened by exposed recovery keys or compromised credentials. Endpoint safeguards are important for security operations practitioners and privacy-focused cybersecurity careers.
Threats, Vulnerabilities, and Mitigations (Questions 13–34)
Q13. An attacker researches a company's procurement process and emails a purchasing employee a malicious document disguised as a supplier invoice. Which attack is occurring?
A. Spear phishing
B. Password spraying
C. DNS poisoning
D. Cryptojacking
Answer: A — Spear phishing. The message targets a specific employee using relevant organizational information. Its convincing context distinguishes it from broad, untargeted phishing campaigns. Investigating targeted messages is useful preparation for SOC analyst jobs and security awareness responsibilities.
Q14. A fraudulent email impersonates the company's board chair and requests an urgent confidential transfer from the chief financial officer. Which phishing category best describes this attack?
A. Smishing
B. Whaling
C. Pharming
D. Watering-hole attack
Answer: B — Whaling. Whaling targets senior executives or other high-value individuals, commonly using authority and urgency to trigger financial fraud. The privileged target distinguishes it from ordinary spear phishing. This threat belongs in enterprise risk assessments and cybersecurity governance programs.
Q15. A customer receives a text claiming that their bank account is suspended. The message directs them to a fraudulent login page. What is the delivery method?
A. Vishing
B. Smishing
C. Shoulder surfing
D. Tailgating
Answer: B — Smishing. Smishing delivers phishing attempts through SMS or similar messaging channels. The malicious website may harvest credentials, but the question asks about the message delivery method. Recognizing that distinction strengthens analyst incident triage and cybersecurity awareness training.
Q16. An attacker calls the help desk pretending to be a locked-out executive and pressures staff to reset an MFA method. Which social-engineering technique is being used?
A. Vishing
B. DNS tunneling
C. Pass-the-hash
D. SQL injection
Answer: A — Vishing. Voice-based phishing manipulates employees into disclosing information or performing unauthorized account actions. A callback to a trusted registered number and established identity-verification procedures reduce the risk. These controls are central to IAM operations and security awareness programs.
Q17. A user receives 20 unexpected authentication approval notifications in five minutes. What should the user do first?
A. Approve one request to stop the notifications
B. Ignore the notifications indefinitely
C. Deny the requests and report the activity
D. Disable all account logging
Answer: C — Deny the requests and report the activity. MFA fatigue attacks repeatedly prompt users, hoping they will approve unauthorized access. Security teams should investigate the attempted sign-ins and consider phishing-resistant authentication. The scenario illustrates identity threat monitoring and SOC alert investigation.
Q18. Authentication logs show one common password attempted against hundreds of usernames, with few attempts against each individual account. Which attack is most likely?
A. Credential stuffing
B. Password spraying
C. Brute forcing one account
D. Session hijacking
Answer: B — Password spraying. Spraying distributes a small number of password guesses across many accounts to reduce per-account lockout events. Detection should correlate attempts across identities and source infrastructure. Practise recognizing such patterns through SIEM home-lab projects and SOC investigation questions.
Q19. Attackers use username-password combinations exposed in a retail breach to access accounts on an unrelated travel website. What attack is this?
A. Credential stuffing
B. Password spraying
C. ARP spoofing
D. Privilege escalation
Answer: A — Credential stuffing. Attackers test previously compromised credentials across services, exploiting password reuse. MFA, breached-password screening, and bot defenses reduce success. Understanding credential reuse is important for identity management specialists and security analysts examining authentication logs.
Q20. A web application constructs database queries by concatenating search-box input. Attackers manipulate the query to expose unauthorized records. Which remediation addresses the root cause?
A. Disable database logging
B. Use parameterized queries
C. Increase session timeout
D. Compress SQL responses
Answer: B — Use parameterized queries. Parameterization separates user-supplied data from SQL instructions, preventing input from altering query structure. A WAF may provide supplementary protection, but cannot replace correct query construction. This is essential for application security portfolios and penetration-testing career preparation.
Q21. Attackers submit a malicious script through a customer comment field. Other visitors' browsers execute the script when viewing the page. Which vulnerability is present?
A. Cross-site scripting
B. CSRF
C. DNS amplification
D. Integer underflow
Answer: A — Cross-site scripting. Stored XSS occurs when attacker-controlled content persists and executes in other users' browsers. Context-aware output encoding and safe rendering are primary protections; Content Security Policy adds defense in depth. This scenario belongs in offensive security training and technical project demonstrations.
Q22. A logged-in user visits a malicious website that silently submits a money-transfer request to their bank using the user's existing session. Which protection most directly addresses this attack?
A. Anti-CSRF tokens
B. Disk encryption
C. Network load balancing
D. Password salting
Answer: A — Anti-CSRF tokens. An unpredictable request token helps the server distinguish authorized application requests from forged cross-site submissions. SameSite cookies and origin validation provide additional protection. Understanding these layers strengthens cybersecurity technical assessments and security engineering skills.
Q23. A website accepts a URL and retrieves content from it. An attacker supplies an internal cloud metadata endpoint, causing the backend to disclose sensitive information. What vulnerability is being exploited?
A. CSRF
B. Server-side request forgery
C. Reflected XSS
D. Clickjacking
Answer: B — Server-side request forgery. SSRF manipulates a trusted server into making unintended requests. Destination allowlisting, network egress restrictions, and hardened metadata access mitigate the exposure. This is increasingly important in cloud security careers and penetration-testing investigations.
Q24. A legacy service crashes when attackers send an unusually large input that overwrites memory outside an allocated buffer. Which vulnerability best explains the failure?
A. Buffer overflow
B. Credential stuffing
C. DNS poisoning
D. Session fixation
Answer: A — Buffer overflow. Improper memory bounds handling allows writes beyond allocated space, potentially causing crashes or code execution. Bounds checking and memory-safe development address the underlying defect; ASLR and DEP add exploit resistance. These concepts support hands-on penetration-testing knowledge and technical cybersecurity assessments.
Q25. An attacker modifies a download path to include ../../ sequences and retrieves a configuration file outside the intended directory. What is the vulnerability?
A. Directory traversal
B. DNS spoofing
C. Session replay
D. ARP poisoning
Answer: A — Directory traversal. The application permits path manipulation that escapes its intended directory. Canonicalizing paths, enforcing an approved root directory, and restricting filesystem permissions reduce exposure. Investigating this behavior provides useful evidence for application security projects and technical security interviews.
Q26. A trusted software update introduces malicious code because an attacker compromised a third-party dependency. Which threat category best describes the incident?
A. Supply-chain compromise
B. Password spraying
C. Social engineering only
D. Physical tampering only
Answer: A — Supply-chain compromise. Attackers exploit a dependency, vendor, or distribution mechanism trusted by the victim. Dependency inventories, provenance verification, vendor evaluation, and software bill of materials practices improve visibility. Supply-chain exposure is especially relevant to third-party risk specialists and cybersecurity auditors.
Q27. A file server begins encrypting shared documents and displays a ransom demand. The attack may still be spreading. What should the incident responder prioritize?
A. Immediately pay the ransom
B. Isolate affected systems according to the response plan
C. Delete all security logs
D. Publicly restore every backup immediately
Answer: B — Isolate affected systems according to the response plan. Containment limits additional encryption and lateral movement. Evidence preservation, scope assessment, eradication, and verified recovery follow established incident procedures. The sequence is essential for SOC analyst investigations and security operations career development.
Q28. Malware exploits an unpatched network service to spread automatically between systems without additional user interaction. Which malware category best fits?
A. Trojan
B. Worm
C. Logic bomb
D. Spyware
Answer: B — Worm. Worms can self-propagate by exploiting network weaknesses or other automated spread mechanisms. Segmentation, timely patching, and monitoring restrict transmission. The distinction is useful when building SOC detection laboratories and learning incident response analysis.
Q29. Investigators discover malware that manipulates operating-system components to conceal malicious processes and resist detection. What type of malware is most consistent with this behavior?
A. Rootkit
B. Adware
C. Worm
D. Fileless phishing message
Answer: A — Rootkit. Rootkits provide stealth and may maintain privileged access by manipulating system components. Trusted offline scanning and integrity verification can help investigate deeply compromised systems. This knowledge supports endpoint investigation skills and SOC technical competency.
Q30. An attacker creates a wireless access point using the same network name as a nearby café and tricks visitors into connecting. Which attack is occurring?
A. Evil twin
B. VLAN hopping
C. DNS zone transfer
D. MAC flooding
Answer: A — Evil twin. A malicious access point imitates a legitimate wireless network to capture traffic or facilitate further attacks. Proper network authentication, certificate validation, and trusted VPN usage can reduce exposure. Wireless security knowledge supports networking certification preparation and practical security laboratories.
Q31. A malicious device sends forged ARP messages so that local network traffic intended for the default gateway passes through the attacker. Which switch feature most directly reduces this risk?
A. Dynamic ARP Inspection
B. Port mirroring
C. DNS forwarding
D. Link aggregation
Answer: A — Dynamic ARP Inspection. DAI validates ARP information against trusted bindings, commonly established through DHCP snooping. Incorrect trust configuration can cause operational disruption, so legitimate network topology matters. This is an important distinction for networking foundations and network-focused security labs.
Q32. Users attempting to reach a legitimate banking domain are redirected because forged DNS responses polluted the recursive resolver's cache. Which control helps validate DNS data authenticity?
A. DNSSEC validation
B. Full-disk encryption
C. ARP inspection
D. Wireless isolation
Answer: A — DNSSEC validation. DNSSEC validates cryptographic signatures on DNS data within a trusted chain, helping detect forged responses. It does not encrypt DNS queries or guarantee website safety. This distinction is useful in technical security assessments and network security training.
Q33. An accounts-payable employee receives an apparently legitimate supplier email asking for payment to a newly opened bank account. What is the strongest verification step?
A. Trust the existing email conversation
B. Call the supplier using previously verified contact information
C. Approve the payment because the message uses company branding
D. Ask the same email sender to confirm the request
Answer: B — Call the supplier using previously verified contact information. Business email compromise can involve convincing impersonation or hijacked correspondence. Independent verification breaks the attacker's communication channel. Financial fraud controls are essential in enterprise risk management and security governance programs.
Q34. Employees connecting to a company portal through public Wi-Fi receive browser warnings that the server certificate does not match the requested domain. What should the security team recommend?
A. Bypass the warning for faster access
B. Disable TLS verification
C. Stop the connection and investigate the certificate mismatch
D. Switch to an older encryption protocol
Answer: C — Stop the connection and investigate the certificate mismatch. A hostname mismatch may indicate misconfiguration or interception. Verifying the certificate and destination prevents users from blindly trusting an attacker-controlled endpoint. The same reasoning is tested in cybersecurity interview laboratories and network security investigations.
3) Security+ Practice Questions 35–52: Security Architecture, Cloud Security, and Business Resilience
Q35. A company hosts a public website that communicates with a confidential internal customer database. Where should the public-facing web server be placed?
A. Directly inside the database subnet
B. In a segmented DMZ
C. On the domain controller
D. Inside the backup network
Answer: B — In a segmented DMZ. A demilitarized zone separates internet-facing services from sensitive internal systems. Firewall rules should allow only necessary application-to-database communication. Designing these boundaries is valuable for security architecture portfolio projects and cloud security career development.
Q36. An attacker compromises one application server but cannot reach neighboring workloads because each application has tightly restricted communication rules. What architectural approach provides this protection?
A. Network flattening
B. Microsegmentation
C. Shared administrative access
D. Unrestricted routing
Answer: B — Microsegmentation. Microsegmentation restricts lateral movement by defining granular communication policies between workloads. It is especially useful when systems share virtualized or cloud infrastructure. This approach matters in security engineering roles and practical infrastructure security projects.
Q37. Two company offices need a persistent encrypted connection across the public internet, allowing their internal networks to communicate securely. Which solution best fits?
A. Site-to-site IPsec VPN
B. Public FTP server
C. Network hub
D. HTTP proxy without encryption
Answer: A — Site-to-site IPsec VPN. IPsec provides encrypted connectivity between networks over an untrusted transport. Its tunnel configuration protects interoffice traffic without requiring each user to establish a separate remote-access session. VPN design is useful in CCNA networking preparation and security infrastructure laboratories.
Q38. Contractors require access to one internal application, but the organization wants to avoid exposing its broader internal network. Which architecture provides the most appropriate access model?
A. Full-tunnel unrestricted VPN
B. Zero Trust Network Access
C. Public anonymous access
D. Direct database access
Answer: B — Zero Trust Network Access. ZTNA grants access to specific applications according to identity, device, and contextual policies. It reduces broad network exposure associated with unrestricted remote connectivity. This principle underpins IAM security careers and enterprise identity architecture.
Q39. A company runs virtual machines on a public cloud provider. Who is generally responsible for configuring the guest operating system's security settings?
A. The cloud provider exclusively
B. The customer
C. The internet service provider
D. The certificate authority
Answer: B — The customer. In a typical IaaS model, the provider manages the underlying physical infrastructure while the customer secures its operating systems, applications, and access configurations. Responsibility varies by service model. Understanding those boundaries is critical for cloud security professionals and risk management specialists.
Q40. A business adopts a SaaS customer relationship management platform. The provider operates the software, but employees begin uploading confidential records without classification. What remains the customer's responsibility?
A. Physical server replacement
B. Customer data governance and access permissions
C. Data-center cooling
D. Physical network cabling
Answer: B — Customer data governance and access permissions. SaaS providers handle substantial infrastructure and application responsibilities, while customers remain accountable for appropriate data use, identity configuration, and applicable compliance obligations. These are core competencies for privacy analysts and cybersecurity compliance specialists.
Q41. A security team discovers that several cloud storage resources allow unrestricted public access despite an internal policy requiring private access. Which solution provides ongoing visibility into these configuration violations?
A. CSPM
B. Traditional antivirus alone
C. Password manager
D. Standalone vulnerability disclosure form
Answer: A — CSPM. Cloud Security Posture Management identifies cloud misconfigurations and policy deviations across environments. Corrective action may involve permissions changes, automation, or preventive guardrails. This is valuable for cloud security career progression and automation engineering.
Q42. A public shopping website experiences repeated application-layer attacks involving malicious request parameters. Which security control is best suited to inspect and filter those HTTP requests?
A. Web application firewall
B. Unmanaged network switch
C. File encryption utility
D. Offline backup tape
Answer: A — Web application firewall. A WAF examines HTTP traffic and applies application-aware detection or blocking rules. It provides additional defense against common web attacks, while secure application development remains necessary. WAF configuration offers practical material for cybersecurity portfolio projects and security technical assessments.
Q43. An infrastructure team deploys cloud environments using configuration files stored in a source repository. An unauthorized edit weakens firewall settings. Which process most directly reduces recurrence?
A. Disable version tracking
B. Require reviewed infrastructure-as-code changes
C. Allow unrestricted console modifications
D. Remove deployment logs
Answer: B — Require reviewed infrastructure-as-code changes. Version-controlled changes, automated policy checks, and required approvals help prevent insecure infrastructure modifications. Drift detection catches differences between approved definitions and deployed environments. This process is relevant to cybersecurity automation engineering and cloud security practice.
Q44. A development team finds a vulnerable library inside dozens of deployed containers. What remediation strategy most effectively addresses the affected deployments?
A. Rebuild and redeploy patched container images
B. Modify only the host wallpaper
C. Increase container log retention
D. Disable all container scanning permanently
Answer: A — Rebuild and redeploy patched container images. Updating the dependency, rebuilding verified images, and replacing vulnerable instances addresses the risk consistently. Image scanning and provenance controls help prevent recurrence. This workflow strengthens security engineering portfolios and automation-related cybersecurity skills.
Q45. A manufacturing plant operates industrial controllers that cannot tolerate unexpected downtime. The security team needs to update vulnerable equipment. What consideration deserves the highest priority?
A. Install patches immediately without testing
B. Coordinate safety assessments and approved maintenance windows
C. Disable every safety mechanism
D. Connect controllers directly to public networks
Answer: B — Coordinate safety assessments and approved maintenance windows. Operational technology changes require attention to safety, availability, vendor requirements, and recovery plans. Unvalidated updates can disrupt physical processes. These considerations are important in cybersecurity risk management and senior security leadership.
Q46. A hotel deploys hundreds of smart locks and cameras. Administrators want to minimize the impact if a poorly maintained device becomes compromised. What is the strongest network-level safeguard?
A. Place all IoT devices on the payroll subnet
B. Separate IoT devices into restricted network segments
C. Disable all monitoring
D. Share one administrator password across devices
Answer: B — Separate IoT devices into restricted network segments. Segmentation limits access between IoT devices and sensitive business systems. Device inventories, firmware maintenance, and secure credentials add further protection. These principles strengthen network security fundamentals and hands-on infrastructure security projects.
Q47. A development team needs realistic customer records for software testing but must prevent developers from viewing actual personal information. Which technique is appropriate?
A. Data masking
B. Unrestricted production replication
C. Disabling authentication
D. Publishing customer records
Answer: A — Data masking. Masking replaces or obscures sensitive elements while preserving useful data characteristics. For stronger privacy protection, synthetic data may be preferable when realistic production records are unnecessary. This is relevant to privacy-focused cybersecurity work and regulatory compliance roles.
Q48. A retailer replaces stored payment card numbers with reference values that only an authorized token service can map back to the original numbers. Which protection is being used?
A. Tokenization
B. Data compression
C. DNS filtering
D. Password hashing
Answer: A — Tokenization. Tokenization substitutes sensitive values with references, reducing the need to expose actual card data throughout connected systems. Its security depends on protecting the token vault and detokenization process. This is valuable for cybersecurity compliance careers and security audit responsibilities.
Q49. An organization transfers confidential documents between a browser and its internal application over an untrusted network. Which protocol best provides encrypted transport and server authentication?
A. HTTP
B. Telnet
C. HTTPS using properly configured TLS
D. FTP
Answer: C — HTTPS using properly configured TLS. TLS protects data in transit and allows clients to authenticate the server through certificate validation. Correct hostname verification and trusted certificate chains remain essential. This understanding supports network security interviews and security infrastructure practice.
Q50. A financial application can tolerate losing at most 15 minutes of transactions following a disaster. Which recovery metric expresses this requirement?
A. MTTR
B. RTO
C. RPO
D. MTTD
Answer: C — RPO. Recovery Point Objective defines the maximum acceptable amount of data loss measured in time. An RPO of 15 minutes requires recovery data sufficiently recent to meet that target. RTO measures restoration time separately. Both concepts matter in enterprise risk management and cybersecurity leadership planning.
Q51. An online service operates across two active data centers, both processing normal customer requests. If one fails, the other continues handling traffic. Which design describes the arrangement?
A. Cold standby
B. Active-active architecture
C. Offline archival storage
D. Single point of failure
Answer: B — Active-active architecture. Both locations handle production traffic during normal operation, providing availability if one becomes unavailable. Proper replication, application-state handling, and capacity planning remain necessary. These principles are valuable for security architecture projects and operational resilience management.
Q52. Ransomware operators obtain administrative access and delete all reachable backup copies. Which backup design would have most directly reduced their ability to destroy recovery data?
A. Synchronizing files to one shared directory
B. Maintaining isolated immutable or offline backup copies
C. Using the same administrator account everywhere
D. Storing backups exclusively on the infected server
Answer: B — Maintaining isolated immutable or offline backup copies. Isolation and immutability restrict attacker access to recovery data. Backups still require integrity checks and restoration testing to establish recoverability. This defensive architecture is important for SOC incident response and enterprise cybersecurity risk programs.
Quick Poll: What's Actually Costing You Points on Security+ Practice Tests?
Select your biggest obstacle and submit to reveal a targeted study adjustment.
Submit
Instant browser-based self-assessment. Responses are not stored or counted.
4) Security+ Practice Questions 53–80: Security Operations, Incident Response, and Identity Management
Q53. An endpoint begins launching suspicious PowerShell processes and contacting known malicious infrastructure. The security analyst needs to contain it while preserving investigation visibility. Which tool is most appropriate?
A. DLP
B. EDR
C. DNS registrar
D. Load balancer
Answer: B — EDR. Endpoint Detection and Response tools provide process telemetry, investigation capabilities, and endpoint isolation. Isolation can restrict network communication while retaining forensic evidence. This is a fundamental skill for SOC analyst careers and endpoint investigation laboratories.
Q54. A security team must correlate firewall denials, identity-provider logins, and endpoint alerts to identify related attacks across multiple systems. Which solution best supports this requirement?
A. SIEM
B. Disk defragmentation
C. BIOS configuration
D. File compression
Answer: A — SIEM. Security Information and Event Management platforms collect, normalize, search, and correlate events from multiple sources. Their usefulness depends on log quality, coverage, and effective detection logic. SIEM competency is especially valuable in practical SOC laboratories and SOC technical interviews.
Q55. A firewall administrator must ensure that only explicitly authorized connections can reach a sensitive server. Which default policy is most appropriate?
A. Allow all traffic unless blocked
B. Deny traffic unless explicitly permitted
C. Permit all inbound management traffic
D. Disable firewall logging
Answer: B — Deny traffic unless explicitly permitted. Default-deny rules enforce least privilege at the network layer. Administrators should document and test necessary exceptions before deployment to prevent unintended service outages. This principle belongs in network security certification preparation and infrastructure security projects.
Q56. A company needs a network security device that automatically blocks traffic matching confirmed malicious signatures. Which solution best fulfills this requirement?
A. Passive IDS
B. IPS
C. Log archive
D. Network tap alone
Answer: B — IPS. An Intrusion Prevention System can inspect and block suspicious traffic when deployed in an enforcement path. An IDS primarily detects and alerts. False positives require careful tuning because blocking decisions may interrupt legitimate activity. This distinction appears in SOC hiring assessments and network security laboratories.
Q57. Employees connecting laptops to the corporate network must demonstrate current endpoint protection and approved device configuration before receiving normal access. Which capability supports this policy?
A. NAC
B. Network load balancing
C. Data deduplication
D. DNS caching
Answer: A — NAC. Network Access Control evaluates identity and device posture before granting or restricting connectivity. Noncompliant endpoints may receive quarantine or remediation access. NAC also supports identity security operations and network security engineering.
Q58. A company-owned smartphone containing sensitive business applications is reported stolen. Administrators need to revoke managed access and remotely erase corporate information when connectivity becomes available. Which solution is most suitable?
A. MDM
B. Public DNS service
C. Network scanner
D. Email signature validator
Answer: A — MDM. Mobile Device Management allows organizations to enforce device policies, manage applications, and issue remote-wipe commands. Remote wiping depends on the device receiving the command; encryption protects information while it remains offline. This is relevant to security operations roles and privacy governance.
Q59. An employee attempts to email a spreadsheet containing thousands of regulated personal records to an external address. The organization wants to detect and block the unauthorized transfer. Which capability is most appropriate?
A. DLP
B. Disk optimization
C. Network time synchronization
D. Password expiration
Answer: A — DLP. Data Loss Prevention identifies sensitive information and enforces policies on its movement through approved channels. Effective implementations depend on classification accuracy and carefully designed exceptions. DLP decisions are important in privacy analyst careers and cybersecurity regulatory compliance.
Q60. Employees use unauthorized cloud file-sharing applications, and the security team wants visibility into SaaS usage and policy enforcement for corporate data. Which solution best fits?
A. CASB
B. Local disk defragmenter
C. Wireless signal repeater
D. Hardware diagnostic tool
Answer: A — CASB. Cloud Access Security Broker capabilities help discover cloud application usage and enforce security policies across supported services. Coverage varies by deployment mode and integration. This challenge appears in cloud security careers and enterprise cybersecurity governance.
Q61. A vulnerability scanner identifies two issues: a critical-rated flaw on an isolated laboratory system and a high-rated flaw on a public server that attackers are actively exploiting. Which remediation should generally receive priority?
A. The isolated laboratory issue solely because of its rating
B. The actively exploited, internet-facing issue
C. Neither issue requires assessment
D. Whichever issue has the shortest description
Answer: B — The actively exploited, internet-facing issue. Remediation priority depends on exploit activity, exposure, affected assets, business impact, and available compensating controls. CVSS is valuable but insufficient by itself. This reasoning is essential for vulnerability management professionals and SOC investigation skills.
Q62. A scanner reports a critical vulnerability on a server, but the system owner claims the affected service is not installed. What should the analyst do before closing or escalating the finding?
A. Automatically delete the finding
B. Validate the detection using approved evidence and asset information
C. Disable future scans
D. Publish the server credentials
Answer: B — Validate the detection using approved evidence and asset information. False positives can result from inaccurate service identification, banner interpretation, or incomplete scan context. Verification should establish actual exposure while preserving the audit trail. Such judgment is valuable in technical cybersecurity interviews and security research roles.
Q63. Developers want to identify unsafe coding patterns directly from application source code before the software runs. Which technique best meets the requirement?
A. DAST
B. SAST
C. External penetration testing exclusively
D. Network packet capture
Answer: B — SAST. Static Application Security Testing examines source code or other static application artifacts without requiring a running application. DAST evaluates a running application from its exposed behavior. Both can complement penetration-testing skills and security engineering projects.
Q64. Security monitoring detects that a production server's configuration no longer matches its approved hardening settings. What provides the authoritative reference for restoring secure settings?
A. Configuration baseline
B. Employee vacation calendar
C. Public vulnerability leaderboard
D. Unverified user preference
Answer: A — Configuration baseline. An approved baseline documents the intended secure configuration. Configuration management and drift monitoring help restore consistency and detect unauthorized changes. Maintaining reliable baselines is important for security automation roles and cybersecurity auditing.
Q65. A company discovers unmanaged servers running outdated software that its security team never included in vulnerability scans. Which foundational process was deficient?
A. Asset inventory management
B. Public relations monitoring
C. Password recovery
D. Certificate issuance
Answer: A — Asset inventory management. Vulnerability management requires an accurate inventory of hardware, software, ownership, and operational context. Unknown assets cannot be consistently assessed or remediated. Asset discovery is especially important in SOC home-lab workflows and cybersecurity risk assessments.
Q66. A business plans to retire self-encrypting storage drives containing confidential information. The drives support a validated cryptographic erase function. What is the most appropriate data sanitization approach?
A. Delete desktop shortcuts
B. Cryptographically erase the drives using the validated procedure
C. Rename sensitive folders
D. Format only the visible filesystem directory
Answer: B — Cryptographically erase the drives using the validated procedure. Cryptographic erase can render protected data inaccessible by securely destroying applicable encryption keys, provided implementation and key coverage are verified. Sanitization must match media characteristics and organizational requirements. This matters in compliance auditing and privacy security operations.
Q67. An organization wants to reduce phishing attacks that trick users into providing one-time authentication codes on fraudulent websites. Which authentication method offers the strongest phishing resistance?
A. SMS verification codes
B. Email verification links
C. FIDO2/WebAuthn authentication with origin binding
D. Security questions
Answer: C — FIDO2/WebAuthn authentication with origin binding. Properly implemented WebAuthn credentials bind authentication to the legitimate relying party, resisting credential entry on phishing sites. Traditional OTP methods remain vulnerable to real-time interception. This is foundational to IAM security careers and digital identity security.
Q68. A company grants accounting employees the same predefined permissions because they perform equivalent duties. Which access control model best describes this arrangement?
A. Role-Based Access Control
B. Attribute-Based Access Control only
C. Mandatory network routing
D. Discretionary encryption
Answer: A — Role-Based Access Control. RBAC assigns permissions to roles associated with organizational responsibilities. Administrators can manage job-function permissions centrally rather than maintaining individual exceptions. Understanding RBAC is useful for IAM career preparation and enterprise identity architecture.
Q69. Database administrators need elevated permissions only during approved maintenance activities. The organization wants access to expire automatically after each task. Which security capability best addresses this requirement?
A. Permanent administrator accounts for everyone
B. Just-in-time privileged access management
C. Shared credentials without auditing
D. Anonymous database access
Answer: B — Just-in-time privileged access management. JIT PAM provides privileged access when authorized and removes it after the approved window. It reduces standing privileges and improves accountability. These controls are important in identity security operations and cybersecurity governance.
Q70. Employees authenticate through their corporate identity provider and then access a third-party enterprise application using signed authentication assertions. Which standard commonly supports this federation model?
A. SAML
B. SNMP
C. SMTP
D. ICMP
Answer: A — SAML. Security Assertion Markup Language supports federated authentication through signed assertions exchanged between identity and service providers. OIDC is another common federation approach with different protocol mechanics. Understanding federation helps in identity management careers and IAM technical interviews.
Q71. A browser needs current information about whether a server certificate has been revoked before its expiration date. Which protocol provides online certificate status responses?
A. OCSP
B. DHCP
C. FTP
D. ARP
Answer: A — OCSP. The Online Certificate Status Protocol allows clients to request certificate revocation information from a responder. Operational limitations and browser behavior affect practical enforcement; stapling can improve performance and availability. Certificate validation knowledge is relevant to security technical tests and infrastructure security practice.
Q72. Investigators cannot accurately reconstruct an intrusion because firewall logs and server logs show inconsistent timestamps. Which infrastructure service should the organization improve?
A. NTP
B. NAT
C. FTP
D. DHCP lease compression
Answer: A — NTP. Network Time Protocol supports consistent time synchronization across systems. Accurate timestamps enable reliable event sequencing and SIEM correlation. Organizations should also maintain consistent time-zone conventions. This issue frequently arises in SOC log-analysis projects and incident investigation interviews.
Q73. DNS logs show a workstation repeatedly querying unusual domains at regular intervals. The domains have no known business purpose. What should the analyst investigate first?
A. Possible command-and-control beaconing
B. Printer toner levels
C. Physical access badges
D. Normal file compression
Answer: A — Possible command-and-control beaconing. Periodic DNS requests can indicate malware contacting external infrastructure. Timing alone is insufficient for confirmation; process, endpoint, and network evidence should be correlated. This investigation approach is useful in SOC home labs and technical interview scenarios.
Q74. Investigators suspect a workstation uploaded several gigabytes of data to an unfamiliar HTTPS destination. Which data source is most useful for identifying the destination, timing, and transfer volume when that information is recorded?
A. Web proxy or network flow logs
B. Printer maintenance records
C. Employee attendance sheets
D. Password complexity policy
Answer: A — Web proxy or network flow logs. Proxy and flow telemetry can reveal network destinations, connection timing, and traffic volume. Content inspection may require additional authorized visibility because HTTPS encrypts payloads. These evidence sources are useful in SIEM investigation projects and SOC analyst interviews.
Q75. A forensic analyst transfers a suspicious laptop image to another investigator. The organization must prove who handled the evidence and whether it remained intact. What documentation is required?
A. Chain of custody
B. Annual vacation schedule
C. Marketing asset register
D. Software license agreement only
Answer: A — Chain of custody. Chain-of-custody records document evidence collection, possession, transfers, and handling. Cryptographic hashes can additionally help demonstrate image integrity. This combination strengthens incident response competency and cybersecurity audit practices.
Q76. An incident responder isolates an infected server. Investigators later remove the malicious persistence mechanism and close the exploited vulnerability. Which activity describes removing the cause of the compromise?
A. Containment
B. Eradication
C. Risk acceptance
D. Threat modeling
Answer: B — Eradication. Containment limits immediate harm, while eradication removes malicious artifacts, persistence, and root causes. Recovery then restores trusted operation and monitoring. Distinguishing these phases is essential for SOC technical evaluations and incident response portfolios.
Q77. A SOC receives repeated phishing alerts requiring enrichment, ticket creation, indicator checks, and approved account restrictions. The team wants to automate the workflow across existing security tools. Which technology best fits?
A. SOAR
B. Disk encryption
C. Network repeater
D. Physical access turnstile
Answer: A — SOAR. Security Orchestration, Automation, and Response platforms coordinate workflows across tools using predefined playbooks. Sensitive actions should include authorization, validation, and human approval when necessary. These skills support cybersecurity automation careers and SOC operational improvement.
Q78. An organization completes daily backups successfully but has never attempted to restore its most important business application. What should the security team prioritize?
A. Verified restoration testing
B. Increasing backup file names
C. Disabling integrity checks
D. Deleting older incident records
Answer: A — Verified restoration testing. Successful backup jobs establish that data was copied, while restoration tests establish whether recovery procedures work. Tests should verify usable data, dependencies, integrity, and recovery objectives. This practice supports cybersecurity risk management and operational security leadership.
Q79. A security analyst suspects attackers are using legitimate administrative tools to avoid existing detection rules. The analyst proactively searches telemetry for suspicious behavior without waiting for new alerts. What activity is this?
A. Threat hunting
B. Password rotation
C. Asset depreciation
D. Routine data classification
Answer: A — Threat hunting. Threat hunting uses hypotheses and investigative evidence to discover activity that automated detections may have missed. Findings can inform new detection rules and response procedures. This capability is valuable in SOC career progression and security research careers.
Q80. A detection rule generates hundreds of alerts every time approved vulnerability scanning occurs, overwhelming analysts with known benign activity. What should the team do?
A. Disable all monitoring permanently
B. Tune the detection using validated context while preserving visibility
C. Ignore every security alert
D. Block all vulnerability scanning indefinitely
Answer: B — Tune the detection using validated context while preserving visibility. Detection tuning uses authorized asset, process, and activity information to reduce false positives. Broad exclusions can create blind spots, so changes require testing and review. Effective alert engineering is important for SOC hiring expectations and security automation specialists.
5) Security+ Practice Questions 81–100: Risk Management, Governance, Compliance, and Auditing
Q81. An organization publishes a document stating that employees must protect confidential information and comply with approved security requirements. The document defines organizational expectations without specifying individual technical steps. What type of document is this?
A. Security policy
B. Technical procedure
C. Incident log
D. Vulnerability report
Answer: A — Security policy. Policies establish organizational direction and mandatory expectations. Standards define specific requirements, while procedures explain implementation steps. Distinguishing these documents is essential for cybersecurity policy analysts, GRC specialists, and security auditors.
Q82. A security analyst identifies a business risk that remains after reasonable safeguards are implemented. The organization must formally decide whether to tolerate the remaining exposure. Who should generally approve acceptance?
A. Any available employee
B. The authorized risk owner
C. The external penetration tester
D. The firewall vendor
Answer: B — The authorized risk owner. Risk acceptance requires accountable business authority consistent with organizational policy and delegated approval limits. Security teams assess and recommend; authorized owners make acceptance decisions. Understanding accountability matters in cybersecurity risk management careers, GRC roles, and security leadership.
Q83. A company estimates that a successful cyber incident would cause $200,000 in losses and expects an annualized rate of occurrence of 0.25. What is the Annual Loss Expectancy?
A. $20,000
B. $50,000
C. $100,000
D. $800,000
Answer: B — $50,000. Annual Loss Expectancy equals Single Loss Expectancy multiplied by Annualized Rate of Occurrence. Therefore, $200,000 × 0.25 = $50,000 annually. This figure supports quantitative risk comparisons, although actual losses remain uncertain. ALE calculations are relevant to risk management specialists and cybersecurity governance professionals.
Q84. A security team evaluates business risks using categories such as low, medium, high, and critical rather than assigning monetary loss estimates. What assessment method is being used?
A. Quantitative risk assessment
B. Qualitative risk assessment
C. Cryptographic analysis
D. Forensic acquisition
Answer: B — Qualitative risk assessment. Qualitative methods use descriptive ratings to compare likelihood, impact, and priority. Quantitative approaches rely on numerical estimates, such as expected financial loss. Both depend on explicit assumptions and consistent assessment criteria. This distinction is valuable in GRC career development and enterprise risk evaluation.
Q85. A company purchases cyber insurance to cover certain financial consequences of a qualifying ransomware incident. Which risk response strategy is primarily being applied?
A. Risk avoidance
B. Risk transfer
C. Risk elimination
D. Risk exploitation
Answer: B — Risk transfer. Insurance transfers specified financial consequences to an insurer under contractual conditions. Operational disruption, reputational damage, deductibles, exclusions, and other residual exposures remain relevant. Risk transfer decisions belong in cybersecurity risk programs and security leadership discussions.
Q86. A company permanently discontinues a high-risk online service because its potential financial exposure exceeds the expected business benefit. Which risk treatment has been selected?
A. Risk avoidance
B. Risk mitigation
C. Risk transfer
D. Risk acceptance
Answer: A — Risk avoidance. Discontinuing the activity eliminates exposure associated with that particular activity. Mitigation would reduce its likelihood or impact while continuing operations. This decision requires business judgment, making it relevant to risk management specialists and senior cybersecurity leaders.
Q87. A security manager needs a centralized record of identified risks, affected assets, likelihood, impact, assigned owners, mitigation plans, and review dates. Which artifact should be maintained?
A. Risk register
B. DNS zone file
C. Password dictionary
D. Packet capture filter
Answer: A — Risk register. A risk register connects identified exposure with accountable ownership, treatment decisions, and ongoing review. Well-maintained registers help leadership compare risks and monitor unresolved actions. This is fundamental to GRC specialist work, cybersecurity risk management, and audit preparation.
Q88. A company stores public marketing content, internal financial forecasts, and confidential medical records. Security requirements differ according to the sensitivity of each dataset. Which governance process establishes these distinctions?
A. Data classification
B. Network address translation
C. Packet fragmentation
D. Port forwarding
Answer: A — Data classification. Classification assigns sensitivity categories that guide handling, access, retention, transmission, and disposal controls. Effective classification considers legal obligations and business impact. These decisions are essential for privacy analysts, cybersecurity policy specialists, and regulatory compliance professionals.
Q89. A company wants to determine which services must recover first after a disaster, based on financial losses, operational dependencies, and acceptable disruption periods. Which assessment should be performed?
A. Business Impact Analysis
B. Wireless penetration test
C. Source-code formatting review
D. Password complexity audit
Answer: A — Business Impact Analysis. A BIA identifies critical business activities, disruption consequences, dependencies, and recovery requirements. Its findings inform recovery priorities and targets such as RTO and RPO. BIA competence matters in enterprise risk management and cybersecurity leadership planning.
Q90. A software vendor provides a SOC 2 Type II report covering security controls over a defined review period. What does this report primarily help customers evaluate?
A. The operating effectiveness of controls during the covered period
B. Guaranteed protection against future breaches
C. The vendor's product sales revenue
D. The security of every customer configuration
Answer: A — The operating effectiveness of controls during the covered period. A SOC 2 Type II examination assesses control design and operation across a specified period. Customers must review report scope, exceptions, complementary user entity controls, and relevance to their services. This is important for third-party cybersecurity audits and GRC vendor assessments.
Q91. A financial administrator can create suppliers and independently approve payments to those suppliers. The security team identifies a significant fraud risk. Which governance control best addresses this problem?
A. Separation of duties
B. Longer password expiration periods
C. Unrestricted administrator access
D. Reduced transaction logging
Answer: A — Separation of duties. Separating supplier creation from payment authorization prevents one individual from controlling the entire sensitive workflow. Where separation is impractical, independent review and monitoring may serve as compensating controls. This principle belongs in cybersecurity auditing and GRC operational controls.
Q92. A cloud vendor processes regulated customer information. The customer wants contractual authority to review relevant security controls and obtain assurance documentation. Which provision is most relevant?
A. Right-to-audit clause
B. Marketing exclusivity clause
C. Automatic public disclosure clause
D. Unlimited anonymous access clause
Answer: A — Right-to-audit clause. Audit rights define how customers or authorized assessors may evaluate vendor compliance with agreed requirements. Contracts should specify scope, evidence access, notification conditions, and handling of confidential information. These provisions are relevant to cybersecurity regulatory specialists and third-party risk professionals.
Q93. An organization hires an independent assessment firm to evaluate whether its implemented controls satisfy specified security requirements. Which activity is being performed?
A. External security audit
B. Daily endpoint monitoring
C. Password spraying
D. Routine data backup
Answer: A — External security audit. An external audit evaluates controls against defined criteria using evidence gathered by assessors independent of the organization. Scope and assurance level depend on the engagement. This differs from a penetration test, which examines exploitable weaknesses. Both distinctions matter in cybersecurity auditor careers and governance assessments.
Q94. A customer registration form collects birth dates, residential addresses, and national identification numbers, although only an email address is necessary to deliver the service. Which privacy principle should guide redesign?
A. Data minimization
B. Maximum data collection
C. Unrestricted secondary use
D. Permanent retention of all records
Answer: A — Data minimization. Organizations should collect information appropriate and necessary for the specified purpose. Reducing unnecessary personal data decreases exposure, handling obligations, and potential breach impact. This is essential for privacy analyst careers, chief privacy officer pathways, and cybersecurity compliance.
Q95. A company receives a litigation preservation notice covering relevant employee communications. Its normal deletion schedule would otherwise remove some of the records. What action is most appropriate?
A. Continue deleting records as usual
B. Implement a legal hold for relevant information
C. Permanently disable all security monitoring
D. Publish every employee communication
Answer: B — Implement a legal hold for relevant information. A legal hold preserves potentially relevant material despite ordinary deletion schedules. Its scope should follow legal instructions and documented preservation procedures. This issue is important for cybersecurity compliance specialists, privacy leadership, and security auditors.
Q96. A security analyst confirms unauthorized access to regulated personal information. The company has contractual and legal incident-notification obligations. What should the analyst do next?
A. Independently promise that notification is unnecessary
B. Escalate through the incident response and authorized notification process
C. Delete the evidence
D. Publicly disclose all affected records
Answer: B — Escalate through the incident response and authorized notification process. Security, legal, privacy, and compliance stakeholders must evaluate incident scope and applicable reporting requirements. Deadlines and recipient obligations vary by jurisdiction and contract. This coordination is critical in cybersecurity regulatory roles, privacy operations, and incident response leadership.
Q97. A company's finance department repeatedly falls for fraudulent payment-change requests, while other departments rarely encounter the same problem. What training strategy offers the most relevant improvement?
A. Generic training unrelated to finance
B. Role-specific business email compromise training
C. Eliminate all employee reporting channels
D. Focus only on physical security
Answer: B — Role-specific business email compromise training. Training should address realistic fraud scenarios, independent payment verification, approval boundaries, and escalation procedures. Targeted exercises address demonstrated weaknesses more precisely than generic awareness messages. This approach supports cybersecurity training careers and security policy implementation.
Q98. An organization runs monthly phishing simulations. Leadership wants to determine whether the program improves employee behavior. Which measurement strategy is most useful?
A. Count how many training slides were created
B. Track reporting behavior, risky actions, and improvement over comparable simulations
C. Measure office electricity consumption
D. Count only the number of emails delivered
Answer: B — Track reporting behavior, risky actions, and improvement over comparable simulations. Useful metrics include reporting rates, unsafe interaction rates, and changes after targeted education. Results should account for simulation difficulty and avoid discouraging employees from reporting mistakes. Measurement design matters for security awareness trainers and cybersecurity governance teams.
Q99. Senior executives, legal counsel, communications staff, and incident responders gather to discuss how they would manage a simulated ransomware crisis. No production systems are attacked. What type of exercise is this?
A. Tabletop exercise
B. External penetration test
C. Live malware deployment
D. Vulnerability exploitation campaign
Answer: A — Tabletop exercise. Tabletop exercises rehearse responsibilities, escalation pathways, coordination, and decision-making using a simulated scenario. They help expose gaps in plans before a real incident. This capability matters in cybersecurity leadership and risk management planning.
Q100. A company initially estimates a significant risk of unauthorized database access. After implementing MFA, privileged-access restrictions, encryption, and monitoring, some exposure remains. What is the remaining exposure called?
A. Inherent risk
B. Residual risk
C. Eliminated risk
D. Transferred ownership
Answer: B — Residual risk. Residual risk is the exposure that remains after controls and treatments are considered. The organization must evaluate it against approved risk tolerance and determine whether further action is necessary. This final distinction connects risk management practice, GRC decision-making, and security leadership accountability.
6) Security+ Practice Test 2026: Frequently Asked Questions
-
This practice test follows the SY0-701 (Security+ V7) examination objectives, including its five domains and their published weightings. It is designed for candidates studying for the version available in October 2026.
CompTIA expects Security+ V8, exam code SY0-801, to launch on or around November 17, 2026. V8 changes domain weightings and introduces updated subject coverage, including AI-related security concepts. The SY0-701 English examination is scheduled to retire on June 11, 2027.
Candidates should verify their registered exam code and use the corresponding official objectives before purchasing study materials or scheduling their final revision.
The underlying skills remain useful across versions. Candidates pursuing Security+ for employability should also understand the certification-versus-lab tradeoff, evaluate their certification sequence, and build practical security evidence.
-
A useful preparation target is 85% or higher on fresh, sufficiently challenging practice questions, combined with consistent performance across all five domains. This is a study benchmark rather than an official CompTIA passing threshold.
The actual examination uses scaled scoring. A score of 750 does not translate to a published fixed percentage of correct answers.
A candidate scoring 88% after memorizing repeated questions may be less prepared than someone scoring 82% on unfamiliar, realistic scenarios with strong practical reasoning.
Evaluate performance using three separate measures: overall accuracy, domain-level accuracy, and the ability to explain why plausible distractors are incorrect.
If your mistakes concentrate in Security Operations, prioritize SOC interview scenarios and hands-on detection projects. If your weaknesses involve risk or compliance, strengthen your understanding of GRC responsibilities.
-
Performance-based questions require candidates to apply security knowledge through practical tasks, configurations, analysis, or simulated troubleshooting.
Preparation should focus on performing activities that resemble real administrative and investigative decisions:
Configure firewall rules that permit required traffic while denying unauthorized connections.
Interpret authentication logs, endpoint events, and suspicious network activity.
Match security controls to attack scenarios and business requirements.
Identify weaknesses in network segmentation and access permissions.
Sequence incident response actions and select appropriate recovery controls.
Use a beginner SOC home lab to generate realistic events, develop recruiter-verifiable technical projects, and practise technical interview assessments.
During an actual examination, evaluate the PBQ's complexity and available time. Mark difficult tasks for review if the exam interface permits, then return after completing more manageable questions.
-
Start by categorizing incorrect answers according to the underlying reason for failure.
Conceptual mistakes occur when terms such as RPO and RTO, SAST and DAST, or authorization and authentication are confused. Correct these by comparing definitions against scenarios where each term applies.
Evidence interpretation mistakes occur when candidates recognize security terminology but struggle to interpret logs, indicators, or technical architecture. Address these through SIEM investigations and hands-on SOC exercises.
Decision-making mistakes occur when two answers appear technically reasonable. Identify the condition that distinguishes the strongest response: urgency, least privilege, business impact, control effectiveness, or stage of incident response.
Review incorrect questions immediately, revisit their concepts after a day or two, and use fresh scenarios to verify improvement. Repeatedly reading the same answer key can create familiarity without transferable understanding.
-
A candidate with solid IT networking and system administration experience may be able to prepare effectively in four to eight weeks. Someone starting without networking or operating-system fundamentals may need considerably longer.
Rather than relying exclusively on calendar time, establish readiness milestones.
During the initial study period, strengthen networking, security controls, cryptography, and common attacks. Then focus on security architecture, IAM, vulnerability management, incident response, and risk governance.
Use your final revision period for unfamiliar practice questions, performance-based exercises, and focused correction of weak domains.
Candidates coming from technical support can accelerate preparation by applying existing knowledge from the help-desk-to-cybersecurity pathway. Complete beginners should assess entry-level cybersecurity barriers and strengthen networking foundations before attempting difficult examination simulations.
-
Security+ can improve eligibility for positions where employers recognize the credential or require baseline security knowledge. Hiring outcomes also depend on practical skills, competition, work authorization, and the specific responsibilities of the position.
Candidates without professional experience should demonstrate that they can perform basic investigations, explain network behavior, apply security controls, and communicate findings clearly.
A strong starting portfolio might include a documented SIEM investigation, an access-control configuration exercise, a network segmentation diagram, and a vulnerability remediation assessment.
These projects become more valuable when they include reproducible steps, evidence, findings, and explanations of decisions.
For a realistic employment strategy, review cybersecurity graduate hiring problems, build a cybersecurity résumé with technical evidence, and understand what SOC hiring managers evaluate.
