Try 8 Real Questions From CompTIA Security+ (SY0-701) - 600 Questions & Full Rationale Answers
These are unedited questions from the full 600-question set, pulled from across every exam domain. Click a question to reveal the answer and the full rationale for every option, exactly as it appears in the PDF.
A security team notices repeated unauthorized attempts to access a restricted area. They want a control that discourages attempts before they occur. Which control is BEST?
Show answer & full rationale
A: Restoring systems from backups is a corrective control. It repairs damage after an event and does nothing to discourage someone from attempting entry.
B: Daily log review is a detective control. It surfaces attempts after they have already been made rather than discouraging them beforehand.
C (Correct): Visible signage and obvious monitoring are deterrent controls: they work by influencing the decision of a would-be intruder before an attempt is made, which is exactly the timing the scenario calls for.
D: A lessons learned meeting is a managerial activity performed after an incident closes. It improves future response but has no effect on the intruder's decision to try.
A company wants to limit damage if a user account is compromised by ensuring the account can access only what is required. Which principle BEST supports this?
Show answer & full rationale
A: Elasticity describes a system's ability to scale resources up or down with demand. It is an availability and cost concept with no bearing on how much a compromised account can reach.
B: Obfuscation makes data or code harder to interpret. It may slow an attacker's understanding but does not restrict what an account is permitted to access.
C: Non-repudiation ensures an actor cannot credibly deny an action, typically through digital signatures and reliable logging. It supports accountability after the fact, not limitation of access.
D (Correct): Least privilege grants each account only the access its function requires. When such an account is compromised, the attacker inherits only that narrow set of rights, which is precisely the damage limitation described.
A threat actor targets a defense contractor to steal weapons design data over many months while avoiding disruption. Which threat actor is MOST likely responsible?
Show answer & full rationale
A (Correct): Long-duration, low-noise operations against a defense contractor to steal design data indicate a well-resourced actor pursuing strategic intelligence. That combination of patience, funding, and espionage motive characterizes a nation-state actor.
B: An unskilled attacker relies on tools written by others and typically seeks quick, visible results. Sustaining months of undetected access against a defense target is beyond that capability.
C: A hacktivist acts on political or ideological motives and normally wants the action to be seen — defacement, leaks, disruption. Deliberate long-term stealth runs counter to that goal.
D: An unintentional insider causes harm through error rather than intent. Sustained, targeted collection of weapons design data reflects deliberate planning, not accident.
Which motivation MOST commonly aligns with ransomware attacks?
Show answer & full rationale
A (Correct): Ransomware exists to extract payment — through extortion for a decryption key, for suppression of stolen data, or both. Financial gain is its defining motivation.
B: Ideological motivation drives hacktivism and some destructive attacks where no payment is sought. Ransomware operators may occasionally borrow ideological language, but the payload's purpose is payment.
C: Ego or reputation motivates some attackers to seek notoriety. Ransomware crews generally prefer anonymity, since exposure interferes with collecting the ransom.
D: Accidental harm involves no attacker motive at all. Ransomware requires deliberate deployment and a negotiation process.
A company wants every access request to be evaluated using identity and context, regardless of network location. Which model BEST fits?
Show answer & full rationale
A: Security through obscurity relies on hiding design details. It is explicitly discouraged as a primary defense and says nothing about evaluating each request.
B: An implicit trust perimeter assumes anything inside the boundary is trustworthy — the precise assumption the requirement rejects.
C: A flat network trust model provides no internal segmentation, allowing free lateral movement once inside. It is the opposite of per-request evaluation.
D (Correct): Zero trust removes location-based trust entirely and evaluates every request against identity and context — device posture, behavior, sensitivity of the resource — before granting access, which is exactly what the company is asking for.
Placing internet-facing servers in a screened subnet separated from the internal network is MOST commonly called a:
Show answer & full rationale
A: A RAID configuration provides disk redundancy or performance within a single system. It is a storage concept, not a network placement zone.
B (Correct): A screened subnet, still widely called a DMZ, isolates internet-facing hosts between two filtering boundaries so a compromise there does not grant direct access to the internal network.
C: Tokenization replaces sensitive data values with surrogates. It protects data content rather than defining where servers sit on the network.
D: Data masking obscures field values for unprivileged viewers. Like tokenization, it addresses data exposure rather than network topology.
A new server build includes many unused services enabled by default. Which action BEST reduces exposure before production use?
Show answer & full rationale
A: Load balancing distributes traffic across servers for availability and performance. It does not remove the unnecessary services already present on the build.
B: Tokenization substitutes sensitive data values with surrogates. It protects data rather than reducing the number of running services.
C: Non-repudiation ensures an actor cannot deny an action. It is an accountability property, not a hardening step.
D (Correct): Every unnecessary service is a listening process that could contain an exploitable flaw. Disabling or removing them before the system enters production is the core of secure baseline hardening and directly shrinks what an attacker can reach.
Leadership wants to set direction, define roles, and establish enforcement expectations for security. Which document is MOST appropriate?
Show answer & full rationale
A: A DHCP scope plan documents address ranges for network addressing. It is a technical configuration record, not a governance instrument.
B (Correct): An information security policy is the senior-level document that states management's intent, assigns roles and responsibilities, and establishes the expectation of enforcement. Standards and procedures then derive their authority from it.
C: A packet capture procedure gives step-by-step technical instructions for one task. Procedures sit well below policy and carry no organizational direction.
D: A RAID configuration guide covers storage redundancy setup. It is technical documentation with no governance function.
CompTIA Security+ (SY0-701) - 600 Questions & Full Rationale Answers — $19.99, instant PDF download with full rationale on every answer.
View the practice questions →