Loading page
40 free CompTIA Security+ SY0-701 practice questions for Domain 1, General Security Concepts, which is about 12% of the exam. Each question has the correct answer and a clear explanation. No account or signup needed.
Last updated July 2026
Encrypting a sensitive file so that only authorized people can read its contents primarily protects which part of the CIA triad?
Correct answer: A. Confidentiality
Confidentiality means keeping information secret from unauthorized parties, which is exactly what encryption provides. Integrity is about preventing unauthorized changes, and availability is about access when needed.
A written policy that requires all employees to complete annual security awareness training is an example of which category of control?
Correct answer: B. Managerial
Managerial (administrative) controls are policies, procedures, and governance such as training requirements and risk assessments. Technical controls are enforced by technology, physical controls protect facilities, and operational controls are processes people perform.
A sign reading "Warning: 24-hour video surveillance" is posted at an entrance. Which control function does the sign itself perform?
Correct answer: A. Deterrent
A deterrent control discourages an attacker from acting. The sign does not detect or stop entry by itself; it simply discourages bad behavior. The camera that records would be detective.
A required patch cannot be installed right away, so the team temporarily adds strict firewall rules to limit exposure until it can. The firewall rules are acting as which type of control?
Correct answer: A. Compensating
A compensating control is an alternative measure used when the primary control is not feasible. The firewall rules compensate for the missing patch. They are not merely discouraging or detecting anything.
What does a digital certificate primarily bind together?
Correct answer: A. A public key and a verified identity
A digital certificate binds a public key to a verified identity, signed by a certificate authority so others can trust it. It does not store passwords or pair symmetric keys.
A system only allows logins when the device is physically connected inside the corporate office network. Which authentication factor is being used?
Correct answer: C. Somewhere you are
Location-based authentication is the "somewhere you are" factor. Something you know is a secret like a password, something you have is a token, and something you are is a biometric.
What is the primary purpose of a formal change management process?
Correct answer: A. To review, approve, test, and document changes so they do not cause outages or security gaps
Change management ensures changes are reviewed, approved, tested, and documented so they do not introduce instability or vulnerabilities. The other options describe encryption, antimalware, and disaster recovery.
Hiding a secret message inside an ordinary-looking image file so its very existence is concealed is an example of?
Correct answer: A. Steganography
Steganography conceals the existence of a message by embedding it within other data, such as an image. Hashing produces a fingerprint, tokenization substitutes a surrogate value, and key stretching strengthens keys derived from passwords.
A payment platform replaces each stored credit card number with a random surrogate value that has no mathematical relationship to the original. What is this technique?
Correct answer: A. Tokenization
Tokenization swaps sensitive data for a non-sensitive token with no algorithmic link to the original, so a stolen token is useless. Encryption is reversible with a key, and hashing is a one-way digest.
Which method lets two parties securely agree on a shared secret key over an untrusted network without ever transmitting the key itself?
Correct answer: A. Diffie-Hellman key exchange
Diffie-Hellman allows two parties to derive a shared secret over an open channel without sending the secret. SHA-256 is a hash, AES is symmetric encryption that needs a key already shared, and Base64 is encoding, not security.
An organization configures host-based firewalls on every workstation to block unsolicited inbound connections. Which category of security control is this?
Correct answer: C. Technical
Host-based firewalls are technology-enforced technical controls. Managerial controls are policies and governance, operational controls are human-driven processes, and physical controls protect facilities and hardware.
Security staff perform nightly review of privileged account activity as required by procedure. Which control category does this best represent?
Correct answer: D. Operational
Human-executed procedures such as log review are operational controls. Technical controls use systems to enforce security, physical controls secure premises, and compensating controls temporarily offset a missing primary control.
A company installs bollards in front of the data center loading dock to stop vehicles from ramming the building. Which control function is this primarily?
Correct answer: C. Preventive
Bollards stop an attack before damage occurs, so they are preventive. Detective controls identify events after or during occurrence, corrective controls restore after an incident, and directive controls guide required behavior.
After malware is removed, administrators restore clean system images and reapply baselines. Which control function best describes this work?
Correct answer: B. Corrective
Restoring systems after an incident is corrective. Deterrent controls discourage attacks, preventive controls stop them beforehand, and directive controls set rules without themselves remediating damage.
A policy states that removable media is prohibited on production servers. Which control function does the written rule itself primarily serve?
Correct answer: A. Directive
A written rule that tells people what they must do is directive. Detective controls discover violations, compensating controls substitute for unavailable primary controls, and recovery controls restore operations after disruption.
An IDS generates an alert when it observes known exploit traffic patterns on a segment. Which control function is the IDS primarily providing?
Correct answer: D. Detective
An IDS identifies suspicious activity and alerts, which is detective. It does not block by default like a preventive control, does not merely discourage like a deterrent, and is not a physical facility control.
A badge reader denies entry when a card is presented outside authorized hours. Which category and function combination best fits this control?
Correct answer: A. Physical preventive
A door badge system is a physical control that blocks unauthorized entry, so it is preventive. It is not primarily detective, managerial, or corrective, and it is not only a human procedure.
Management requires encryption for all laptops, and IT enforces it with endpoint management software. The software enforcement is which type of control?
Correct answer: D. Technical
Endpoint management that applies encryption is a technical control. The policy requirement is managerial or directive, physical controls protect facilities, and directive alone describes the rule rather than the enforcement technology.
A user proves identity with a smart card, then the system checks whether that user may open a finance application. What is the second step?
Correct answer: B. Authorization
Checking permissions after identity is proven is authorization. Authentication is proving identity, accounting is recording activity, and attestation is asserting device or software state, not granting app rights.
A security design assumes no user or device is trusted by default, even on the internal LAN, and every access request is verified. Which concept is this?
Correct answer: B. Zero trust
Zero trust continuously verifies identity and context instead of trusting the network location. Defense in depth layers controls, least privilege limits rights, and need to know limits data access based on job need.
Which AAA component records who accessed a resource, when it happened, and what actions were performed?
Correct answer: D. Accounting
Accounting tracks and logs usage for audit and investigation. Authentication verifies identity, authorization grants rights, and federation links identities across organizations rather than logging actions.
A digitally signed contract allows a sender to be uniquely tied to a message so they cannot later deny sending it. Which concept is demonstrated?
Correct answer: B. Non-repudiation
Non-repudiation prevents credible denial of an action, often via digital signatures. Confidentiality hides content, availability keeps services usable, and obfuscation only makes code or data harder to read.
An analyst compares the current security program to a target framework and lists missing controls. What activity is this?
Correct answer: A. Gap analysis
Gap analysis measures present state against a desired baseline and identifies shortfalls. Penetration tests exploit weaknesses, tabletops walk through response scenarios, and threat hunting searches for active adversaries.
Employees in accounts payable rotate duties every quarter so no one permanently owns the full payment process. Which practice is this?
Correct answer: B. Job rotation
Job rotation moves people through roles to reduce fraud and cross-train staff. Least privilege limits rights, mandatory vacation forces absence for audit, and separation of duties splits a task among people at once.
A researcher may view only project datasets assigned to their role, even though peers in the same department have other clearances. Which principle applies?
Correct answer: D. Need to know
Need to know limits access to information required for a specific task, even among cleared staff. Defense in depth layers controls, zero trust continuously verifies requests, and non-repudiation proves origin of actions.
A login system accepts a hardware security key in addition to a PIN. Which authentication factor does the security key represent?
Correct answer: D. Something you have
A physical security key is something you have. A PIN is something you know, biometrics are something you are, and something you do refers to behavioral patterns such as gait or keystroke rhythm.
A biometric door system incorrectly unlocks for a person who is not enrolled. Which metric describes this failure?
Correct answer: B. False acceptance rate
False acceptance rate measures unauthorized people wrongly accepted. False rejection rate measures legitimate users wrongly denied, crossover error rate is where those rates meet, and mean time to failure is a reliability metric.
Before a firewall rule change goes live, the team documents how to reverse it if connectivity breaks. What is that documented plan called?
Correct answer: C. Backout plan
A backout plan defines how to undo a failed change. A BIA studies disruption impact, a risk register tracks risks, and an SLA defines service expectations between parties.
A change board reviews a proposed database upgrade for downtime, dependency risk, and security effects before approval. What is this review mainly providing?
Correct answer: A. Impact analysis
Evaluating effects of a proposed change is impact analysis within change management. Vulnerability scanning finds weaknesses, containment is incident response, and certificate pinning is a TLS trust technique.
IT schedules high-risk infrastructure changes for a two-hour window on Saturday night when few users are online. What practice is this?
Correct answer: D. Using a maintenance window
A maintenance window is a planned period for disruptive work. Shadow IT is unauthorized systems, continuous deployment is a release method, and warm site failover is disaster recovery capacity.
After a successful application update, the team revises runbooks and network diagrams to match the new design. Which change management activity is this?
Correct answer: C. Updating documentation
Keeping diagrams and procedures current after a change is documentation update. Honeypots are decoys, threat modeling analyzes threats, and certificates establish cryptographic identity.
A proposed OS upgrade is first installed on a non-production clone of the server for validation. Which change practice is being followed?
Correct answer: C. Testing in a staging environment
Validating changes in staging reduces production risk. Hot patching only in production skips that safety step, full cutover without testing is riskier, and key escrow is a cryptographic recovery practice.
Two internal servers encrypt bulk file transfers with a shared secret key used for both encryption and decryption. Which cryptography type is this?
Correct answer: A. Symmetric
The same key for encrypt and decrypt is symmetric cryptography. Asymmetric uses key pairs, steganography hides existence of data, and hashing is one-way integrity checking without reversible encryption.
An administrator downloads a vendor ISO and compares its published SHA-256 value to a hash of the local file. What property is being verified?
Correct answer: C. Integrity
Matching hashes shows the file was not altered, which is integrity. Confidentiality would require encryption secrecy, non-repudiation needs proof of origin such as signatures, and availability concerns uptime.
A software publisher signs application packages so customers can verify the publisher and detect tampering. Which cryptographic mechanism enables this?
Correct answer: D. Digital signature
Digital signatures use private-key signing and public-key verification for authenticity and integrity. Stream ciphers encrypt, salting hardens password hashes, and tokenization replaces sensitive values with surrogates.
A bank stores private keys for certificate signing inside a dedicated appliance that resists extraction and logs key use. What is this appliance?
Correct answer: B. Hardware security module
An HSM protects and uses cryptographic keys in hardened hardware. Jump servers broker admin access, load balancers distribute traffic, and content filters inspect web or email content.
A laptop uses a chip on the motherboard to store disk encryption keys and measure boot components. Which technology is this describing?
Correct answer: D. Trusted Platform Module
A TPM is a hardware root of trust for keys and measured boot. NGFWs filter network traffic, SIEM connectors feed logs, and WAFs protect web applications.
An organization stores copies of employee encryption keys with a trusted third party so data can be recovered if keys are lost. What practice is this?
Correct answer: A. Key escrow
Key escrow keeps recovery copies of keys with a trusted party. Key stretching slows password cracking, PFS limits damage from long-term key theft, and stapling delivers revocation status with TLS handshakes.
A password storage scheme runs many slow iterations of a hash function to make offline guessing expensive. Which technique is this?
Correct answer: C. Key stretching
Key stretching intentionally slows hashing so brute-force attempts cost more time. Key escrow is recovery storage, steganography hides messages, and symmetric tunneling encrypts network paths.
Developers deploy an internal tool with a certificate they generated themselves, not issued by the corporate CA. What is the main security concern?
Correct answer: A. Clients may not trust the certificate without manual exception
Self-signed certificates lack a trusted CA chain, so browsers and clients warn or block unless trust is added. They can still use TLS, and they do not disable symmetric crypto or hashing.
SecPlus Mastery covers all five SY0-701 domains with over 1,000 practice questions, timed mock exams, and spaced review that targets your weak spots so you walk in ready.
Original practice questions aligned to the CompTIA Security+ SY0-701 objectives. CompTIA and Security+ are trademarks of CompTIA, used here for identification only.