Loading page
40 free CompTIA Security+ SY0-701 practice questions for Domain 3, Security Architecture, which is about 18% of the exam. Each question has the correct answer and a clear explanation. No account or signup needed.
Last updated July 2026
Which device filters traffic between networks and tracks the state of active connections so it can allow return traffic for sessions it already approved?
Correct answer: A. Stateful firewall
A stateful firewall tracks connection state and permits return traffic for established sessions, unlike a stateless packet filter. Switches, hubs, and repeaters move traffic but do not enforce stateful policy.
Which technology creates an encrypted tunnel so a remote employee can securely reach the corporate network over the public Internet?
Correct answer: A. VPN
A VPN (virtual private network) encrypts traffic in a tunnel across an untrusted network. A VLAN segments a LAN, NAT translates addresses, and a DMZ is an isolated subnet for public services.
Which server sits between internal users and the Internet, forwarding their web requests on their behalf and able to cache and filter content?
Correct answer: A. Forward proxy
A forward proxy represents internal clients when they reach out to the Internet, adding caching and content filtering. A reverse proxy fronts internal servers for inbound clients, and a jump server is a hardened admin gateway.
Encrypting information while it travels across a network protects data in which state?
Correct answer: A. Data in transit
Data in transit is data moving across a network, protected by transport encryption such as TLS. Data at rest is stored data, and data in use is data actively being processed in memory.
Under the cloud shared responsibility model for Infrastructure as a Service (IaaS), who is responsible for securing the data and applications the customer places in the cloud?
Correct answer: A. The customer
In IaaS, the provider secures the underlying infrastructure while the customer secures their operating systems, applications, and data. Responsibility is shared, but data and apps belong to the customer.
Which technique distributes incoming requests across multiple backend servers to improve performance and avoid overloading any single one?
Correct answer: A. Load balancing
A load balancer spreads traffic across multiple servers, supporting both performance and availability. Port mirroring copies traffic for monitoring, VLAN tagging labels segmented traffic, and NAT maps addresses.
Which technology provides fault tolerance by mirroring or striping data across multiple physical disks so a single disk failure does not lose data?
Correct answer: A. RAID
RAID combines disks for redundancy and performance so one drive can fail without data loss. Backups protect against larger loss but are not real-time fault tolerance, and journaling and deduplication serve other purposes.
Which type of system directly controls physical industrial processes, such as a water treatment plant, and often runs legacy software that is hard to patch?
Correct answer: A. ICS/SCADA
Industrial control systems (ICS), often managed by SCADA, run physical processes and are frequently legacy and fragile, requiring special protections such as isolation. The other options are general-purpose IT systems.
Which technology packages an application with its dependencies to run in isolation on a shared host operating system kernel, without a full guest OS for each instance?
Correct answer: A. Containerization
Containers share the host kernel and isolate applications with their dependencies, making them lightweight. A virtual machine runs a full guest OS on a hypervisor, which is heavier.
To protect the confidentiality and integrity of data sent to a public web application, which protocol should be implemented?
Correct answer: A. TLS (HTTPS)
TLS encrypts and authenticates web traffic (HTTPS), protecting it in transit. Telnet, FTP, and SNMPv1 all transmit data, including credentials, in cleartext.
A company places many customers on the same physical cloud servers while isolating each tenant with logical controls. Which cloud characteristic creates the greatest risk that one tenant could affect another if isolation fails?
Correct answer: B. Multitenancy
Multitenancy shares infrastructure among customers, so weak isolation can leak data or resources between tenants. Elasticity scales capacity, measured service tracks usage, and broad network access describes remote reach, not shared-tenant risk.
Developers deploy functions that run only when events occur and scale automatically without managing servers. Which architecture model is this, and what is a key security concern?
Correct answer: A. Serverless, short-lived instances that are hard to inspect
Serverless runs event-driven code without customer-managed servers, so traditional host monitoring is limited. Bare metal and mainframes are not ephemeral function models, and peer-to-peer is a different distribution pattern.
Sensors process data near retail store devices so decisions happen with minimal delay before results are sent to a central cloud. Which model best describes this placement?
Correct answer: B. Edge computing
Edge computing processes data close to the source to cut latency. Mainframes are centralized systems, LAN client-server does not imply local IoT-style processing, and air-gapped systems are isolated from networks.
An application is split into many small services that communicate over APIs. Which security implication is most associated with this design?
Correct answer: A. A larger network attack surface between services
Microservices increase east-west API paths that must be authenticated and monitored. They do not remove auth, supply chain risk, or encryption needs.
Under Platform as a Service, which task typically remains the customer's responsibility rather than the provider's?
Correct answer: A. Securing application code and identity configuration
In PaaS the provider manages platform and host layers, while customers secure their apps, data, and access settings. Facility power, hypervisor hosts, and physical plant remain provider duties.
An attacker escapes a virtual machine and executes code on the host that runs other VMs. Which component was primarily compromised?
Correct answer: C. The hypervisor
VM escape targets the hypervisor that separates guests from the host. Proxy caches, DNS resolvers, and offline media are unrelated to guest isolation.
Network policies and routing are controlled centrally through software rather than by configuring each switch by hand. Which technology is this?
Correct answer: D. Software-defined networking (SDN)
SDN separates the control plane so software defines network behavior centrally. The other options are older or unrelated networking concepts.
A fleet of low-power building sensors cannot run full endpoint agents or frequent patch cycles. Which architecture concern is most relevant?
Correct answer: A. Constrained devices with limited update and monitoring options
IoT and similar devices often lack CPU, memory, and update paths that desktops have. They rarely support full enterprise agent stacks or Group Policy by default.
Administrators must manage production servers without exposing SSH directly to the Internet. Which control best provides a hardened intermediate access path?
Correct answer: B. Jump server (bastion host)
A jump or bastion host is a controlled entry point for admin access. Open DNS, anonymous FTP, and public RDP expand exposure instead of reducing it.
A security gateway loses power and must choose a default behavior. The organization prefers blocking traffic rather than allowing unknown flows. Which fail mode is required?
Correct answer: A. Fail-closed
Fail-closed denies traffic when the control cannot operate safely. Fail-open permits traffic during failure, which increases risk for security-critical gateways.
A team wants to inspect and block common web application attacks such as injection attempts before they reach application servers. Where should a web application firewall typically sit?
Correct answer: B. In front of the web applications facing clients
A WAF is placed where it can see HTTP/S to applications and filter malicious requests. It does not protect backup media, live in browsers as a network control, or encrypt disks.
After an initial foothold on one internal host, an attacker moves laterally between servers in the same data center. Which traffic path is this primarily?
Correct answer: A. East-west traffic
East-west is internal server-to-server movement. North-south is client or Internet to data center edge, not lateral movement among internal systems.
A switch port should allow only a known workstation MAC and shut down if another device is plugged in. Which feature implements this?
Correct answer: C. Port security
Port security binds allowed MACs to a switch port and can disable the port on violation. The other features solve different Layer 2 problems.
Network devices currently use SNMPv2c with a shared community string in clear text. Which change most improves management protocol security?
Correct answer: B. Migrate to SNMPv3 with authentication and encryption
SNMPv3 adds authentication and privacy that SNMPv2c lacks. Telnet is clear text, and disabling logging or publishing secrets worsens security.
A company wants cloud-delivered secure web access, CASB-style SaaS control, and private app access without full traditional VPN backhaul. Which approach best matches this design?
Correct answer: C. Secure Access Service Edge (SASE)
SASE combines network and security services at the cloud edge for users and apps. Dial-up RAS and open Wi-Fi do not provide that integrated model.
A research lab network has no physical or logical links to any other network, including the Internet. Which isolation method is this?
Correct answer: D. Air gap
An air gap means intentional complete isolation. VLANs, split tunnel VPN, and CDN peering still involve connectivity paths.
Database files on disk are encrypted so that stolen hard drives do not expose readable records. Which data state is primarily protected?
Correct answer: B. Data at rest
Data at rest is stored data on media. Transit and motion describe data moving on networks, and in-use focuses on data being processed in memory.
An application must keep a secret key available while it processes transactions in memory, yet limit exposure if memory is dumped. Which protection strategy best targets this state?
Correct answer: A. Secure enclaves or memory encryption for data in use
Data in use needs runtime protections such as enclaves or memory encryption. TLS, shredding, and tape rotation address other states or media.
Regulators require that citizen personal data remain stored and processed inside a specific country. Which data protection concept is this requirement enforcing?
Correct answer: D. Data sovereignty
Data sovereignty ties storage and processing to legal jurisdictions. Minimization, tokenization, and hashing are useful controls but do not define location rules.
A support dashboard shows only the last four digits of customer account numbers while hiding the rest from agents. Which technique is this?
Correct answer: B. Data masking
Masking conceals parts of sensitive fields for display. Full disk encryption protects whole volumes, steganography hides messages in media, and key escrow stores keys with a third party.
Before disposing of encrypted drives, the team destroys the encryption keys so ciphertext cannot be recovered. What is this sanitization approach called?
Correct answer: D. Cryptographic erasure
Cryptographic erasure makes data unreadable by destroying keys. Formatting or defrag is not reliable sanitization, and warm site replication is a recovery design.
Cloud object storage is configured so objects may be created only in approved regions and cannot be copied to disallowed locations. Which control type is this primarily?
Correct answer: B. Geographic or geofencing restrictions
Geographic restrictions limit where data may reside or move. Password, screen lock, and cable lock controls protect endpoints and accounts, not data location policy.
An organization needs a recovery facility with fully mirrored systems and near-immediate cutover after a primary site disaster. Which site type fits best?
Correct answer: A. Hot site
Hot sites are ready to run production quickly with live or near-live capacity. Cold sites need extensive setup, warm sites are partial, and media vaults store data without full compute.
Nightly backups copy only files that changed since the previous backup job of any type, creating a chain of small backups between fulls. Which backup type is this?
Correct answer: A. Incremental backup
Incremental backups capture changes since the last backup of any kind. Full copies everything, and differentials copy since the last full, not since each prior job.
During a brief utility outage, servers keep running long enough for a clean shutdown or generator start. Which device provides this short-term power?
Correct answer: A. Uninterruptible power supply (UPS)
A UPS bridges short power gaps with battery power. Taps, HSMs, and content filters serve monitoring, crypto, or web filtering roles.
Critical systems are duplicated in data centers hundreds of miles apart so a regional outage does not take down all capacity. Which resilience strategy is this?
Correct answer: D. Geographic dispersal
Geographic dispersal spreads risk across distant locations. Local clustering, NIC teaming, and dual PSUs help within one site but not regional disasters.
Before a major OS upgrade, an administrator captures the current virtual machine state so the system can return quickly if the upgrade fails. What was created?
Correct answer: D. A snapshot
Snapshots record a point-in-time VM or volume state for quick rollback. Cold sites, legal holds, and CRLs serve recovery facilities, litigation, and PKI, not OS upgrade rollback.
Two identical firewalls are deployed so one handles live traffic while the other waits and takes over if the primary fails. Which high-availability mode is this?
Correct answer: D. Active-passive
Active-passive keeps a standby ready to assume the role of the primary. Active-active runs both concurrently, and DNS or standalone setups lack true appliance failover pairing.
Backups complete every night, but nobody has restored a sample file in over a year. Which resilience practice is most urgently missing?
Correct answer: D. Regular restore testing to verify recoverability
Untested backups may fail when needed, so restore drills validate them. Weakening encryption, same-array-only copies, and aggressive deletion increase risk.
A company rents empty floor space with power and network jacks but will install servers and restore data only after a disaster is declared. Which site type is this?
Correct answer: B. Cold site
Cold sites provide basic facilities without ready systems. Hot and active-active designs keep capacity running, and multipath SANs address storage path resilience, not empty recovery space.
SecPlus Mastery covers all five SY0-701 domains with over 1,000 practice questions, timed mock exams, and spaced review that targets your weak spots so you walk in ready.
Original practice questions aligned to the CompTIA Security+ SY0-701 objectives. CompTIA and Security+ are trademarks of CompTIA, used here for identification only.