Loading page
40 free CompTIA Security+ SY0-701 practice questions for Domain 4, Security Operations, which is about 28% of the exam. Each question has the correct answer and a clear explanation. No account or signup needed.
Last updated July 2026
Which platform automates and orchestrates repetitive security tasks across many tools using predefined playbooks to speed up response?
Correct answer: A. SOAR
SOAR (Security Orchestration, Automation, and Response) runs playbooks to automate and coordinate responses across tools. An IDS detects intrusions, DLP prevents data loss, and a VPN encrypts connections.
Running a suspicious email attachment in an isolated, instrumented environment to safely watch what it does is known as?
Correct answer: A. Sandboxing
Sandboxing detonates and observes suspicious code in isolation so it cannot harm production. Hashing fingerprints a file, tunneling encapsulates traffic, and hardening reduces a system attack surface.
Which endpoint solution continuously monitors devices for malicious behavior and can isolate a host and roll back changes during an incident?
Correct answer: A. EDR
EDR (Endpoint Detection and Response) provides continuous monitoring, investigation, and response actions like host isolation. Traditional signature antivirus only blocks known files and lacks that response capability.
Which technology lets a user authenticate once and then access many different applications without logging in again to each one?
Correct answer: A. Single sign-on (SSO)
SSO authenticates a user once and grants access to multiple services. Multifactor authentication adds factors to a single login, a password vault stores credentials, and NAC controls device admission.
Which standard lets a user authenticate with the identity provider of one organization and then access a web application at a different organization?
Correct answer: A. SAML (federation)
SAML enables federated identity, letting one organization trust the identity provider of another for single sign-on across domains. RADIUS centralizes network access authentication, WPA3 secures Wi-Fi, and IPsec secures IP traffic.
Which solution vaults and rotates administrator credentials and grants just-in-time elevated access with full session monitoring?
Correct answer: A. Privileged access management (PAM)
PAM controls, vaults, rotates, and monitors privileged (administrator) accounts and grants temporary elevation. SSO handles everyday authentication, a SIEM analyzes logs, and a load balancer distributes traffic.
Which activity uses automated tools to identify and report known weaknesses on systems without actually exploiting them?
Correct answer: A. Vulnerability scan
A vulnerability scan automatically detects and reports known flaws but does not exploit them. A penetration test goes further and actively exploits weaknesses to prove impact.
A vulnerability scanner flags a weakness on a server, but investigation shows the flaw does not actually exist there. This result is a?
Correct answer: A. False positive
A false positive is an alert for something that is not really a problem. A false negative is a real issue that went undetected, and a true positive is a correctly identified real issue.
Permitting only a pre-approved set of applications to run on endpoints and blocking everything else is best described as?
Correct answer: A. Application allow listing
Allow listing (whitelisting) permits only approved applications and denies all others by default, which is very restrictive but strong. Block listing only denies known-bad items and allows the rest.
A decoy system is deliberately exposed with fake data to attract attackers so their methods can be studied. What is this called?
Correct answer: A. Honeypot
A honeypot is a decoy designed to lure and observe attackers. A jump server and a bastion host are hardened administrative gateways, and a proxy mediates client requests.
An administrator must ensure laptops only boot signed firmware and OS loaders so malware cannot replace the boot chain. Which technology best enforces this?
Correct answer: C. UEFI Secure Boot
UEFI Secure Boot verifies digital signatures on boot components before execution. Full disk encryption protects data at rest, a host firewall filters traffic, and MDM wipe removes data after loss, none of which validate the boot chain.
A security team deploys a hardened configuration image to all new workstations and rechecks them monthly for drift. What practice is this primarily demonstrating?
Correct answer: C. Secure baseline enforcement
A secure baseline defines approved settings and is reapplied or audited to prevent configuration drift. Vulnerability scans find known flaws, pen tests attempt exploitation, and DR tests validate recovery, not day-to-day hardening consistency.
An employee loses a company phone that holds corporate email. Which MDM action most quickly reduces data exposure?
Correct answer: A. Remote wipe of the device
Remote wipe removes corporate data from a lost or stolen mobile device. Certificate pinning hardens app TLS trust, packet capture is investigative, and SNMP is rarely relevant on phones, so none match immediate exposure reduction.
Before retiring old hard drives that stored customer records, the company must ensure data cannot be recovered. Which disposal method best meets that goal for magnetic disks?
Correct answer: C. Degaussing
Degaussing destroys the magnetic domains that store the data, so nothing readable remains on the platters. A quick format and the recycle bin only remove references and leave the data recoverable, and unplugging a drive changes nothing on it.
A security manager cannot tell which servers own critical payment data because no current inventory exists. Which asset management failure is this?
Correct answer: C. Incomplete asset inventory
Without a maintained inventory of hardware, software, and data owners, teams cannot protect or prioritize assets. Revocation, hashing, and CAB processes address other controls, not knowing what systems and data you have.
A vendor announces a product reaches end of life next month and will receive no further security updates. What should operations do first for systems still running it?
Correct answer: D. Plan migration or compensating controls
EOL software will not get patches, so migrate off it or add compensating controls quickly. Ignoring risk, marketing changes, or disabling logs does not address unpatched exposure on production systems.
An organization classifies databases as public, internal, confidential, or restricted to set handling rules. What is the primary purpose of this labeling?
Correct answer: B. Guide protection and access decisions
Data classification drives how data is stored, shared, encrypted, and accessed. It does not replace backups, remove vendor risk, or eliminate residual risk after controls are applied.
After patching a critical server vulnerability, the analyst rescans and confirms the finding is gone. What vulnerability management step is this?
Correct answer: D. Remediation validation
Validation confirms fixes actually closed the vulnerability. Threat hunting looks for active adversaries, tabletops practice response scenarios, and chain of custody tracks evidence handling, not patch success.
A scanner needs local credentials to inventory missing patches and insecure services more accurately. Which scan type is this?
Correct answer: C. Credentialed scan
Credentialed scans authenticate to hosts for deeper, more accurate findings. Black-box pen tests exploit without deep credentials, passive DNS watches queries, and social engineering targets people, not host configuration detail.
Security ranks open findings by exploitability and business impact rather than fixing every medium issue first. Which practice is being applied?
Correct answer: D. Risk-based prioritization
Risk-based prioritization focuses effort where impact and likelihood are highest. Encryption, pinning, and NAT are technical controls that do not decide the order of vulnerability remediation work.
Developers want to find insecure coding patterns in source before release without running the application. Which method fits best?
Correct answer: A. Static application security testing
SAST analyzes source or bytecode without execution. DAST tests a running app, packet capture inspects network traffic, and HSM review concerns key hardware, not application source flaws.
Analysts keep closing alerts that fire for normal nightly batch jobs. What monitoring improvement most directly reduces this noise?
Correct answer: D. Alert tuning and baselining
Tuning thresholds and baselining normal behavior cuts false alerts. More licenses, disabling auth logs, or removing MFA do not fix noisy rules and can weaken detection or security.
A network team needs metadata about conversations between hosts, including bytes transferred and duration, without full packet payloads. Which data source is most appropriate?
Correct answer: D. NetFlow or IPFIX records
Flow records summarize connections and volume without storing full payloads. Disk images and hash dumps support host forensics, and badge data tracks physical access, not network session metadata.
An administrator wants critical servers to send security events to a central collector using a standard network logging protocol. Which protocol is commonly used?
Correct answer: A. Syslog
Syslog is the standard protocol for forwarding system and security events to a central collector. FTP transfers files, SMTP delivers mail, and RDP is a remote desktop session, none of which are logging transports.
Security deploys agents that watch for unexpected changes to system binaries and configuration files. Which monitoring capability is this?
Correct answer: A. File integrity monitoring
File integrity monitoring detects unauthorized changes to critical files. Load balancing spreads traffic, tokenization replaces sensitive values, and PAT translates ports, none of which track file change integrity.
The security team wants to stop users from resolving known malicious domains at the DNS layer. Which capability should they enable?
Correct answer: D. DNS filtering or sinkholing
DNS filtering or sinkholing blocks or redirects lookups to bad domains. RAID mirrors disks, screened subnets isolate network zones, and cold storage preserves offline data, not DNS resolution control.
An administrator configures email gateways to reject messages that fail domain authentication checks defined by the sending domain owner. Which controls are involved?
Correct answer: B. SPF, DKIM, and DMARC
SPF, DKIM, and DMARC authenticate and enforce email domain authenticity. Storage and network protocol families listed do not validate outbound domain ownership for email messages.
To stop unauthorized devices from plugging into empty wall jacks, switches require authentication before granting network access. Which feature supports this?
Correct answer: A. 802.1X port-based authentication
802.1X requires a device or user to authenticate before a switch port passes traffic. Port mirroring copies traffic for analysis, DHCP reservations pin an address to a MAC, and PortFast only speeds up port transitions; none of them authenticate anything.
Access rights are assigned based on job function templates such as HR Clerk or Network Engineer rather than one-off per person. Which model is this?
Correct answer: A. Role-based access control
RBAC grants permissions through roles aligned to job duties, so people inherit rights from the role. DAC lets resource owners hand out access ad hoc, physical keys control doors, and mandatory vacation is a fraud-detection control, not an access model.
A policy automatically denies cloud logins from unmanaged devices outside approved countries. Which IAM approach is described?
Correct answer: A. Conditional access policy
Conditional access evaluates signals such as device state and location before allowing sign-in. Packet capture, striping, and warm sites address monitoring, storage performance, or recovery, not access decisions.
Managers must periodically confirm that each subordinate still needs their assigned system permissions. What process is this?
Correct answer: C. Access recertification review
Access reviews recertify that entitlements remain appropriate over time. Enrollment issues certificates, threat modeling designs for risks, and backup rotation manages recovery media, not permission validity.
Infrastructure templates define secure cloud resources so every deployment is consistent and reviewable in version control. What practice is this?
Correct answer: C. Infrastructure as code
Infrastructure as code stores environment definitions as code for repeatable, auditable deployments. Manual console builds, paper-only runbooks, or couriers do not provide the same automated consistency.
When a new hire is added in HR software, accounts and group memberships are created automatically across directory and SaaS apps. What capability is this?
Correct answer: A. Automated identity provisioning
Automated provisioning links joiner events to account creation and access grants. Imaging, port mirroring, and honeynets support forensics, monitoring, or deception, not lifecycle account setup.
During a malware outbreak, responders disconnect affected hosts from the network while preserving volatile evidence. Which incident phase is this primarily?
Correct answer: A. Containment
Containment limits spread while keeping investigation options open. Lessons learned and reporting come after handling, and preparation is readiness work done before an incident occurs.
Investigators create a bit-for-bit copy of a suspect disk and hash both original and copy before analysis. Why is this done?
Correct answer: D. Preserve integrity of digital evidence
Forensic imaging with hashing shows the working copy matches the original and was not altered. It does not speed apps, replace legal advice, or remediate vulnerabilities on the system.
After eradicating ransomware and restoring systems, the team documents what worked, what failed, and process updates. Which activity is this?
Correct answer: C. Lessons learned review
Lessons learned captures improvements after recovery. Triage happens early in detection, spoofing is an attack technique, and certificate issuance is PKI operations, not post-incident improvement.
Legal asks that mailbox contents related to a lawsuit be retained unchanged even if retention timers would delete them. What is this request?
Correct answer: D. Legal hold
A legal hold suspends normal deletion so evidence remains available. Warm sites support DR capacity, pinning hardens TLS trust, and VLAN hopping is a network attack technique.
An analyst investigates possible data theft and needs to see which external hosts an endpoint contacted and how much data was sent. Which source helps most?
Correct answer: B. Firewall or proxy connection logs
Firewall and proxy logs record destination addresses, timestamps, and often byte counts for outbound connections, exactly what an exfiltration investigation needs. Zone transfers, patch history, and print queues do not reconstruct egress traffic.
A phishing investigation requires knowing who received a message, the return path, and intermediate mail servers. Which artifact should be examined?
Correct answer: A. Email header fields
Email headers record the return path, each relay hop, and authentication results, which is what a phishing investigation needs. DHCP scopes, cipher ordering, and cache statistics say nothing about how a message was routed.
Responders need to know which internal IP a laptop used at the time of an incident and when it obtained that address. Which logs should they query?
Correct answer: C. DHCP lease logs
DHCP lease logs map a MAC address to the IP it held and when it held it, which places a device on the network at a point in time. Signature catalogs, time sync records, and power reports cannot establish that mapping.
SecPlus Mastery covers all five SY0-701 domains with over 1,000 practice questions, timed mock exams, and spaced review that targets your weak spots so you walk in ready.
Original practice questions aligned to the CompTIA Security+ SY0-701 objectives. CompTIA and Security+ are trademarks of CompTIA, used here for identification only.