Security+ Domain 4 Practice Questions: Security Operations
40 free CompTIA Security+ SY0-701 practice questions for Domain 4, Security Operations, which is about 28% of the exam. Each question has the correct answer and a clear explanation. No account or signup needed.
Last updated August 2026
- Question 1
Which platform automates and orchestrates repetitive security tasks across many tools using predefined playbooks to speed up response?
- ASOAR
- BVPN
- CDLP
- DIDS
Show answer and explanation
Correct answer: A. SOAR
SOAR (Security Orchestration, Automation, and Response) runs playbooks to automate and coordinate responses across tools. An IDS detects intrusions, DLP prevents data loss, and a VPN encrypts connections.
- Question 2
Running a suspicious email attachment in an isolated, instrumented environment to safely watch what it does is known as?
- AHashing
- BSandboxing
- CHardening
- DTunneling
Show answer and explanation
Correct answer: B. Sandboxing
Sandboxing detonates and observes suspicious code in isolation so it cannot harm production. Hashing fingerprints a file, tunneling encapsulates traffic, and hardening reduces a system attack surface.
- Question 3
Which endpoint solution continuously monitors devices for malicious behavior and can isolate a host and roll back changes during an incident?
- AEDR
- BA host firewall
- CA signature-only antivirus
- DA password manager
Show answer and explanation
Correct answer: A. EDR
EDR (Endpoint Detection and Response) provides continuous monitoring, investigation, and response actions like host isolation. Traditional signature antivirus only blocks known files and lacks that response capability.
- Question 4
Which technology lets a user authenticate once and then access many different applications without logging in again to each one?
- ASingle sign-on (SSO)
- BNetwork access control
- CA password vault
- DMultifactor authentication
Show answer and explanation
Correct answer: A. Single sign-on (SSO)
SSO authenticates a user once and grants access to multiple services. Multifactor authentication adds factors to a single login, a password vault stores credentials, and NAC controls device admission.
- Question 5
Which standard lets a user authenticate with the identity provider of one organization and then access a web application at a different organization?
- AWPA3
- BSAML (federation)
- CRADIUS
- DIPsec
Show answer and explanation
Correct answer: B. SAML (federation)
SAML enables federated identity, letting one organization trust the identity provider of another for single sign-on across domains. RADIUS centralizes network access authentication, WPA3 secures Wi-Fi, and IPsec secures IP traffic.
- Question 6
Which solution vaults and rotates administrator credentials and grants just-in-time elevated access with full session monitoring?
- AA SIEM
- BA load balancer
- CPrivileged access management (PAM)
- DSingle sign-on
Show answer and explanation
Correct answer: C. Privileged access management (PAM)
PAM controls, vaults, rotates, and monitors privileged (administrator) accounts and grants temporary elevation. SSO handles everyday authentication, a SIEM analyzes logs, and a load balancer distributes traffic.
- Question 7
Which activity uses automated tools to identify and report known weaknesses on systems without actually exploiting them?
- ATabletop exercise
- BPenetration test
- CVulnerability scan
- DThreat modeling
Show answer and explanation
Correct answer: C. Vulnerability scan
A vulnerability scan automatically detects and reports known flaws but does not exploit them. A penetration test goes further and actively exploits weaknesses to prove impact.
- Question 8
A vulnerability scanner flags a weakness on a server, but investigation shows the flaw does not actually exist there. This result is a?
- ATrue positive
- BFalse negative
- CFalse positive
- DZero-day
Show answer and explanation
Correct answer: C. False positive
A false positive is an alert for something that is not really a problem. A false negative is a real issue that went undetected, and a true positive is a correctly identified real issue.
- Question 9
Permitting only a pre-approved set of applications to run on endpoints and blocking everything else is best described as?
- APatch management
- BApplication allow listing
- CSandboxing
- DApplication block listing
Show answer and explanation
Correct answer: B. Application allow listing
Allow listing (whitelisting) permits only approved applications and denies all others by default, which is very restrictive but strong. Block listing only denies known-bad items and allows the rest.
- Question 10
A decoy system is deliberately exposed with fake data to attract attackers so their methods can be studied. What is this called?
- AHoneypot
- BJump server
- CProxy server
- DBastion host
Show answer and explanation
Correct answer: A. Honeypot
A honeypot is a decoy designed to lure and observe attackers. A jump server and a bastion host are hardened administrative gateways, and a proxy mediates client requests.
- Question 11
An administrator must ensure laptops only boot signed firmware and OS loaders so malware cannot replace the boot chain. Which technology best enforces this?
- AFull disk encryption
- BUEFI Secure Boot
- CHost-based firewall
- DRemote wipe via MDM
Show answer and explanation
Correct answer: B. UEFI Secure Boot
UEFI Secure Boot verifies digital signatures on boot components before execution. Full disk encryption protects data at rest, a host firewall filters traffic, and MDM wipe removes data after loss, none of which validate the boot chain.
- Question 12
A security team deploys a hardened configuration image to all new workstations and rechecks them monthly for drift. What practice is this primarily demonstrating?
- ASecure baseline enforcement
- BDisaster recovery testing
- CPenetration testing
- DVulnerability scanning
Show answer and explanation
Correct answer: A. Secure baseline enforcement
A secure baseline defines approved settings and is reapplied or audited to prevent configuration drift. Vulnerability scans find known flaws, pen tests attempt exploitation, and DR tests validate recovery, not day-to-day hardening consistency.
- Question 13
An employee loses a company phone that holds corporate email. Which MDM action most quickly reduces data exposure?
- AEnable full packet capture
- BDisable SNMP on the phone
- CRemote wipe of the device
- DCertificate pin the mail app
Show answer and explanation
Correct answer: C. Remote wipe of the device
Remote wipe removes corporate data from a lost or stolen mobile device. Certificate pinning hardens app TLS trust, packet capture is investigative, and SNMP is rarely relevant on phones, so none match immediate exposure reduction.
- Question 14
Before retiring old hard drives that stored customer records, the company must ensure data cannot be recovered. Which disposal method best meets that goal for magnetic disks?
- AUnplugging the drives only
- BMoving files to recycle bin
- CQuick format of the volume
- DDegaussing
Show answer and explanation
Correct answer: D. Degaussing
Degaussing destroys the magnetic domains that store the data, so nothing readable remains on the platters. A quick format and the recycle bin only remove references and leave the data recoverable, and unplugging a drive changes nothing on it.
- Question 15
A security manager cannot tell which servers own critical payment data because no current inventory exists. Which asset management failure is this?
- AWeak password hashing
- BIncomplete asset inventory
- CMissing certificate revocation
- DAbsent change advisory board
Show answer and explanation
Correct answer: B. Incomplete asset inventory
Without a maintained inventory of hardware, software, and data owners, teams cannot protect or prioritize assets. Revocation, hashing, and CAB processes address other controls, not knowing what systems and data you have.
- Question 16
A vendor announces a product reaches end of life next month and will receive no further security updates. What should operations do first for systems still running it?
- APlan migration or compensating controls
- BIgnore the notice until next audit
- CDisable all logging on those hosts
- DOnly update the marketing website
Show answer and explanation
Correct answer: A. Plan migration or compensating controls
EOL software will not get patches, so migrate off it or add compensating controls quickly. Ignoring risk, marketing changes, or disabling logs does not address unpatched exposure on production systems.
- Question 17
An organization classifies databases as public, internal, confidential, or restricted to set handling rules. What is the primary purpose of this labeling?
- AEliminate all third-party risk
- BReplace the need for backups
- CGuide protection and access decisions
- DGuarantee zero residual risk
Show answer and explanation
Correct answer: C. Guide protection and access decisions
Data classification drives how data is stored, shared, encrypted, and accessed. It does not replace backups, remove vendor risk, or eliminate residual risk after controls are applied.
- Question 18
After patching a critical server vulnerability, the analyst rescans and confirms the finding is gone. What vulnerability management step is this?
- ARemediation validation
- BTabletop exercise
- CThreat hunting
- DChain of custody
Show answer and explanation
Correct answer: A. Remediation validation
Validation confirms fixes actually closed the vulnerability. Threat hunting looks for active adversaries, tabletops practice response scenarios, and chain of custody tracks evidence handling, not patch success.
- Question 19
A scanner needs local credentials to inventory missing patches and insecure services more accurately. Which scan type is this?
- ASocial engineering assessment
- BCredentialed scan
- CExternal black-box pen test
- DPassive DNS monitoring
Show answer and explanation
Correct answer: B. Credentialed scan
Credentialed scans authenticate to hosts for deeper, more accurate findings. Black-box pen tests exploit without deep credentials, passive DNS watches queries, and social engineering targets people, not host configuration detail.
- Question 20
Security ranks open findings by exploitability and business impact rather than fixing every medium issue first. Which practice is being applied?
- AFull disk encryption
- BRisk-based prioritization
- CNetwork address translation
- DCertificate pinning
Show answer and explanation
Correct answer: B. Risk-based prioritization
Risk-based prioritization focuses effort where impact and likelihood are highest. Encryption, pinning, and NAT are technical controls that do not decide the order of vulnerability remediation work.
- Question 21
Developers want to find insecure coding patterns in source before release without running the application. Which method fits best?
- APacket capture analysis
- BHardware security module review
- CStatic application security testing
- DDynamic application security testing
Show answer and explanation
Correct answer: C. Static application security testing
SAST analyzes source or bytecode without execution. DAST tests a running app, packet capture inspects network traffic, and HSM review concerns key hardware, not application source flaws.
- Question 22
Analysts keep closing alerts that fire for normal nightly batch jobs. What monitoring improvement most directly reduces this noise?
- ABuying more endpoint licenses
- BAlert tuning and baselining
- CDisabling all authentication logs
- DRemoving multi-factor authentication
Show answer and explanation
Correct answer: B. Alert tuning and baselining
Tuning thresholds and baselining normal behavior cuts false alerts. More licenses, disabling auth logs, or removing MFA do not fix noisy rules and can weaken detection or security.
- Question 23
A network team needs metadata about conversations between hosts, including bytes transferred and duration, without full packet payloads. Which data source is most appropriate?
- APassword hash dumps
- BFull disk images
- CPhysical access badges only
- DNetFlow or IPFIX records
Show answer and explanation
Correct answer: D. NetFlow or IPFIX records
Flow records summarize connections and volume without storing full payloads. Disk images and hash dumps support host forensics, and badge data tracks physical access, not network session metadata.
- Question 24
An administrator wants critical servers to send security events to a central collector using a standard network logging protocol. Which protocol is commonly used?
- AFTP
- BSyslog
- CRDP
- DSMTP
Show answer and explanation
Correct answer: B. Syslog
Syslog is the standard protocol for forwarding system and security events to a central collector. FTP transfers files, SMTP delivers mail, and RDP is a remote desktop session, none of which are logging transports.
- Question 25
Security deploys agents that watch for unexpected changes to system binaries and configuration files. Which monitoring capability is this?
- AData tokenization
- BPort address translation
- CFile integrity monitoring
- DLoad balancing
Show answer and explanation
Correct answer: C. File integrity monitoring
File integrity monitoring detects unauthorized changes to critical files. Load balancing spreads traffic, tokenization replaces sensitive values, and PAT translates ports, none of which track file change integrity.
- Question 26
The security team wants to stop users from resolving known malicious domains at the DNS layer. Which capability should they enable?
- AScreened subnet only for printers
- BDNS filtering or sinkholing
- CRAID 1 mirroring
- DOffline cold storage
Show answer and explanation
Correct answer: B. DNS filtering or sinkholing
DNS filtering or sinkholing blocks or redirects lookups to bad domains. RAID mirrors disks, screened subnets isolate network zones, and cold storage preserves offline data, not DNS resolution control.
- Question 27
An administrator configures email gateways to reject messages that fail domain authentication checks defined by the sending domain owner. Which controls are involved?
- ARAID, NAS, and SAN
- BDHCP, ARP, and ICMP
- CNFC, RFID, and Bluetooth
- DSPF, DKIM, and DMARC
Show answer and explanation
Correct answer: D. SPF, DKIM, and DMARC
SPF, DKIM, and DMARC authenticate and enforce email domain authenticity. Storage and network protocol families listed do not validate outbound domain ownership for email messages.
- Question 28
To stop unauthorized devices from plugging into empty wall jacks, switches require authentication before granting network access. Which feature supports this?
- ASpanning Tree PortFast
- B802.1X port-based authentication
- CDHCP reservations
- DPort mirroring (SPAN)
Show answer and explanation
Correct answer: B. 802.1X port-based authentication
802.1X requires a device or user to authenticate before a switch port passes traffic. Port mirroring copies traffic for analysis, DHCP reservations pin an address to a MAC, and PortFast only speeds up port transitions; none of them authenticate anything.
- Question 29
Access rights are assigned based on job function templates such as HR Clerk or Network Engineer rather than one-off per person. Which model is this?
- APhysical key control
- BMandatory vacation policy
- CDiscretionary access control
- DRole-based access control
Show answer and explanation
Correct answer: D. Role-based access control
RBAC grants permissions through roles aligned to job duties, so people inherit rights from the role. DAC lets resource owners hand out access ad hoc, physical keys control doors, and mandatory vacation is a fraud-detection control, not an access model.
- Question 30
A policy automatically denies cloud logins from unmanaged devices outside approved countries. Which IAM approach is described?
- AWarm site failover
- BConditional access policy
- CFull packet capture
- DDisk striping
Show answer and explanation
Correct answer: B. Conditional access policy
Conditional access evaluates signals such as device state and location before allowing sign-in. Packet capture, striping, and warm sites address monitoring, storage performance, or recovery, not access decisions.
- Question 31
Managers must periodically confirm that each subordinate still needs their assigned system permissions. What process is this?
- ABackup rotation scheme
- BThreat modeling workshop
- CCertificate enrollment
- DAccess recertification review
Show answer and explanation
Correct answer: D. Access recertification review
Access reviews recertify that entitlements remain appropriate over time. Enrollment issues certificates, threat modeling designs for risks, and backup rotation manages recovery media, not permission validity.
- Question 32
Infrastructure templates define secure cloud resources so every deployment is consistent and reviewable in version control. What practice is this?
- AManual console-only builds
- BAir-gapped paper runbooks only
- CPhysical media courier
- DInfrastructure as code
Show answer and explanation
Correct answer: D. Infrastructure as code
Infrastructure as code stores environment definitions as code for repeatable, auditable deployments. Manual console builds, paper-only runbooks, or couriers do not provide the same automated consistency.
- Question 33
When a new hire is added in HR software, accounts and group memberships are created automatically across directory and SaaS apps. What capability is this?
- AAutomated identity provisioning
- BPort mirroring for capture
- CHoneynet traffic generation
- DDisk imaging for forensics
Show answer and explanation
Correct answer: A. Automated identity provisioning
Automated provisioning links joiner events to account creation and access grants. Imaging, port mirroring, and honeynets support forensics, monitoring, or deception, not lifecycle account setup.
- Question 34
During a malware outbreak, responders disconnect affected hosts from the network while preserving volatile evidence. Which incident phase is this primarily?
- AContainment
- BLessons learned
- CPost-incident reporting only
- DPreparation only
Show answer and explanation
Correct answer: A. Containment
Containment limits spread while keeping investigation options open. Lessons learned and reporting come after handling, and preparation is readiness work done before an incident occurs.
- Question 35
Investigators create a bit-for-bit copy of a suspect disk and hash both original and copy before analysis. Why is this done?
- AIncrease application throughput
- BReplace need for legal counsel
- CPreserve integrity of digital evidence
- DAutomatically patch the host
Show answer and explanation
Correct answer: C. Preserve integrity of digital evidence
Forensic imaging with hashing shows the working copy matches the original and was not altered. It does not speed apps, replace legal advice, or remediate vulnerabilities on the system.
- Question 36
After eradicating ransomware and restoring systems, the team documents what worked, what failed, and process updates. Which activity is this?
- AInitial detection triage
- BLive traffic spoofing
- CLessons learned review
- DCertificate issuance
Show answer and explanation
Correct answer: C. Lessons learned review
Lessons learned captures improvements after recovery. Triage happens early in detection, spoofing is an attack technique, and certificate issuance is PKI operations, not post-incident improvement.
- Question 37
Legal asks that mailbox contents related to a lawsuit be retained unchanged even if retention timers would delete them. What is this request?
- ACertificate pinning
- BVLAN hopping test
- CWarm site activation
- DLegal hold
Show answer and explanation
Correct answer: D. Legal hold
A legal hold suspends normal deletion so evidence remains available. Warm sites support DR capacity, pinning hardens TLS trust, and VLAN hopping is a network attack technique.
- Question 38
An analyst investigates possible data theft and needs to see which external hosts an endpoint contacted and how much data was sent. Which source helps most?
- ADNS zone transfer files
- BFirewall or proxy connection logs
- CWindows Update history
- DPrint spooler logs
Show answer and explanation
Correct answer: B. Firewall or proxy connection logs
Firewall and proxy logs record destination addresses, timestamps, and often byte counts for outbound connections, exactly what an exfiltration investigation needs. Zone transfers, patch history, and print queues do not reconstruct egress traffic.
- Question 39
A phishing investigation requires knowing who received a message, the return path, and intermediate mail servers. Which artifact should be examined?
- AProxy cache hit statistics
- BDHCP scope options
- CTLS cipher suite order
- DEmail header fields
Show answer and explanation
Correct answer: D. Email header fields
Email headers record the return path, each relay hop, and authentication results, which is what a phishing investigation needs. DHCP scopes, cipher ordering, and cache statistics say nothing about how a message was routed.
- Question 40
Responders need to know which internal IP a laptop used at the time of an incident and when it obtained that address. Which logs should they query?
- ADHCP lease logs
- BNTP synchronization logs
- CAntivirus signature catalogs
- DSwitch PoE power reports
Show answer and explanation
Correct answer: A. DHCP lease logs
DHCP lease logs map a MAC address to the IP it held and when it held it, which places a device on the network at a point in time. Signature catalogs, time sync records, and power reports cannot establish that mapping.
Master every domain
A free account opens all of Domain 1: a lesson, a hands-on lab and a graded question bank on every objective, plus a placement check and a dated plan. No card.
FAQ
Are these Security+ Domain 4 practice questions free?
Yes. Every question on this page is free, with the correct answer and an explanation. No account, payment, or download is required.How much of the Security+ exam is Domain 4?
Domain 4, Security Operations, accounts for about 28% of the CompTIA Security+ SY0-701 exam.
Practice another domain
Original practice questions aligned to the CompTIA Security+ SY0-701 objectives. CompTIA and Security+ are trademarks of CompTIA, used here for identification only.