Free Security+ Practice Questions (SY0-701)
20 free CompTIA Security+ practice questions spanning all five SY0-701 domains, each with the correct answer and a plain-English explanation. No account, no payment, nothing to install. Read the question, pick your answer, then reveal the explanation.
Last updated August 2026
- Question 11.0 General Security Concepts
Which security principle ensures that information has not been altered by an unauthorized party?
- AAvailability
- BIntegrity
- CConfidentiality
- DNon-repudiation
Show answer and explanation
Correct answer: B. Integrity
Integrity ensures data is not modified by unauthorized users, and hashing is used to verify it. Confidentiality is about secrecy, availability is about access, and non-repudiation is about proving who took an action.
- Question 21.0 General Security Concepts
A system uses a key pair so that data encrypted with the public key can only be decrypted with the matching private key. What type of cryptography is this?
- ASymmetric encryption
- BSteganography
- CAsymmetric encryption
- DHashing
Show answer and explanation
Correct answer: C. Asymmetric encryption
Asymmetric (public key) cryptography uses a public and private key pair. Symmetric encryption uses one shared key, hashing is one-way and cannot be decrypted, and steganography hides data inside other data.
- Question 31.0 General Security Concepts
A login requires a password plus a code from an authenticator app. Which two authentication factors are in use?
- ASomething you know and something you have
- BTwo separate things you know
- CSomething you are and something you know
- DSomething you have and somewhere you are
Show answer and explanation
Correct answer: A. Something you know and something you have
A password is something you know, and a one-time code from an authenticator app is something you have. Combining two different factor types is what makes it true multifactor authentication.
- Question 42.0 Threats, Vulnerabilities, and Mitigations
An attacker sends a text message pretending to be your bank to trick you into giving up your credentials. What is this attack called?
- AVishing
- BPhishing
- CWhaling
- DSmishing
Show answer and explanation
Correct answer: D. Smishing
Smishing is phishing carried out over SMS text messages. Vishing uses voice or phone calls, whaling targets high-value executives, and phishing is the general email-based term.
- Question 52.0 Threats, Vulnerabilities, and Mitigations
Which type of malware encrypts a victim's files and demands payment for the decryption key?
- ARootkit
- BWorm
- CRansomware
- DLogic bomb
Show answer and explanation
Correct answer: C. Ransomware
Ransomware encrypts files and demands a ransom for the key. A rootkit hides privileged access, a worm self-propagates across systems, and a logic bomb triggers when a specific condition is met.
- Question 63.0 Security Architecture
Which device sits inline on the network and can automatically block malicious traffic, not just alert on it?
- AIPS
- BIDS
- CSyslog server
- DProxy server
Show answer and explanation
Correct answer: A. IPS
An IPS (intrusion prevention system) sits inline and can drop or block malicious traffic in real time. An IDS (intrusion detection system) only detects and alerts, it does not stop the traffic.
- Question 73.0 Security Architecture
Which approach best protects a critical server against a single point of failure?
- ARedundancy and high availability
- BEnforcing stronger passwords
- CFull disk encryption
- DA longer backup retention period
Show answer and explanation
Correct answer: A. Redundancy and high availability
Redundancy through clustering, failover, and load balancing removes single points of failure and supports availability. Passwords and encryption protect confidentiality, not uptime.
- Question 84.0 Security Operations
What is the best first step to reduce the attack surface of a newly deployed server?
- ADisable unnecessary services and close unused ports
- BLeave default credentials in place for support
- CEnable the guest account for easy access
- DInstall antivirus and nothing else
Show answer and explanation
Correct answer: A. Disable unnecessary services and close unused ports
Disabling unneeded services, closing unused ports, and removing default or guest accounts hardens the host and shrinks its attack surface. Enabling guest accounts or default credentials does the opposite.
- Question 94.0 Security Operations
In a public key infrastructure (PKI), what is the primary role of a Certificate Authority (CA)?
- AIt issues, signs, and revokes digital certificates
- BIt encrypts all traffic on the network
- CIt scans endpoints for malware
- DIt stores user passwords securely
Show answer and explanation
Correct answer: A. It issues, signs, and revokes digital certificates
A Certificate Authority issues, signs, and revokes digital certificates that bind a public key to a verified identity. It is the trust anchor of a PKI.
- Question 105.0 Security Program Management and Oversight
A company buys cyber insurance to cover the financial impact of a potential breach. Which risk response is this?
- ARisk transference
- BRisk acceptance
- CRisk mitigation
- DRisk avoidance
Show answer and explanation
Correct answer: A. Risk transference
Buying insurance transfers the financial risk to a third party, which is risk transference. Avoidance stops the risky activity, acceptance takes no action, and mitigation reduces the likelihood or impact with controls.
Halfway. Reading an answer that is already on the screen is not the same as recalling it under a clock. A free account gives you 271 Domain 1 questions graded, plus a placement check and a dated plan.
- Question 112.0 Threats, Vulnerabilities, and Mitigations
An attacker with a stolen password triggers dozens of push notifications to the victim's authenticator app late at night until the annoyed user finally taps Approve. Which attack is this?
- ABrute force against the password
- BSIM swapping
- CMFA fatigue
- DCredential harvesting
Show answer and explanation
Correct answer: C. MFA fatigue
MFA fatigue (push bombing) floods a user with authentication prompts hoping one gets approved out of annoyance or confusion. The password was already stolen, so it is not brute force; SIM swapping hijacks a phone number to intercept codes; credential harvesting is how the password was obtained in the first place, not this prompt flood.
- Question 125.0 Security Program Management and Oversight
A third party is authorized to actively exploit findings in a production-like environment to prove business impact and test detection. Which assessment is this?
- APrivacy impact questionnaire
- BPenetration test
- CTabletop discussion
- DVulnerability scan only
Show answer and explanation
Correct answer: B. Penetration test
Penetration tests attempt exploitation to validate real impact and detection. Vulnerability scans report known weaknesses without exploiting them, tabletops are discussion exercises, and privacy questionnaires evaluate data handling.
- Question 132.0 Threats, Vulnerabilities, and Mitigations
A traveler joins a free airport hotspot named "Airport_WiFi_Free" that an attacker set up to mimic the real one, and the attacker then reads their unencrypted traffic. Which attack is this?
- ADeauthentication attack
- BBluesnarfing
- CEvil twin
- DDNS poisoning
Show answer and explanation
Correct answer: C. Evil twin
An evil twin is a rogue wireless access point impersonating a legitimate network so victims connect through the attacker, who can then read or alter their traffic. DNS poisoning corrupts name resolution records, bluesnarfing steals data over Bluetooth, and a deauthentication attack forces clients off a network rather than luring them onto one.
- Question 141.0 General Security Concepts
A developer adds a unique random value to each password before hashing it, so identical passwords produce different hashes. What is this value called?
- AA salt
- BA pepper stored in the database
- CA nonce for replay protection
- DAn initialization vector for a cipher
Show answer and explanation
Correct answer: A. A salt
A salt is a per-password random value that defeats precomputed rainbow tables and hides duplicate passwords. A nonce prevents replay of messages, an IV randomizes cipher output, and a pepper is a secret value kept outside the database, not stored with each hash.
- Question 152.0 Threats, Vulnerabilities, and Mitigations
A login form passes whatever the user types directly into a database query, and entering ' OR 1=1 -- returns every account. Which vulnerability is this?
- ASQL injection
- BCross-site scripting
- CDirectory traversal
- DBuffer overflow
Show answer and explanation
Correct answer: A. SQL injection
Concatenating raw user input into a database query allows SQL injection, and parameterized queries are the fix. XSS injects script into pages viewed by other users, buffer overflows corrupt memory, and traversal escapes a directory with path tricks.
- Question 162.0 Threats, Vulnerabilities, and Mitigations
After a workstation is compromised, attackers cannot reach the server VLAN because firewall rules only permit specific application ports between zones. Which mitigation limited the damage?
- AFull disk encryption
- BCertificate stapling
- CKey stretching
- DNetwork segmentation
Show answer and explanation
Correct answer: D. Network segmentation
Segmentation divides the network into zones and restricts traffic between them, containing a compromise to its segment. Disk encryption protects stored data, key stretching slows password cracking, and stapling speeds certificate revocation checks.
- Question 174.0 Security Operations
A vulnerability report lists a finding with a CVSS base score of 9.8. What does this number communicate?
- AThe severity of the vulnerability on a standard 0 to 10 scale
- BThe age of the vulnerability in months
- CThe cost of remediation in thousands of dollars
- DThe number of systems affected in the environment
Show answer and explanation
Correct answer: A. The severity of the vulnerability on a standard 0 to 10 scale
CVSS scores vulnerability severity from 0 to 10 based on exploitability and impact metrics, and 9.8 is critical. The score says nothing about how many of your systems are affected, how old the flaw is, or what fixing it costs.
- Question 185.0 Security Program Management and Oversight
After an outage, a business requires that its order system be restored within four hours. Which metric captures this four-hour target?
- ARecovery point objective (RPO)
- BAnnualized rate of occurrence (ARO)
- CMean time between failures (MTBF)
- DRecovery time objective (RTO)
Show answer and explanation
Correct answer: D. Recovery time objective (RTO)
RTO is the maximum acceptable time to restore a function after disruption. RPO is the maximum acceptable data loss measured in time, MTBF is a reliability average, and ARO estimates how often a risk event happens per year.
- Question 194.0 Security Operations
Investigators document every person who handled a seized laptop, when they had it, and why, from collection through courtroom. What does this record preserve?
- AChain of custody
- BOrder of volatility
- CData sovereignty
- DSeparation of duties
Show answer and explanation
Correct answer: A. Chain of custody
Chain of custody documents who controlled evidence at every moment so its integrity holds up legally. Order of volatility guides what to collect first, data sovereignty ties data to jurisdictions, and separation of duties splits sensitive tasks between people.
- Question 202.0 Threats, Vulnerabilities, and Mitigations
A departing engineer starts copying large volumes of design documents to personal cloud storage two weeks before resigning. Which threat does this behavior indicate?
- AHacktivism
- BTyposquatting
- CAdvanced persistent threat
- DInsider threat
Show answer and explanation
Correct answer: D. Insider threat
An employee abusing legitimate access to take data is an insider threat, and unusual bulk transfers before resignation are a classic indicator. APTs are external long-term intruders, hacktivists act for causes, and typosquatting abuses lookalike domains.
Want the full question bank?
You just worked 20 questions with the answers next to them. A free account starts the other half of that: it grades you, tracks what you miss, and brings it back on a schedule.
- All 4 Domain 1 objectives: a lesson, a hands-on lab and 57 to 77 exam-style questions each
- A placement check that skips you past what you already know
- A dated day-by-day plan built around your exam date
- One timed sitting from a domain you have not paid for, 10 questions that open with a PBQ
- 3 terminal labs and 2 alert-triage drills
Free forever on Domain 1. No card.
New accounts get 30% off both plans for 7 days: the 90-Day Pass is $27.30 instead of $39.
Security+ practice questions FAQ
Are these Security+ practice questions free?
Yes. Every question on this page is free, with the correct answer and an explanation. No account, payment, or download is required.Which exam version do these questions cover?
They follow the current CompTIA Security+ SY0-701 objectives and span all five domains, from general security concepts to security program management.Are these real CompTIA exam questions?
No. These are original practice questions written to match the SY0-701 objectives. CompTIA does not release live exam questions, and using leaked questions violates their exam policy.How many practice questions does SecPlus Mastery have?
The full platform includes over 1,000 practice questions plus timed mock exams, lessons, and spaced review across all five domains. This page is a free sample of that bank.
Wondering how these questions get written and checked? Read how we write and vet every question, or browse every free study tool on the site.
Keep studying: full practice test, ports cheat sheet, attacks cheat sheet, and the acronyms glossary.
Practice questions are original study material aligned to the CompTIA Security+ SY0-701 objectives. CompTIA and Security+ are trademarks of CompTIA, used here for identification only.