Loading page
20 free CompTIA Security+ practice questions spanning all five SY0-701 domains, each with the correct answer and a plain-English explanation. No account, no payment, nothing to install. Read the question, pick your answer, then reveal the explanation.
Last updated July 2026
Which security principle ensures that information has not been altered by an unauthorized party?
Correct answer: B. Integrity
Integrity ensures data is not modified by unauthorized users, and hashing is used to verify it. Confidentiality is about secrecy, availability is about access, and non-repudiation is about proving who took an action.
A system uses a key pair so that data encrypted with the public key can only be decrypted with the matching private key. What type of cryptography is this?
Correct answer: C. Asymmetric encryption
Asymmetric (public key) cryptography uses a public and private key pair. Symmetric encryption uses one shared key, hashing is one-way and cannot be decrypted, and steganography hides data inside other data.
A login requires a password plus a code from an authenticator app. Which two authentication factors are in use?
Correct answer: A. Something you know and something you have
A password is something you know, and a one-time code from an authenticator app is something you have. Combining two different factor types is what makes it true multifactor authentication.
An attacker sends a text message pretending to be your bank to trick you into giving up your credentials. What is this attack called?
Correct answer: C. Smishing
Smishing is phishing carried out over SMS text messages. Vishing uses voice or phone calls, whaling targets high-value executives, and phishing is the general email-based term.
Which type of malware encrypts a victim's files and demands payment for the decryption key?
Correct answer: C. Ransomware
Ransomware encrypts files and demands a ransom for the key. A rootkit hides privileged access, a worm self-propagates across systems, and a logic bomb triggers when a specific condition is met.
Which device sits inline on the network and can automatically block malicious traffic, not just alert on it?
Correct answer: B. IPS
An IPS (intrusion prevention system) sits inline and can drop or block malicious traffic in real time. An IDS (intrusion detection system) only detects and alerts, it does not stop the traffic.
Which approach best protects a critical server against a single point of failure?
Correct answer: B. Redundancy and high availability
Redundancy through clustering, failover, and load balancing removes single points of failure and supports availability. Passwords and encryption protect confidentiality, not uptime.
What is the best first step to reduce the attack surface of a newly deployed server?
Correct answer: A. Disable unnecessary services and close unused ports
Disabling unneeded services, closing unused ports, and removing default or guest accounts hardens the host and shrinks its attack surface. Enabling guest accounts or default credentials does the opposite.
In a public key infrastructure (PKI), what is the primary role of a Certificate Authority (CA)?
Correct answer: B. It issues, signs, and revokes digital certificates
A Certificate Authority issues, signs, and revokes digital certificates that bind a public key to a verified identity. It is the trust anchor of a PKI.
A company buys cyber insurance to cover the financial impact of a potential breach. Which risk response is this?
Correct answer: C. Risk transference
Buying insurance transfers the financial risk to a third party, which is risk transference. Avoidance stops the risky activity, acceptance takes no action, and mitigation reduces the likelihood or impact with controls.
An attacker with a stolen password triggers dozens of push notifications to the victim's authenticator app late at night until the annoyed user finally taps Approve. Which attack is this?
Correct answer: B. MFA fatigue
MFA fatigue (push bombing) floods a user with authentication prompts hoping one gets approved out of annoyance or confusion. The password was already stolen, so it is not brute force; SIM swapping hijacks a phone number to intercept codes; credential harvesting is how the password was obtained in the first place, not this prompt flood.
A third party is authorized to actively exploit findings in a production-like environment to prove business impact and test detection. Which assessment is this?
Correct answer: D. Penetration test
Penetration tests attempt exploitation to validate real impact and detection. Vulnerability scans report known weaknesses without exploiting them, tabletops are discussion exercises, and privacy questionnaires evaluate data handling.
A user receives a text message claiming to be from their bank, with a link to "verify" their account. Which attack is this?
Correct answer: C. Smishing
Smishing is phishing delivered over SMS text messages. Vishing uses voice calls, whaling targets executives specifically, and spear phishing is a tailored email attack.
A developer adds a unique random value to each password before hashing it, so identical passwords produce different hashes. What is this value called?
Correct answer: B. A salt
A salt is a per-password random value that defeats precomputed rainbow tables and hides duplicate passwords. A nonce prevents replay of messages, an IV randomizes cipher output, and a pepper is a secret value kept outside the database, not stored with each hash.
A login form passes whatever the user types directly into a database query, and entering ' OR 1=1 -- returns every account. Which vulnerability is this?
Correct answer: D. SQL injection
Concatenating raw user input into a database query allows SQL injection, and parameterized queries are the fix. XSS injects script into pages viewed by other users, buffer overflows corrupt memory, and traversal escapes a directory with path tricks.
After a workstation is compromised, attackers cannot reach the server VLAN because firewall rules only permit specific application ports between zones. Which mitigation limited the damage?
Correct answer: A. Network segmentation
Segmentation divides the network into zones and restricts traffic between them, containing a compromise to its segment. Disk encryption protects stored data, key stretching slows password cracking, and stapling speeds certificate revocation checks.
A vulnerability report lists a finding with a CVSS base score of 9.8. What does this number communicate?
Correct answer: C. The severity of the vulnerability on a standard 0 to 10 scale
CVSS scores vulnerability severity from 0 to 10 based on exploitability and impact metrics, and 9.8 is critical. The score says nothing about how many of your systems are affected, how old the flaw is, or what fixing it costs.
After an outage, a business requires that its order system be restored within four hours. Which metric captures this four-hour target?
Correct answer: D. Recovery time objective (RTO)
RTO is the maximum acceptable time to restore a function after disruption. RPO is the maximum acceptable data loss measured in time, MTBF is a reliability average, and ARO estimates how often a risk event happens per year.
Investigators document every person who handled a seized laptop, when they had it, and why, from collection through courtroom. What does this record preserve?
Correct answer: B. Chain of custody
Chain of custody documents who controlled evidence at every moment so its integrity holds up legally. Order of volatility guides what to collect first, data sovereignty ties data to jurisdictions, and separation of duties splits sensitive tasks between people.
A departing engineer starts copying large volumes of design documents to personal cloud storage two weeks before resigning. Which threat does this behavior indicate?
Correct answer: A. Insider threat
An employee abusing legitimate access to take data is an insider threat, and unusual bulk transfers before resignation are a classic indicator. APTs are external long-term intruders, hacktivists act for causes, and typosquatting abuses lookalike domains.
This is a free sample. SecPlus Mastery has over 1,000 practice questions, full timed mock exams, spaced review that targets your weak spots, and lessons across all five domains.
Keep studying: full practice test, ports cheat sheet, attacks cheat sheet, and the acronyms glossary.
Practice questions are original study material aligned to the CompTIA Security+ SY0-701 objectives. CompTIA and Security+ are trademarks of CompTIA, used here for identification only.