Home/Tools/Security+ Practice Questions
Free Security+ Practice Test: SY0-701 and SY0-801
50 free CompTIA Security+ practice questions across all five exam domains, each with an explanation and a score for every domain at the end. Choose SY0-701, which you can take in English until June 11, 2027, or SY0-801, the V8 exam launching on or around November 17, 2026. No sign-up required.
Question 1 of 20General security concepts
Score: 0
A manufacturing plant runs a controller on an operating system the vendor no longer patches, and replacing it is not possible this year. The team moves the controller to an isolated network segment with tightly restricted access. Which control type BEST describes this segmentation?
All 50 Security+ practice questions with answers
Every question in the bank, grouped by exam domain. Open one to see the answer and the reasoning.
General security concepts
A manufacturing plant runs a controller on an operating system the vendor no longer patches, and replacing it is not possible this year. The team moves the controller to an isolated network segment with tightly restricted access. Which control type BEST describes this segmentation?
Answer: Compensating
The segmentation stands in for a safeguard that cannot be applied, patching, which is what a compensating control does. It is not detective, because it reduces exposure rather than spotting activity after the fact.
A purchasing manager needs proof that a contract email really came from a specific supplier, in a form the supplier cannot later deny. Which mechanism provides this?
Answer: The supplier signs a hash of the message with its private key
Only the supplier holds its private key, so a signature that verifies with the supplier's public key gives non-repudiation. A keyed hash with a shared secret proves integrity, but either party could have produced it, so the supplier could still deny sending the message.
A company stops granting broad access to anyone connected to the office network. Every request to an internal application is now evaluated on user identity, device health and context, even from inside the building. Which principle is being applied?
Answer: Zero Trust
Zero Trust removes trust based on network location and verifies each request using identity, device posture and context. Defence in depth layers several controls, but on its own it does not stop trusting a device simply because it sits on the internal network.
A firewall firmware upgrade is approved for Saturday night's maintenance window. Which part of the change request tells the engineer exactly how to return the device to its previous working state if the upgrade fails?
Answer: Backout plan
The backout plan documents the steps to reverse a change and restore the prior working state. Impact analysis predicts what the change will affect, but it does not provide the rollback procedure.
A web browser wants a current answer about whether one specific server certificate has been revoked, using a small request for just that certificate. Which mechanism fits?
Answer: Online Certificate Status Protocol (OCSP)
OCSP lets a client ask the CA's responder about the status of a single certificate and receive a current, signed answer. A CRL also conveys revocation, but the client must download the whole published list, which is only as fresh as its last publication.
During a code review, a developer notices that two users who chose the same password have identical stored password hashes. Which change would make their stored values differ?
Answer: Add a unique random salt per user before hashing
A unique random salt changes the input to the hash for every account, so identical passwords produce different stored values and precomputed rainbow tables stop working. A stronger algorithm alone is still deterministic, so the same password would still give the same hash.
After a TLS handshake completes, which type of cryptography protects the bulk of the application data flowing between browser and server?
Answer: Symmetric encryption with a negotiated session key
The handshake uses asymmetric methods to authenticate the server and agree on keys, then a symmetric cipher such as AES carries the data because it is far faster. Asymmetric encryption is the tempting answer, but it is too slow for bulk data and is used only during the handshake.
A development team wants stolen password hashes to take far longer to crack offline, so it processes each password with a function such as PBKDF2 or bcrypt that deliberately repeats the work many times. What is this technique called?SY0-701 only
Answer: Key stretching
Key stretching makes every guess expensive by iterating a hash or key derivation function, which slows brute-force and dictionary attacks. Key rotation replaces keys on a schedule, but it does nothing to slow guessing against a hash an attacker already holds.
Which technology keeps a distributed, append-only record in which each block contains a hash of the block before it, so altering an old entry breaks every later link?SY0-701 only
Answer: Blockchain
A blockchain links blocks by hash and replicates the ledger across many participants, which makes tampering with history evident. A certificate revocation list is a signed list published by a single CA and has no chained structure.
Threats and vulnerabilities
A company's AI assistant summarizes inbound email for staff. An attacker sends a message containing hidden text that tells the assistant to forward the user's recent messages to an outside address, and the assistant tries to do it. Which AI threat is this?SY0-801 only
Answer: Prompt injection
Instructions planted in content the model processes, overriding what its operator intended, are prompt injection; this indirect form arrives through data rather than the user's own typing. Poisoning is the tempting wrong answer, but it corrupts training data before deployment, while this attack happens at run time through the input.
A spam filter retrains every week on messages that users report. Over several months an attacker gets thousands of crafted samples labelled as safe into that feedback, and the filter gradually starts letting the attacker's real campaigns through. Which AI threat does this describe?SY0-801 only
Answer: Poisoning
Corrupting the data a model learns from, so it behaves the way the attacker wants, is poisoning. Evasion is the tempting choice, but evasion fools an unchanged model at inference time, whereas here the model itself was taught the wrong lesson.
A SOC analyst asks an LLM-based assistant for the CVE identifier of a vulnerability. The assistant confidently returns a well-formatted CVE number and a patch name, but neither exists in any vendor or public database. What is this an example of?SY0-801 only
Answer: Hallucination
A hallucination is fluent, confident output that is not grounded in fact, which is why AI answers used in security work must be checked against authoritative sources. Prompt injection is wrong because nobody inserted hostile instructions; the model invented the details on its own.
An attacker makes small, carefully chosen changes to a malware sample so that a machine-learning detector classifies it as benign. The attacker never touches the model or its training data. Which AI threat is this?SY0-801 only
Answer: Evasion
Evasion crafts inputs at inference time that push an unchanged model into the wrong decision. Poisoning is the tempting wrong answer, but it requires tampering with training data, which this attacker never did.
Staff at an accounting firm start pasting client tax records into a free public AI chatbot to draft letters faster. What is the PRIMARY risk this creates?SY0-801 only
Answer: Sensitive data leaving the firm's control through the AI service
Pasting confidential records into an outside AI service hands them to a third party whose retention and training use the firm does not control, which is data loss and a privacy exposure. Bias may affect the quality of answers, but it does not expose any client records.
Authentication logs show one source trying the password Winter2026! against 400 different accounts, one attempt each, spread over several hours. No accounts locked out. Which attack is this?
Answer: Password spraying
Password spraying tries one or a few common passwords across many accounts, staying under per-account lockout thresholds. Brute force is the tempting choice, but it throws many passwords at a single account and would normally trigger a lockout.
An accounts payable clerk joins a video call that appears to show the CFO urgently requesting a wire transfer to a new supplier. The face and voice look convincing. Which control BEST prevents this kind of fraud?
Answer: Confirming the request through a separately known channel
Out-of-band verification, such as calling the CFO back on a number already on file, defeats impersonation no matter how realistic the deepfake is. Blocking video apps is tempting, but the same request could arrive by phone or email, so it leaves the payment process just as exposed.
A privileged program checks that a user may write to /tmp/report, then opens the file a moment later. Between the check and the open, an attacker swaps the file for a link to a system file. Which vulnerability is being exploited?
Answer: Time-of-check to time-of-use race condition
The program acts on a check that is no longer true by the time the file is used, which is a TOC/TOU race condition. Directory traversal is tempting because a file path is involved, but traversal abuses ../ sequences in input, not a timing gap.
A web server log shows the request GET /download?file=../../../../etc/passwd returning HTTP 200. Which attack was attempted?
Answer: Directory traversal
The ../ sequences try to climb out of the application's intended folder to read a system file, which is directory traversal. It is not SQL injection, because the payload manipulates a file path rather than a database query.
A group defaces a pipeline company's website with political slogans and publishes its internal emails online. It demands no payment and says it acted to protest the company's environmental record. Which threat actor BEST fits?
Answer: Hacktivist
Hacktivists are driven by ideological or political causes and favour defacements and leaks that draw attention. Organized crime is the tempting wrong answer, but it is financially motivated and would typically demand a ransom or sell the data.
A user signs in to the corporate VPN from Toronto at 9:02 a.m., and the same account signs in from an IP address in Singapore at 9:20 a.m. Which indicator of malicious activity does this represent?
Answer: Impossible travel
Nobody can travel between those cities in 18 minutes, so impossible travel points to stolen credentials or a session in use by someone else. Account lockout is wrong because both sign-ins succeeded; lockouts follow repeated failed attempts.
Thousands of organizations install a routine, digitally signed update from a trusted IT management vendor. Investigators later find the vendor's build system was compromised and the update carried a backdoor. Which threat vector does this BEST represent?
Answer: Supply chain
The attackers compromised a trusted supplier so its legitimate distribution channel delivered the malware, which is a supply chain attack through a malicious update. A watering hole is tempting, but it compromises a website the targets visit, not a vendor's software build.
Security architecture
After a database failure, management states that the business can tolerate losing no more than 15 minutes of transactions. Which recovery metric did management just define?
Answer: Recovery point objective (RPO)
RPO is the maximum acceptable data loss measured in time, and it drives how often backups or replication must run. RTO is the tempting wrong answer, but it measures how long a system can be down, not how much data can be lost.
A small firm's continuity plan accepts up to two weeks to restore operations after a disaster, and leadership wants the cheapest alternate site option. Which should it choose?
Answer: Cold site
A cold site provides space and power but little or no equipment or data, so it is the least expensive and slowest to bring online, which suits a two-week tolerance. A warm site is tempting, but it costs more because it keeps some hardware and connectivity ready for a faster recovery.
A retailer wants its order system to keep working with card numbers without storing the real ones. Each card number is replaced with a random value, and the mapping back to the real number is kept in a separate, tightly secured vault. Which method is this?
Answer: Tokenization
Tokenization substitutes a random surrogate with no mathematical relationship to the original, and only the token vault can map it back. Masking is tempting, but it obscures part of a value, such as showing only the last four digits, and offers no vault for retrieving the original.
A Canadian company's contract with a public-sector client requires that the client's records be stored only in Canadian data centres so they stay under Canadian jurisdiction. Which concept is the contract addressing?
Answer: Data sovereignty
Data sovereignty is the principle that data is subject to the laws of the country where it is stored, so keeping records in Canada keeps them under Canadian law. Data classification is tempting, but it labels data by sensitivity and does not decide which jurisdiction applies.
An operations team keeps finding servers that have drifted from their approved configuration after manual edits. It moves to defining networks, servers and firewall rules in version-controlled templates that are reviewed and deployed automatically. Which concept is it adopting?
Answer: Infrastructure as Code
Infrastructure as Code describes infrastructure in machine-readable files, so every deployment is repeatable, reviewable and easy to compare against the approved state. Serverless is tempting because it is also cloud automation, but it removes server management for individual functions rather than codifying an environment's configuration.
A company runs its web application on virtual machines rented from an Infrastructure as a Service (IaaS) provider. Who is responsible for patching the guest operating system on those virtual machines?
Answer: The customer renting the VMs
In IaaS the provider secures the facilities, hardware and virtualization layer, while the customer manages everything from the guest OS upward, including patches. The cloud provider is the tempting answer, and it would be right for a SaaS application, but not for IaaS virtual machines.
A reporting job decrypts customer records and holds them in server memory while it calculates totals. Which data state are the records in during the calculation?
Answer: Data in use
Data being actively processed in memory or by the CPU is data in use, the state that encryption at rest and in transit does not cover. Data at rest is tempting because the records live in a database, but during the calculation they are decrypted and being worked on.
Ransomware at a law firm encrypted its file servers and then the backup repository, which was writable from the same network. Which backup property would MOST likely have preserved a clean copy?
Answer: Immutable, write-once backup storage
Immutable backups cannot be altered or deleted until their retention period ends, so an attacker who reaches the repository still cannot encrypt them. Higher frequency is tempting, but more frequent copies on a writable, reachable repository get encrypted just the same.
A team must replace an FTP job that sends payroll files to a bank. The bank requires the transfer to run inside an SSH session on TCP port 22. Which protocol meets the requirement?
Answer: SSH File Transfer Protocol (SFTP)
SFTP runs file transfer as a subsystem of SSH, so it uses the encrypted SSH session on port 22. FTPS is the tempting wrong answer: it also encrypts transfers, but it adds TLS to FTP and uses FTP's ports, such as 21 for explicit mode or 990 for implicit mode.
Security operations
A SOC deploys an agentic AI tool that investigates alerts and can act on its own, for example by disabling accounts and isolating hosts. Which safeguard BEST limits the damage if the agent misjudges a situation?SY0-801 only
Answer: Scoped permissions plus human approval for high-impact actions
An agentic tool acts without waiting for a person, so guardrails such as least-privilege permissions and a human checkpoint for destructive steps contain the impact of a wrong decision. Broad administrator rights do the opposite, making every misjudgment more damaging.
An analyst confirms that a finance workstation is infected and beaconing to an attacker's command-and-control server every 60 seconds. What should the analyst do FIRST?
Answer: Isolate the workstation from the network
With the incident confirmed, containment comes next, and isolating the host cuts the attacker's channel and stops spread while preserving evidence. Reimaging is tempting, but it is eradication and recovery work that follows containment, and doing it first destroys forensic evidence.
A responder arrives at a running server suspected of hosting fileless malware. Which evidence should be collected FIRST?
Answer: The contents of system memory (RAM)
Memory is the most volatile source and is lost when the system powers down, and fileless malware may exist only there, so it is captured first. The disk image is tempting, but disk contents survive a shutdown and can be collected afterwards.
A company publishes SPF and DKIM records, yet spoofed emails using its domain still reach customers. It wants receiving servers to reject messages that fail those checks and to send it reports about the failures. What should it publish?
Answer: A DMARC policy
DMARC tells receivers what to do with mail that fails SPF or DKIM alignment, such as quarantine or reject, and where to send reports. BIMI is tempting because it is also an email DNS record, but it only displays a brand logo and depends on DMARC already being enforced.
A hospital wants every device plugged into a wired switch port to authenticate through a RADIUS server before the port forwards any traffic other than authentication messages. Which technology provides this?
Answer: 802.1X port-based access control
802.1X keeps the switch port in an unauthorized state, passing only authentication traffic until an authentication server such as RADIUS verifies the device or user. MAC-based port security is tempting, but it only limits which MAC addresses may connect, and MAC addresses are easy to spoof.
A security team wants a tool on every laptop that records process and network activity, detects suspicious behaviour and lets analysts isolate the device remotely. Which solution fits BEST?
Answer: Endpoint detection and response (EDR)
EDR collects detailed endpoint telemetry, flags suspicious behaviour and supports remote response such as isolation. Traditional antivirus is the tempting choice, but it mainly matches known signatures and lacks the recording and response capabilities described.
Administrators create a fake administrator credential that no legitimate process ever uses, and they configure an alert on any attempt to sign in with it. What is this credential?
Answer: Honeytoken
A honeytoken is planted bait data, such as a fake credential or record, whose only purpose is to raise an alert when someone uses it. A honeypot is tempting, but it is a whole decoy system built to attract and observe attackers, not a single piece of bait data.
A penetration test finds that entering ' OR '1'='1 into a login form bypasses authentication. Which fix addresses the root cause in the application code?
Answer: Server-side input validation with parameterized queries
Validating input on the server and using parameterized queries stops user data from being interpreted as SQL, which removes the flaw itself. A WAF is the tempting choice and can block many attempts, but it is a protective layer in front of vulnerable code, not a fix inside it.
A new SIEM rule fires hundreds of times a day, and analysts confirm that nearly every alert is a scheduled backup job behaving normally. Real threats are being missed in the noise. What should the team do?
Answer: Tune the rule to exclude the known benign job
Alert tuning refines a rule, for example by excluding the verified backup job, so it stays useful while false positives drop. Deleting the rule or its source is tempting for quick relief, but it removes visibility of the real attacks the rule exists to catch.
Instead of giving engineers permanent administrator rights, a company grants elevated access only after an approved request, and the rights expire automatically after four hours. What is this approach called?
Answer: Just-in-time access
Just-in-time access grants privileges only when needed and removes them automatically, shrinking the window in which an account can be abused. Role-based access control is tempting, but roles grant standing permissions that remain until someone changes the assignment.
Employees sign in once to the company's identity provider and are then admitted to a cloud HR application, which receives a signed XML assertion describing the user. Which standard is in use?
Answer: SAML
SAML passes signed XML assertions from an identity provider to a service provider to deliver web single sign-on. OAuth is the tempting choice, but it is an authorization framework for delegating access to resources, not a format for signed XML identity assertions.
Which sign-in combination provides true multifactor authentication?
Answer: A password and a code from an authenticator app
A password is something you know and the authenticator app code proves something you have, so two different factor types are combined. Two biometrics are the tempting wrong answer: they are two methods, but both belong to the same factor, something you are.
A vulnerability scan flagged a critical flaw on a web server, and the server team reports that the patch is installed. What should the security team do next before closing the finding?
Answer: Rescan the server to verify the fix
Verification, usually a rescan, confirms the remediation actually worked before the finding is closed. Trusting the team's report is tempting, but patches sometimes fail, need a restart or miss a component, and only verification proves the exposure is gone.
Program management and oversight
Each laptop theft costs an organization $4,000 in hardware and response effort, and it expects about five thefts a year. What is the annualized loss expectancy (ALE)?
Answer: $20,000
ALE equals single loss expectancy times annualized rate of occurrence, so $4,000 times 5 gives $20,000 a year. $4,000 is only the single loss expectancy, and $800 comes from dividing instead of multiplying.
After assessing its ransomware risk, a company buys a cyber insurance policy that covers recovery costs. Which risk treatment is this?
Answer: Transference
Insurance shifts the financial impact of an incident to a third party, which is risk transference. Mitigation is tempting, but mitigation means adding controls that lower likelihood or impact, while insurance leaves the risk itself unchanged and only moves who pays.
A company installs a web application firewall and patches its servers, which lowers its estimated breach risk but does not eliminate it. What is the risk that remains called?
Answer: Residual risk
Residual risk is what is left after controls are applied, and leadership must decide whether it falls within the organization's risk appetite. Inherent risk is the tempting wrong answer, but it describes the level of risk before any controls are in place.
A company's contract with its managed hosting provider guarantees 99.95% monthly uptime and grants service credits whenever that target is missed. Which agreement type contains these terms?
Answer: Service-level agreement (SLA)
An SLA defines measurable service levels such as uptime, along with the remedies when they are missed. A statement of work is tempting because it is also a contract document, but it describes the specific tasks and deliverables of a project rather than ongoing service performance.
Before signing with a payroll processor, a company wants the contractual ability to inspect the vendor's security controls itself or through an assessor it chooses. Which clause should it negotiate?
Answer: Right-to-audit clause
A right-to-audit clause gives the customer contractual permission to examine a vendor's controls and records. Indemnification is tempting because it also protects the customer, but it only allocates who pays for losses and grants no access to verify controls.
A company hires a penetration tester and provides no network diagrams, credentials or source code, so the tester starts from the same position as an outside attacker. Which type of test is this?
Answer: Unknown environment
In an unknown environment test, also called black-box testing, the tester receives no inside information and must perform their own reconnaissance. Partially known is tempting, but in that test the tester is given some limited information, such as an IP range or a user account.
A retailer decides what customer data to collect and why, then hires a marketing firm to send emails using that data on the retailer's instructions. In privacy terms, what role does the marketing firm play?
Answer: Data processor
A processor handles personal data on behalf of, and according to the instructions of, the controller that decides the purposes and means of processing. Controller is the tempting wrong answer, but here that role belongs to the retailer, which made the decisions about the data.
Frequently asked questions
Are these Security+ practice questions free?
Yes. All 50 questions are free with no sign-up. CISNET instructors wrote them in their own words against CompTIA's published objectives for SY0-701 and SY0-801, and every answer comes with an explanation of why it is right and why the most tempting wrong option is not.
Should I practise for SY0-701 or SY0-801?
Practise for the exam you will book. CompTIA launches Security+ V8, exam SY0-801, on or around November 17, 2026, and SY0-701 can still be taken in English until June 11, 2027. Pick your exam in the version menu: SY0-801 adds AI threats such as prompt injection and data poisoning, and drops topics such as key stretching and blockchain.
What domains do the Security+ questions cover?
The bank covers all five Security+ domains in proportion to their exam weight: general security concepts, threats and vulnerabilities, security architecture, security operations, and security program management and oversight. Your results show a score for each domain so you can see where to study next.
Is this practice test like the real Security+ exam?
The question style matches the multiple-choice part of the exam, with scenario questions that ask for the BEST or FIRST action. SY0-701 allows 90 minutes for up to 90 questions, needs 750 on a 100 to 900 scale to pass, and adds performance-based questions, so pair this test with hands-on practice.
How should I use Security+ practice questions?
Take a 20-question set, read every explanation, including for questions you got right, and note your weakest domain. Study that domain against the official objectives, then take a new random set. Repeating this over several weeks builds the judgement the scenario questions test better than memorising answers.
Keep studying
Drill the exam vocabulary with the Security+ acronym trainer, check format, fees and dates in the Security+ certification guide, or follow the Security+ study guide. CISNET's live Security+ course covers every domain with an instructor and a lab environment.
Ready to Advance Your IT Career?
Get in touch to find the right certification path for your goals.
Get in Touch
