CompTIA Security+ (SY0-701) practice questions

Question 1 · General Security Concepts

Nadia, a security analyst at Corvid Logistics, is reviewing a new warehouse sensor rollout. The project lead insists the sensors ship with telnet enabled "because the vendor supports it that way." Nadia objects, citing the principle that systems should start from the most restrictive configuration and only open what is required. Which concept is Nadia applying?

1. A.Availability-first design
2. B.Vendor risk transference
3. C.Compensating control selection
4. D.Secure baseline configuration

Question 2 · Threats, Vulnerabilities, and Mitigations

A finance clerk at Brackenford Mills receives an email that appears to come from the CFO, urgently requesting a wire transfer to a new supplier before a 3 p.m. deadline. The sending domain is brackenford-mills.co rather than the company's brackenfordmills.com. What type of attack is this?

1. A.Business email compromise using a lookalike domain
2. B.Watering hole attack on the supplier portal
3. C.Smishing against the finance department
4. D.Whaling against the CFO

Question 3 · Security Architecture

Larkspur Biotech wants internet-facing researchers to reach an internal analysis cluster. The architect places a reverse proxy in a screened subnet; external TLS terminates there, requests are inspected, and only the proxy may initiate connections inward. What is the screened subnet's primary security purpose?

1. A.To guarantee availability during denial-of-service attacks
2. B.To accelerate TLS handshakes for external users
3. C.To provide out-of-band management for the cluster
4. D.To provide a buffer zone so external traffic never reaches internal hosts directly

Question 4 · Security Operations

During an incident at Vexley Commerce, an analyst confirms an attacker is actively exfiltrating the customer database from a compromised application server. According to standard incident response practice, what should the team do NEXT?

1. A.Contain the system by isolating it from the network
2. B.Publish a breach notification to customers
3. C.Begin the lessons-learned review
4. D.Reimage the server immediately and restore from backup

Question 5 · Security Program Management and Oversight

Selwyn Optics is choosing between remediating, insuring against, or discontinuing a legacy customer portal after a risk assessment found exploitation would cost roughly $800,000. Leadership buys a cyber insurance policy covering that scenario instead of fixing or retiring the portal. Which risk response did they choose?

1. A.Acceptance
2. B.Transference
3. C.Mitigation
4. D.Avoidance

Question 6 · General Security Concepts

Halvern Credit Union is redesigning access so that every request — even from headquarters — is authenticated, authorized, and encrypted before reaching the loan database, with policy decisions made by a central engine and enforced at gateways. Which security model is being implemented?

1. A.Perimeter-based defense in depth
2. B.Zero trust architecture
3. C.Discretionary access control
4. D.Federated single sign-on

Question 7 · Threats, Vulnerabilities, and Mitigations

Threat hunters at Osprey Health notice that a workstation makes DNS requests for thousands of long, random-looking subdomains of one external domain, each returning small TXT records. Little other traffic leaves the host. What is the most likely explanation?

1. A.A misconfigured DNS resolver retrying lookups
2. B.An expired DNS cache being repopulated
3. C.Normal content-delivery-network behavior
4. D.Data exfiltration through DNS tunneling

Question 8 · Security Architecture

An architect at Coble Freight is comparing virtualization options for a multi-tenant analytics product. She notes that containers share the host kernel while virtual machines each run their own. What is the main security implication of that difference?

1. A.Containers cannot run untrusted code under any circumstances
2. B.A kernel-level escape affects all containers on the host, so isolation is weaker than between VMs
3. C.Containers require no patching because images are immutable
4. D.Virtual machines cannot be affected by hypervisor vulnerabilities