Security+ SY0-701 Practice Questions 2026
How to use these Security+ practice questions
Security+ SY0-701 practice questions are most useful when they are treated as a learning tool, not a score-only exercise. The goal is to train the candidate to recognize the clue in the question, choose the best control or response, and explain why the other answers are weaker.
If the candidate wants the official exam landing page, start here: Security+ SY0-701 exam page. For the full topic review, use the study guide: Security+ SY0-701 Study Guide 2026. For the live question set, use the free practice CTA: Try 35 free Security+ SY0-701 practice questions. For the vendor source, review the official CompTIA page: CompTIA Security+ official page.
These questions are written in an exam-style format that reflects the kinds of decisions Security+ asks about. They are not actual exam questions, and they are not meant to reproduce protected content. They are meant to help the candidate think the right way under test conditions.
Official exam facts
| Detail | Info |
|---|---|
| Exam code | SY0-701 |
| Certification | Security+ |
| Vendor | CompTIA |
| Time limit | 90 minutes |
| Passing score | 70% |
| Official source | CompTIA Security+ official page |
| Cert-Pass exam page | Security+ SY0-701 exam page |
| Study support | Security+ SY0-701 Study Guide 2026 |
| Retirement date | Not announced |
Question 1
A company notices that several employees clicked a link in an email that looked like an invoice from a trusted vendor. The security team wants the best immediate control to reduce the chance of account compromise if a password has already been stolen.
What is the best control?
- A. Increase the length of the password requirement only
- B. Enable multifactor authentication
- C. Disable all email attachments
- D. Replace the firewall
Correct answer: B. Enable multifactor authentication
Why this is correct: MFA reduces the usefulness of a stolen password and is one of the strongest immediate account-protection controls.
Why the other answers are weaker:
- A helps, but it does not stop a stolen password from being used.
- C is too broad and does not address the actual account-compromise risk.
- D is unrelated to the specific issue.
Question 2
A security analyst sees repeated failed logins from many different IP addresses against the same user account. The logins use common passwords and small batches of attempts rather than one rapid burst.
Which attack is most likely?
- A. Password spraying
- B. Brute force
- C. Man in the middle
- D. Tailgating
Correct answer: A. Password spraying
Why this is correct: Password spraying uses a small number of common passwords across many accounts or attempts in a way that avoids lockout thresholds.
Why the other answers are weaker:
- B usually means trying many passwords against one account.
- C is about intercepting traffic.
- D is a physical social engineering tactic.
Question 3
A help desk technician wants to make sure a user can sign in to the company VPN only from a known laptop and not from a personal device.
Which control best supports this requirement?
- A. Device posture or device trust check
- B. Full disk encryption
- C. Backup rotation
- D. Port mirroring
Correct answer: A. Device posture or device trust check
Why this is correct: Device trust or posture validation helps verify that the device itself meets the company requirement before access is granted.
Why the other answers are weaker:
- B protects stored data but does not enforce device trust.
- C is about recovery, not access control.
- D is a monitoring technique, not an access control.
Question 4
A company wants to reduce the risk that one compromised server will allow an attacker to move freely across the entire environment.
What is the best architectural control?
- A. Segmentation
- B. Baiting
- C. Shoulder surfing awareness training
- D. Password reuse
Correct answer: A. Segmentation
Why this is correct: Segmentation limits lateral movement and reduces blast radius.
Why the other answers are weaker:
- B is a social engineering attack, not a control.
- C helps with physical observation risk, not server movement.
- D is a weakness, not a control.
Question 5
A security team needs to preserve evidence after a suspected insider incident. The team is concerned that the evidence might be challenged later.
Which concept is most important?
- A. Chain of custody
- B. Least privilege
- C. Data masking
- D. Patch management
Correct answer: A. Chain of custody
Why this is correct: Chain of custody documents who handled evidence and when, which is critical for integrity and admissibility.
Why the other answers are weaker:
- B is important for access, but not for evidence handling.
- C protects sensitive data, but it is not the central forensics concept here.
- D is a maintenance control, not an evidence control.
Question 6
A server was compromised by malware, but the security team has already isolated it from the network. The next step should focus on removing the malicious presence before the server is returned to service.
What phase is this?
- A. Containment
- B. Eradication
- C. Recovery
- D. Acceptance
Correct answer: B. Eradication
Why this is correct: Containment has already happened. The next phase is eradication, which removes the threat from the system.
Why the other answers are weaker:
- A already occurred.
- C happens after the threat is removed.
- D is a risk treatment, not an incident phase.
Question 7
A company wants a policy that describes the required encryption method for laptops, the approved backup schedule, and the minimum access controls for sensitive data.
Which type of document is this most likely?
- A. Guideline
- B. Policy
- C. Recommendation email
- D. Ticket note
Correct answer: B. Policy
Why this is correct: Policy sets mandatory organizational direction and requirements.
Why the other answers are weaker:
- A is flexible advice.
- C is informal and not authoritative.
- D is operational documentation, not a governance document.
Question 8
A security analyst sees a device connecting to a known malicious command and control domain. The device is already on the internal network.
What is the best first response?
- A. Ignore it until the monthly report
- B. Contain the device
- C. Replace the router
- D. Reimage the entire network immediately
Correct answer: B. Contain the device
Why this is correct: Containment reduces damage and prevents spread while the incident is investigated.
Why the other answers are weaker:
- A delays response and increases risk.
- C does not address the infected device.
- D is too broad and not the best first step.
Question 9
Which control is designed primarily to detect suspicious activity rather than stop it directly?
- A. SIEM monitoring
- B. Network segmentation
- C. Multifactor authentication
- D. Application allowlisting
Correct answer: A. SIEM monitoring
Why this is correct: SIEM platforms correlate logs and help detect suspicious behavior.
Why the other answers are weaker:
- B helps prevent spread.
- C prevents unauthorized access.
- D helps stop unauthorized execution.
Question 10
A company wants to reduce the risk that a worker will approve a fake request from a person pretending to be from finance.
Which measure is most effective as part of a long-term defense?
- A. Security awareness training
- B. More monitors on the desk
- C. Changing the laptop wallpaper
- D. Disabling all printers
Correct answer: A. Security awareness training
Why this is correct: Awareness training helps employees recognize social engineering and report suspicious requests.
Why the other answers are weaker:
- B, C, and D do not directly reduce social engineering risk.
Question 11
A company wants to make sure users only have the access required for their roles and nothing extra.
What principle is being applied?
- A. Need to know
- B. Least privilege
- C. Redundancy
- D. Denial of service
Correct answer: B. Least privilege
Why this is correct: Least privilege gives users only the access they need.
Why the other answers are weaker:
- A is related but narrower and often used for information access.
- C is a resilience concept.
- D is an attack, not a principle.
Question 12
A user reports that the company email system blocked a message that contained a suspicious link and a fake invoice attachment. The attacker was trying to trick the user into sending payment information to the wrong account.
What attack type best fits this description?
- A. Phishing
- B. Buffer overflow
- C. Port scanning
- D. Mantrap bypass
Correct answer: A. Phishing
Why this is correct: The attacker used deceptive email to manipulate the user.
Why the other answers are weaker:
- B is a memory corruption issue.
- C is reconnaissance.
- D is a physical security issue.
Question 13
An organization is deciding whether to keep an older system that has known risk because the replacement would be expensive and slow to deploy.
Which risk treatment is the company considering if it chooses not to change anything right now?
- A. Risk acceptance
- B. Risk avoidance
- C. Risk transfer
- D. Risk elimination by patching only
Correct answer: A. Risk acceptance
Why this is correct: The company is consciously deciding to live with the risk for now.
Why the other answers are weaker:
- B means removing the risky activity.
- C means shifting the burden elsewhere.
- D is not a standard risk treatment label.
Question 14
A server has a known vulnerability, but the team cannot patch it immediately because of a production freeze. They decide to place the server behind a stricter firewall rule and increase monitoring until the patch window opens.
What is this approach?
- A. Risk mitigation with a compensating control
- B. Risk avoidance
- C. Risk transfer
- D. Data destruction
Correct answer: A. Risk mitigation with a compensating control
Why this is correct: The team is reducing the risk using an alternate control while waiting for the real fix.
Why the other answers are weaker:
- B would mean removing the risky system or activity.
- C would shift the risk to someone else.
- D is unrelated.
Question 15
A company wants to prevent users from reaching dangerous websites and also wants to stop some malware from running if it is downloaded. The security team is choosing among several options.
Which answer is most appropriate if the goal is to limit execution of untrusted software?
- A. Application allowlisting
- B. DNS logging only
- C. More chair inspections
- D. Backup rotation
Correct answer: A. Application allowlisting
Why this is correct: Allowlisting restricts execution to approved software.
Why the other answers are weaker:
- B helps detection, not execution control.
- C is physical and unrelated.
- D is recovery, not prevention.
Question 16
A candidate is asked which control is most useful for improving password security when a user keeps choosing weak passwords.
- A. Password complexity policy plus MFA
- B. More bandwidth
- C. Disk defragmentation
- D. Printer firmware upgrade
Correct answer: A. Password complexity policy plus MFA
Why this is correct: Weak password choice is best reduced by stronger policy and a second factor.
Why the other answers are weaker:
- B, C, and D do not solve the problem.
Question 17
A company has been hit by several ransomware attempts. Management wants to reduce the impact of a successful attack and restore critical systems quickly.
What should the security team emphasize?
- A. Verified backups and restore testing
- B. More office decorations
- C. Larger desks for the help desk
- D. Removing all network cables permanently
Correct answer: A. Verified backups and restore testing
Why this is correct: Backups are only useful if they can be restored. Testing matters.
Why the other answers are weaker:
- B and C are irrelevant.
- D is not a practical business response.
Question 18
A security architect wants to design a network so that a public web server does not expose the internal database directly.
What is the best design choice?
- A. Separate network zones with controlled access between them
- B. Use the same flat network for everything
- C. Disable all authentication
- D. Allow unrestricted inbound traffic
Correct answer: A. Separate network zones with controlled access between them
Why this is correct: Segmented zones help protect internal systems from direct exposure.
Why the other answers are weaker:
- B increases risk.
- C removes an essential control.
- D is unsafe by design.
Question 19
A manager asks for the best way to reduce the risk of a contractor handling sensitive data incorrectly.
Which approach is most appropriate?
- A. Vendor agreement, access limits, and data handling rules
- B. A brighter monitor
- C. A stronger coffee machine
- D. A bigger inbox
Correct answer: A. Vendor agreement, access limits, and data handling rules
Why this is correct: Third-party risk is managed through clear terms, access boundaries, and handling requirements.
Why the other answers are weaker:
- B, C, and D do not control risk.
Question 20
A candidate wants to know the best way to use these practice questions during the final week before the exam.
What is the most effective approach?
- A. Review every wrong answer and classify why it was wrong
- B. Only look at the score and move on
- C. Memorize one answer letter pattern
- D. Skip all review and hope for the best
Correct answer: A. Review every wrong answer and classify why it was wrong
Why this is correct: Review turns practice into improvement.
Why the other answers are weaker:
- B misses the learning value.
- C is unreliable and does not build understanding.
- D wastes the practice session.
Common answer patterns to watch
Security+ questions often repeat the same logic in different scenarios. If a candidate learns these patterns, the questions become much easier:
- MFA is often the best response to password theft risk.
- Segmentation is often the best response to lateral movement risk.
- Logging and monitoring are often the best response to detection questions.
- Policy or training is often the best response to repeated human behavior problems.
- Backups and restore testing are often the best response to ransomware resilience questions.
- Least privilege is often the best response to overaccess problems.
- Containment first is often the best response to confirmed incidents.
How to study from mistakes instead of around them
When a candidate misses a question, the answer explanation should be used as a learning map. Ask three follow-up questions:
- What did the question really want me to identify?
- Which clue in the wording should have pointed me to the right answer?
- What is the simplest rule I can remember next time?
That process is far more effective than simply reading the correct answer once.
Final review checklist
Before the exam, the candidate should be able to do the following without hesitation:
- explain the difference between prevention and detection
- identify phishing, password spraying, ransomware, and social engineering tactics
- choose a sensible control for account compromise, lateral movement, and recovery
- understand risk treatment choices
- know when a question is about policy, process, or technology
- use practice question explanations to improve weak areas
