Security+ Practice Questions With Answers and Explanations (SY0-701)
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
These ten Security+ SY0-701 practice questions cover all five domains, two each, with the correct answer and an explanation for every option. These are original study questions written to the published exam objectives. CompTIA warns that unauthorized exam content can lead to certification revocation, so use legitimate materials. Try each question before you read the answer key: attempting a question before you check it is more effective than rereading notes. The real exam also has performance-based questions that these multiple-choice items do not cover, so treat this as a quick diagnostic and not a full mock exam. For a schedule, see our Security+ study plan, and for the topics behind each question see the objectives explained.
Domain 1: General Security Concepts (Questions 1 and 2)
Domain 1 is 12% of SY0-701 and covers controls, core concepts like the CIA triad and zero trust, change management and cryptography. Answer both before you look at the key.
Question 1. A security team creates a fake API key that no legitimate process uses and plants it in a code repository. Any attempt to use the key generates an alert. Which of the following deception technologies does this describe?
- A. Honeypot
- B. Honeynet
- C. Honeyfile
- D. Honeytoken
Question 2. A developer stores user passwords as hashes and adds a unique random value to each password before hashing. Which of the following attacks does this technique MOST directly defeat?
- A. Man-in-the-middle attacks
- B. Precomputed rainbow table attacks
- C. Offline brute force of a single hash
- D. Replay attacks
Domain 2: Threats, Vulnerabilities, and Mitigations (Questions 3 and 4)
Domain 2 is 22% of the exam. Expect questions that describe an attack in a sentence or two and ask you to name it or pick the best response.
Question 3. An attacker registers a domain that differs from a legitimate banking site by one transposed letter and waits for customers to mistype the address. Which of the following attacks is this?
- A. Watering hole
- B. Pretexting
- C. Typosquatting
- D. Smishing
Question 4. Which of the following BEST describes a password spraying attack?
- A. Trying every possible character combination against one account
- B. Trying a few common passwords against many accounts to avoid lockouts
- C. Using a precomputed table to reverse a captured hash
- D. Replaying a captured authentication token to log in
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Domain 3: Security Architecture (Questions 5 and 6)
Domain 3 is 18% of the exam and covers architecture models, infrastructure, data protection and resilience.
Question 5. Customer records are loaded into the memory of an application server while a report is generated. In which data state are the records at that moment?
- A. At rest
- B. In transit
- C. In archive
- D. In use
Question 6. A business unit states that it can tolerate losing no more than four hours of data after an outage. Which of the following metrics does this describe?
- A. Recovery point objective (RPO)
- B. Recovery time objective (RTO)
- C. Mean time to repair (MTTR)
- D. Mean time between failures (MTBF)
Domain 4: Security Operations (Questions 7 and 8)
Domain 4 is the largest domain at 28% of the exam, so the most points are decided here. It covers vulnerability management, identity and access management, automation and incident response.
Question 7. A vulnerability scanner flags a server as missing a patch for a specific CVE. The administrator confirms that the patch is installed and the vulnerable component is not present. How should this finding be classified?
- A. False positive
- B. False negative
- C. True positive
- D. True negative
Question 8. A calendar application needs limited access to a user email account without ever receiving the user password. Which of the following protocols is designed for this delegated authorization?
- A. LDAP
- B. RADIUS
- C. SAML
- D. OAuth
Domain 5: Security Program Management and Oversight (Questions 9 and 10)
Domain 5 is 20% of SY0-701 and covers governance, risk, third-party risk, compliance, audits and awareness. Keep a calculator habit for the quantitative risk formulas.
Question 9. A server is worth $80,000. Analysts estimate that a flood would destroy 40 percent of its value. What is the single loss expectancy (SLE) for this threat?
- A. $32,000
- B. $40,000
- C. $48,000
- D. $80,000
Question 10. A penetration tester is given network diagrams, source code, and administrator-level credentials before testing begins. Which type of test is this?
- A. Unknown environment
- B. Known environment
- C. Partially known environment
- D. Passive environment
Answer Key and Explanations
Check your answers here. Every option is explained, because on the real exam the wrong answers are usually things that are true in a different context.
Question 1: D. Honeytoken (objective 1.2)
A honeytoken is a fake credential or data element that alerts when used, which matches the planted API key.
- A. Honeypot. A honeypot is a decoy system, not a fake credential.
- B. Honeynet. A honeynet is a network of decoy systems, which is far larger than a single planted key.
- C. Honeyfile. A honeyfile is a decoy document that triggers an alert when opened, while this decoy is a credential.
Question 2: B. Precomputed rainbow table attacks (objective 1.4)
A unique salt makes each hash different, so a precomputed table of hashes no longer works.
- A. Man-in-the-middle attacks. Man-in-the-middle attacks target data in transit, which password salting does not address.
- C. Offline brute force of a single hash. A salt does not stop guessing against one known salted hash, since key stretching is what raises that cost.
- D. Replay attacks. Replay attacks reuse captured authentication traffic, which salting does not prevent.
Question 3: C. Typosquatting (objective 2.2)
Typosquatting registers misspelled variants of a real domain to catch users who mistype it.
- A. Watering hole. A watering hole compromises a site that the target group already visits, rather than relying on typing errors.
- B. Pretexting. Pretexting uses an invented scenario to manipulate a victim, not a lookalike domain.
- D. Smishing. Smishing delivers the lure through SMS messages.
Question 4: B. Trying a few common passwords against many accounts to avoid lockouts (objective 2.4)
Spraying tries a small set of common passwords across many accounts, staying under lockout thresholds.
- A. Trying every possible character combination against one account. Trying every combination against one account is a brute force attack.
- C. Using a precomputed table to reverse a captured hash. Using precomputed tables to reverse hashes is a rainbow table attack.
- D. Replaying a captured authentication token to log in. Replaying a captured token is a replay attack.
Question 5: D. In use (objective 3.3)
Right: data being actively processed in memory is in use.
- A. At rest. Wrong: at rest refers to data stored on persistent media.
- B. In transit. Wrong: in transit refers to data moving across a network.
- C. In archive. Wrong: archive is a storage category, not one of the three data states.
Question 6: A. Recovery point objective (RPO) (objective 3.4)
Right: RPO defines the maximum acceptable amount of data loss measured in time.
- B. Recovery time objective (RTO). Wrong: RTO defines how quickly service must be restored, not how much data can be lost.
- C. Mean time to repair (MTTR). Wrong: MTTR is the average time needed to repair a failed component.
- D. Mean time between failures (MTBF). Wrong: MTBF is the average time between failures, a reliability measure.
Question 7: A. False positive (objective 4.3)
The scanner reported a vulnerability that does not exist, which is a false positive.
- B. False negative. A false negative would be a real vulnerability that the scanner failed to report.
- C. True positive. A true positive would require the vulnerability to actually exist.
- D. True negative. A true negative means no alert was raised and none was warranted, which is not the case here.
Question 8: D. OAuth (objective 4.6)
OAuth issues limited-scope access tokens so apps can act on behalf of a user without the password.
- A. LDAP. LDAP is a directory access protocol and does not delegate scoped access to third-party apps.
- B. RADIUS. RADIUS provides network access authentication and accounting.
- C. SAML. SAML mainly exchanges authentication assertions for federated SSO rather than scoped API authorization.
Question 9: A. $32,000 (objective 5.2)
SLE equals asset value times exposure factor, so $80,000 x 0.40 = $32,000.
- B. $40,000. This subtracts a flat 40 rather than multiplying by the exposure factor.
- C. $48,000. This is the remaining value after the loss ($80,000 x 0.60), not the loss itself.
- D. $80,000. This is the full asset value, which would apply only to a 100 percent exposure factor.
Question 10: B. Known environment (objective 5.5)
A known environment test provides full knowledge of the target, as described.
- A. Unknown environment. An unknown environment test gives the tester little or no prior information.
- C. Partially known environment. A partially known test shares limited information, not complete diagrams, code, and admin access.
- D. Passive environment. Passive environment is not a standard penetration test classification.
What to Do With Your Score
Ten questions is a sample, not a prediction of your exam result. Use it to find where to spend your next study session.
8 to 10 correct: move to timed practice
Your fundamentals look solid. Switch to full-length timed practice exams and spend the extra time on the domain where you missed questions.
5 to 7 correct: study by domain
Pick the domains where you missed questions, read the matching objectives, then retry questions from those domains a few days later instead of the same day.
0 to 4 correct: build a base first
Start from the objectives list and learn each domain in order before doing more practice. Practice questions help most once you have seen the material once.
Review wrong answers by reason, not by answer
For each miss, write down why the correct option is right and why yours was wrong. The wrong options on this exam are usually correct statements about a different situation.
The bottom line
Ten questions will not predict your result, but they show you where to point your next study session. Keep practicing across all five domains, review every wrong answer by reason, and retry missed topics on different days. When you are ready for full-length timed practice, use a tool that tracks your performance by objective.
Frequently asked questions
Are these real Security+ exam questions?
No. These are original practice questions written to the published SY0-701 objectives. CompTIA does not release exam questions, and its objectives document warns that using unauthorized exam content, often called brain dumps, can lead to certification revocation.
How many questions are on the Security+ SY0-701 exam?
CompTIA lists a maximum of 90 questions in 90 minutes, a mix of multiple-choice and performance-based questions, with a passing score of 750 on a scale of 100 to 900.
Does the Security+ exam have performance-based questions?
Yes. CompTIA says the exam includes performance-based questions, which ask you to complete a task in a simulated environment, and that they usually appear at the start of the exam. These ten questions are multiple-choice only, so add performance-based practice separately.
What is the best way to use Security+ practice questions?
Attempt questions before you study a topic, review every wrong answer, and retry missed questions after a few days. A widely cited review of ten learning techniques (Dunlosky and colleagues, 2013) rated practice testing and spaced practice as high utility and rereading as low.
Are these questions relevant for SY0-801?
Most of the topics in these questions, such as threat actors, cryptography basics, vulnerability management, access control and risk calculations, appear in both versions. SY0-801 reorganizes some objectives and adds an AI threats objective, so check the objective lists for the version you plan to take.
How many practice questions should I do before the exam?
CompTIA does not publish a recommended number or a pass rate. A better target than a raw count is consistency: practice regularly across all five domains, track which objectives you miss, and keep retrying them until you answer correctly on different days.
Where can I get more Security+ practice questions?
DD Academy has Security+ SY0-701 flashcards and timed practice exams on iPhone and the web, free to start, with an AI tutor that explains why each option is right or wrong. You can also write your own questions from the CompTIA objectives list, which is itself a strong study method.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
