Free CompTIA Security+ Exam Questions and Answers
Updated October 13, 2026 | 20 questions with full answers
The short answer
Security+ SY0-701 is a 90-question, 90-minute exam and you need 750 out of 900 to pass. The questions below are real ones from our 540-question SY0-701 bank, printed in full with the correct answer and the reasoning, so you can see exactly how CompTIA words a scenario and what separates the right answer from the plausible one.
SY0-701 exam facts
| Questions | Up to 90 (multiple choice + performance-based) |
| Time limit | 90 minutes |
| Passing score | 750 / 900 (scaled) |
| Cost | $425 USD (voucher) |
| Delivery | Pearson VUE test centre or OnVUE online proctored |
| Prerequisites | None, but CompTIA recommends Network+ and 2 years of IT security experience |
What the exam covers, domain by domain
| Domain | Weight | What it tests |
|---|---|---|
| 1.0 General Security Concepts | 12% | CIA triad, security controls, cryptography basics, authentication and authorisation. |
| 2.0 Threats, Vulnerabilities and Mitigations | 22% | Threat actors, attack types, social engineering, malware, vulnerability scanning. |
| 3.0 Security Architecture | 18% | Network and cloud architecture, secure design, zero trust, data protection. |
| 4.0 Security Operations | 28% | Monitoring, incident response, forensics, IAM, automation. The heaviest domain. |
| 5.0 Security Program Management and Oversight | 20% | Risk management, frameworks, policies, compliance and audits. |
20 free SY0-701 exam questions with answers
Real questions from our 540-question SY0-701 bank, spread across every domain. The correct answer is marked and every question carries an explanation, so you can check the reasoning and not just the result. The interactive mocks serve the full bank, timed and scaled-scored.
During a security assessment, an analyst discovers that internal workstations can directly access the internet without any content filtering. Management wants to implement a solution that can inspect all outbound web traffic, enforce acceptable use policies, and cache frequently accessed content. Which firewall architecture would BEST meet these requirements?
- ○ Stateless packet filter
- ○ Stateful inspection firewall
- ✓ Proxy firewall
- ○ Next-generation firewall (NGFW)
Which of the following BEST describes the function of a digital signature?
- ○ Encrypts the message to ensure confidentiality
- ✓ Provides authentication and non-repudiation for a message
- ○ Hashes the public key and attaches it to prevent tampering
- ○ Generates a symmetric key for bulk data encryption
An analyst notices unusual PowerShell scripts running in memory without creating files on disk. Which technology would be MOST effective at detecting this type of fileless malware?
- ○ Traditional antivirus (EPP)
- ○ Network-based intrusion prevention system (NIPS)
- ✓ Endpoint Detection and Response (EDR)
- ○ Web application firewall (WAF)
During a business impact analysis, a company determines that a critical application has an asset value of $500,000 and would experience a 40% loss in functionality during an outage. What is the Single Loss Expectancy (SLE) for this application?
- ✓ $200,000
- ○ $500,000
- ○ $300,000
- ○ $250,000
Ransomware encrypts files using a symmetric encryption key, which is then encrypted with an asymmetric public key and sent to a command and control server. What is the PRIMARY reason for this hybrid approach?
- ○ To enable faster encryption of large files
- ○ To allow multiple victims to use the same decryption key
- ✓ To securely exchange the decryption key only with the attacker
- ○ To bypass signature-based antivirus detection
An IDS (Intrusion Detection System) differs from an IPS (Intrusion Prevention System) in that an IDS:
- ○ Is deployed inline and can block malicious traffic automatically
- ✓ Only monitors and alerts without taking action to block traffic
- ○ Uses signature updates quarterly, while IPS uses real-time updates
- ○ Can only detect known malware, while IPS uses behavior analysis
A security team needs to verify that a downloaded software package has not been modified during transmission. Which cryptographic technique provides the BEST assurance of integrity?
- ○ Encrypting the package with AES-256
- ✓ Using RSA to sign the package hash
- ○ Implementing Diffie-Hellman for key exchange
- ○ Applying 3DES encryption to the package
An organization wants to enhance their endpoint security beyond traditional antivirus. Which TWO capabilities distinguish EDR from basic EPP solutions? (Choose TWO)
- ✓ Real-time behavioral monitoring
- ○ Signature-based malware detection
- ✓ Forensic data collection and analysis
- ○ Automated threat containment
- ○ File signature updates
A multinational corporation with operations in the European Union experiences a data breach affecting EU citizens' personal data. Which TWO actions are required under GDPR? (Choose TWO)
- ✓ Notify supervisory authorities within 72 hours
- ○ Conduct a full forensic investigation before any notification
- ✓ Inform affected data subjects without undue delay
- ○ Wait for law enforcement investigation to complete
- ○ Only notify if financial data was compromised
A security team is implementing defenses against wiper malware attacks. Which TWO controls would be MOST effective? (Choose TWO)
- ✓ Application allowlisting
- ✓ Regular immutable backups
- ○ Network intrusion detection systems
- ○ Data execution prevention
- ○ Email content filtering
A financial services company is experiencing repeated SQL injection attacks against their online banking application. Their current stateful firewall allows legitimate HTTP/S traffic but cannot inspect the application payload. Which security control should be deployed at the network perimeter to BEST address this specific threat?
- ○ Unified Threat Management (UTM) appliance
- ✓ Web Application Firewall (WAF)
- ○ Intrusion Detection System (IDS)
- ○ Proxy firewall with content filtering
An organization's risk assessment calculates that a security control reducing breach likelihood from 20% to 5% annually would prevent losses of $100,000. What is the Annualized Rate of Occurrence (ARO) reduction achieved by this control?
- ✓ 0.15
- ○ 15%
- ○ $15,000
- ○ 5%
A security team calculates that a database server valued at $50,000 would experience 40% damage if compromised. Historical data shows this occurs twice per year. What is the Annualized Loss Expectancy (ALE)?
- ○ $20,000
- ✓ $40,000
- ○ $50,000
- ○ $100,000
A federal agency is implementing security controls for their information systems and needs to select a comprehensive control framework that provides detailed security and privacy controls. Which framework provides the most comprehensive set of controls for federal information systems?
- ○ NIST CSF
- ✓ NIST SP 800-53
- ○ ISO/IEC 27002
- ○ SOC 2 Trust Services Criteria
A zero-day vulnerability is one that:
- ○ Has been patched within zero days of discovery
- ✓ Is known to the vendor but no patch is available yet
- ○ Was discovered by automated scanning tools
- ○ Only exists in software older than one year
Which resiliency design principle specifies that a system should continue to operate correctly even if one component fails?
- ○ Defense in depth
- ○ Fail secure
- ○ High availability
- ✓ Redundancy
A company is upgrading its cryptographic standards and needs to replace deprecated hashing algorithms. Which TWO algorithms should be considered ACCEPTABLE for new implementations according to current security best practices? (Choose TWO)
- ✓ SHA-3
- ✓ SHA-256
- ○ MD5
- ○ SHA-1
- ○ RIPEMD-160
During a forensic investigation of a compromised web server, the incident response team needs to collect the most volatile data first to prevent loss of critical evidence. Which component should be collected IMMEDIATELY according to the order of volatility?
- ○ Hard drive contents
- ✓ System memory (RAM)
- ○ Network configuration files
- ○ Operating system logs
An organization purchases cybersecurity insurance to cover potential losses from data breaches. What risk treatment strategy are they implementing?
- ○ Risk acceptance
- ○ Risk mitigation
- ✓ Risk transfer
- ○ Risk avoidance
An attacker discovers that a web application's search functionality reflects user input directly in the URL parameters and executes JavaScript code in victims' browsers. What type of XSS is this?
- ○ Stored XSS
- ✓ Reflected XSS
- ○ DOM-based XSS
- ○ Blind XSS
How to use these questions
The single biggest reason people fail SY0-701 is pacing, not knowledge. Ninety questions in ninety minutes leaves one minute per question - and the PBQs at the front are worth far more than one minute. Skip them, bank the multiple-choice marks, then come back.
Read every question twice and look for the qualifying word. CompTIA scenarios almost always contain a constraint - MOST likely, BEST, LEAST cost - and one option that is technically true but ignores that constraint. The constraint is the question.
Domain 4 (Security Operations) is 28% of the exam, so it deserves roughly a third of your study time. Most candidates over-study threats and under-study operations.
Track which domain each question you get wrong came from. If your errors cluster in one domain, that is your study plan - not a general review of everything.
Frequently asked questions
How many questions are on the Security+ SY0-701 exam?
Up to 90 questions in 90 minutes, including multiple-choice and performance-based questions (PBQs). PBQs are drag-and-drop and simulated-console tasks and usually appear at the start of the exam.
What score do you need to pass Security+?
750 out of a possible 900 on a scaled score. Scaled scoring means the raw number of correct answers needed varies slightly by exam version; roughly 75-80% correct is a safe target.
Are these Security+ questions the same as the real exam?
No. These are original practice questions written to the SY0-701 objectives, not leaked or recalled exam content. They cover the same domains at the same weights so the practice is representative.
Is Security+ harder than Network+?
Security+ is generally considered harder because Domain 4 (Security Operations) requires judgement across incident response and monitoring, whereas Network+ is more mechanical. Both need 90 questions in 90 minutes.
Ready to test yourself under exam conditions?
540 questions across 9 timed mock exams, domain-wise drills, and the same scaled scoring as the real thing. Free, no signup.