CompTIA Security+
How to Pass CompTIA Security+ SY0-701 on Your First Try
Security+ is the most widely held entry-level security certification in IT, and it's required for
many government and DoD positions. The SY0-701 exam has up to 90 questions, a 90-minute time limit,
and a passing score of 750 out of 900. Here's how to approach it — and 15 practice questions to test yourself.
Exam structure at a glance
| Domain | Weight |
|---|---|
| 1. General Security Concepts | 12% |
| 2. Threats, Vulnerabilities and Mitigations | 22% |
| 3. Security Architecture | 18% |
| 4. Security Operations | 28% |
| 5. Security Program Management and Oversight | 20% |
Where to focus: Domain 4 (Security Operations) is the largest at 28%. If you only have limited study time, prioritize Domains 2 and 4 — together they cover half the exam.
Study strategy that actually works
The biggest mistake candidates make is memorizing acronyms without understanding the underlying concepts. Security+ is scenario-based — the questions describe a situation and ask what you would do, not just what something is called.
- Start with Threats (Domain 2): Know every attack type cold — phishing, vishing, smishing, whaling, MitM, SQL injection, XSS, buffer overflow. These appear constantly.
- Learn frameworks: NIST, MITRE ATT&CK, incident response phases (Prepare, Identify, Contain, Eradicate, Recover, Lessons Learned). These appear in scenario questions.
- Understand cryptography concepts: Symmetric vs asymmetric, PKI, certificates, hashing (SHA vs MD5), and when to use each. Don't memorize key lengths — understand use cases.
- Practice elimination: On scenario questions, eliminate two obviously wrong answers first. The remaining two usually differ in one key word — that's where your knowledge needs to be precise.
15 free Security+ SY0-701 practice questions
Question 1
An attacker sends millions of requests to a web server from thousands of compromised machines, making the service unavailable. What type of attack is this?
✓ B is correct. A DDoS attack uses multiple compromised systems (a botnet) to flood a target. A DoS comes from a single source. MitM intercepts communication. A replay attack captures and re-sends legitimate data to trick systems.
Question 2
A web application allows user input to be included in a database query without sanitization, enabling an attacker to manipulate the query. What vulnerability is this?
✓ A is correct. SQL injection occurs when unsanitized user input is embedded in SQL queries, allowing attackers to read, modify, or delete data. XSS injects malicious scripts into web pages viewed by other users. Buffer overflow sends more data than a buffer can hold. Directory traversal accesses unauthorized file paths.
Question 3
An attacker exploits a software vulnerability that the vendor is unaware of and for which no patch exists. What is this called?
✓ C is correct. A zero-day vulnerability is unknown to the vendor, meaning there are zero days of protection. Once discovered and disclosed, it becomes a known vulnerability that vendors can patch. Zero-days are especially dangerous because defenders have no patch to deploy.
Question 4
A company wants to implement a security model where no user or system is trusted by default, even those inside the corporate network. What model is this?
✓ B is correct. Zero trust assumes no implicit trust — every request is verified regardless of network location. Defense in depth uses multiple layers of controls. Least privilege limits access to what's needed. Perimeter security trusts internal traffic, which zero trust explicitly rejects.
Question 5
Which encryption type uses the SAME key for both encryption and decryption, making key distribution a challenge?
✓ A is correct. Symmetric encryption (AES, DES) uses one key for both operations — fast, but requires secure key exchange. Asymmetric encryption (RSA, ECC) uses a key pair — slower but solves the key distribution problem. Hashing is one-way and doesn't encrypt. PKI is the infrastructure for managing asymmetric keys.
Question 6
A company stores sensitive data in the cloud but wants to maintain control of the encryption keys themselves. Which solution addresses this?
✓ C is correct. BYOK allows organizations to generate and manage their own encryption keys, even when data is stored in a third-party cloud. This ensures the cloud provider cannot decrypt the data. DLP prevents data exfiltration. CASB provides visibility into cloud usage. MFA secures authentication.
Question 7
During a security incident, which phase comes immediately after Identification (detecting the incident)?
✓ B is correct. NIST incident response phases: Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned. After identifying an incident, you contain it to prevent further damage before eradicating the threat. Recovery restores systems. Lessons Learned happens after everything is resolved.
Question 8
A security analyst receives an alert that a known malicious IP address is communicating with an internal host. The analyst checks logs and confirms the traffic. What should they do FIRST?
✓ C is correct. Containment is the immediate priority — isolating the host stops the attacker's access and prevents lateral movement or further data exfiltration. Reimaging is eradication, which comes after containment. Law enforcement notification may come later. Password changes are useful but not the first priority.
Question 9
Which tool collects and correlates log data from multiple sources across the organization to identify suspicious patterns?
✓ C is correct. A SIEM aggregates, correlates, and analyzes log data from across the environment (firewalls, endpoints, servers) to detect threats. An IDS detects intrusions on a network segment. DLP prevents sensitive data from leaving the organization. A WAF protects web applications from common attacks.
Question 10
A user's account shows logins from two countries simultaneously, 10 minutes apart. Which type of analysis detected this anomaly?
✓ B is correct. Behavioral (anomaly-based) detection establishes a baseline of normal activity and flags deviations — like impossible travel between two countries. Signature-based detection matches known patterns. Heuristic analysis looks for suspicious characteristics without exact signatures. Static code analysis reviews source code for vulnerabilities.
Question 11
A company transfers risk by purchasing cyber liability insurance. Which risk response strategy is this?
✓ C is correct. Risk transference shifts financial impact to a third party (insurance). Risk avoidance eliminates the activity causing the risk. Risk mitigation reduces the likelihood or impact through controls. Risk acceptance acknowledges the risk and does nothing — often when the cost of mitigation exceeds the potential loss.
Question 12
Which regulation requires organizations that handle EU citizens' personal data to implement data protection by design and report breaches within 72 hours?
✓ C is correct. GDPR (General Data Protection Regulation) covers EU citizens' personal data, requires breach notification within 72 hours, and mandates privacy by design. HIPAA covers US healthcare data. PCI DSS covers payment card data. SOX covers financial reporting requirements for public companies.
Question 13
What is the purpose of a penetration test?
✓ C is correct. A penetration test (pentest) actively attempts to exploit vulnerabilities — simulating what a real attacker would do — to discover actual risk exposure. Monitoring traffic is the role of IDS/SIEM. CVE scanning is vulnerability scanning, not pentesting. Policy reviews are security audits.
Question 14
Which access control model assigns permissions based on the user's role within the organization rather than their individual identity?
✓ B is correct. RBAC assigns permissions to roles (Admin, User, Manager), and users inherit permissions based on their assigned role. DAC lets data owners set permissions. MAC uses security labels and clearance levels (common in government). ABAC uses multiple attributes (role, location, time) to make decisions.
Question 15
A hash function is used to verify file integrity. Which property ensures that two different inputs cannot produce the same hash output?
✓ B/C is correct. Collision resistance means it's computationally infeasible for two different inputs to produce the same hash — crucial for integrity verification. MD5 is considered broken due to known collisions. SHA-256 and SHA-3 are collision resistant. Non-repudiation means you can't deny an action was performed (achieved with digital signatures, not hashing alone).
Ready for the full Security+ question bank?
aprencert has 270 Security+ questions with explanations on every answer — free to start.
Start practicing free →Top tips for exam day
- Read every option before answering. Security+ loves "most appropriate" questions where multiple answers are partially correct.
- Watch for "FIRST" and "BEST". These indicate priority — containment before eradication, identification before notification.
- Scenario questions = incident response order. When in doubt, think: contain → eradicate → recover.
- Know the difference between authentication and authorization. Authentication = who you are. Authorization = what you can do.
- Don't overthink cryptography. You need to know use cases, not implementation details. AES = symmetric bulk encryption. RSA = asymmetric key exchange. SHA = hashing.
Practice all 270 Security+ questions at aprencert.com — free to try, no credit card needed.