CompTIA SY0-701 Practice Exams
Last updated on Oct 01,2026- Exam Code: SY0-701
- Exam Name: CompTIA Security+
- Certification Provider: CompTIA
- Latest update: Oct 01,2026
A security administrator observed the following in a web server log while investigating an incident:
Which of the following attacks did the security administrator most likely see?
- A . Privilege escalation
- B . Credential replay
- C . Brute force
- D . Directory traversal
A security administrator recently reset local passwords and the following values were recorded in the system:
Which of the following in the security administrator most likely protecting against?
- A . Account sharing
- B . Weak password complexity
- C . Pass-the-hash attacks
- D . Password compromise
C
Explanation:
The scenario shows MD5 hashed password values. The most likely reason the security administrator is focusing on these values is to protect against pass-the-hash attacks. In this type of attack, an attacker can use a captured hash to authenticate without needing to know the actual plaintext password. By managing and monitoring these hashes, the administrator can implement strategies to mitigate this type of threat.
Reference =
CompTIA Security+ SY0-701 Course Content: Domain 04 Security Operations.
CompTIA Security+ SY0-601 Study Guide: Chapter on Identity and Access Management.
A systems administrator is creating a script that would save time and prevent human error when performing account creation for a large number of end users.
Which of the following would be a good use case for this task?
- A . Off-the-shelf software
- B . Orchestration
- C . Baseline
- D . Policy enforcement
B
Explanation:
Orchestration is the process of automating multiple tasks across different systems and applications. It can help save time and reduce human error by executing predefined workflows and scripts. In this case, the systems administrator can use orchestration to create accounts for a large number of end users without having to manually enter their information and assign permissions.
Reference: CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 457 1
Which of the following is the phase in the incident response process when a security analyst reviews roles and responsibilities?
- A . Preparation
- B . Recovery
- C . Lessons learned
- D . Analysis
A
Explanation:
Preparation is the phase in the incident response process when a security analyst reviews roles and responsibilities, as well as the policies and procedures for handling incidents. Preparation also involves gathering and maintaining the necessary tools, resources, and contacts for responding to incidents. Preparation can help a security analyst to be ready and proactive when an incident occurs, as well as to reduce the impact and duration of the incident.
Some of the activities that a security analyst performs during the preparation phase are:
Defining the roles and responsibilities of the incident response team members, such as the incident manager, the incident coordinator, the technical lead, the communications lead, and the legal advisor.
Establishing the incident response plan, which outlines the objectives, scope, authority, and procedures for responding to incidents, as well as the escalation and reporting mechanisms. Developing the incident response policy, which defines the types and categories of incidents, the severity levels, the notification and reporting requirements, and the roles and responsibilities of the stakeholders.
Creating the incident response playbook, which provides the step-by-step guidance and checklists for handling specific types of incidents, such as denial-of-service, ransomware, phishing, or data breach. Acquiring and testing the incident response tools, such as network and host-based scanners, malware analysis tools, forensic tools, backup and recovery tools, and communication and collaboration tools.
Identifying and securing the incident response resources, such as the incident response team, the incident response location, the evidence storage, and the external support.
Building and maintaining the incident response contacts, such as the internal and external stakeholders, the law enforcement agencies, the regulatory bodies, and the media.
Reference: CompTIA Security+ SY0-701 Certification Study Guide, Chapter 6: Architecture and Design, Section 6.4: Secure Systems Design, p. 279-280
CompTIA Security+ SY0-701 Certification Exam Objectives, Domain 3: Architecture and Design, Objective 3.5: Given a scenario, implement secure network architecture concepts, Sub-objective:
Incident response, p. 16
During a SQL update of a database, a temporary field used as part of the update sequence was modified by an attacker before the update completed in order to allow access to the system.
Which of the following best describes this type of vulnerability?
- A . Race condition
- B . Memory injection
- C . Malicious update
- D . Side loading
A
Explanation:
A race condition occurs when two or more processes attempt to access and modify a shared resource simultaneously, leading to unintended behavior. In this scenario, the attacker was able to modify a temporary field before the SQL update completed, indicating a time-of-check to time-of-use (TOCTOU) vulnerability, which is a type of race condition.
Memory injection (B) refers to inserting malicious code into a running process’s memory, but that is not what is happening here.
Malicious update (C) is too broad and does not specifically describe this scenario.
Side loading (D) is a technique where malicious software is loaded via a trusted application,
unrelated to this case.
Reference: CompTIA Security+ SY0-701 Official Study Guide, Threats, Vulnerabilities, and Mitigations domain.
A new employee logs in to the email system for the first time and notices a message from human
resources about onboarding. The employee hovers over a few of the links within the email and discovers that the links do not correspond to links associated with the company.
Which of the following attack vectors is most likely being used?
- A . Business email
- B . Social engineering
- C . Unsecured network
- D . Default credentials
B
Explanation:
The employee notices that the links in the email do not correspond to the company’s official URLs, indicating that this is likely a social engineering attack. Social engineering involves manipulating individuals into divulging confidential information or performing actions that may compromise security. Phishing emails, like the one described, often contain fraudulent links to trick the recipient into providing sensitive information or downloading malware.
Business email refers to business email compromise (BEC), which typically involves impersonating a
high-level executive to defraud the company.
Unsecured network is unrelated to the email content.
Default credentials do not apply here, as the issue is with suspicious links, not login credentials.
A newly identified network access vulnerability has been found in the OS of legacy loT devices.
Which of the following would best mitigate this vulnerability quickly?
- A . Insurance
- B . Patching
- C . Segmentation
- D . Replacement
C
Explanation:
Segmentation is a technique that divides a network into smaller subnetworks or segments, each with its own security policies and controls. Segmentation can help mitigate network access vulnerabilities in legacy loT devices by isolating them from other devices and systems, reducing their attack surface and limiting the potential impact of a breach. Segmentation can also improve network performance and efficiency by reducing congestion and traffic. Patching, insurance, and replacement are other possible strategies to deal with network access vulnerabilities, but they may not be feasible or effective in the short term. Patching may not be available or compatible for legacy loT devices, insurance may not cover the costs or damages of a cyberattack, and replacement may be expensive and time-consuming.
Reference: CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 142-143
A systems administrator receives an alert that a company’s internal file server is very slow and is only working intermittently.
The systems administrator reviews the server management software and finds the following information about the server:
Which of the following indicators most likely triggered this alert?
- A . Concurrent session usage
- B . Network saturation
- C . Account lockout
- D . Resource consumption
Company A jointly develops a product with Company B, which is located in a different country.
Company A finds out that their intellectual property is being shared with unauthorized companies.
Which of the following has been breached?
- A . SLA
- B . AUP
- C . SOW
- D . MOA
D
Explanation:
Detailed A Memorandum of Agreement (MOA) outlines terms of cooperation, including restrictions on sharing intellectual property. A breach indicates the terms of the agreement were violated, compromising confidentiality or usage terms.
Reference: CompTIA Security+ SY0-701 Study Guide, Domain 5: Security Program Management, Section: "Third-Party Risk Management".
Which of the following would be the greatest concern for a company that is aware of the consequences of non-compliance with government regulations?
- A . Right to be forgotten
- B . Sanctions
- C . External compliance reporting
- D . Attestation
B
Explanation:
Detailed
Sanctions imposed for non-compliance can include fines, legal actions, and loss of business licenses. These pose a significant financial and reputational risk to organizations.
Reference: CompTIA Security+ SY0-701 Study Guide, Domain 5: Security Program Management, Section: "Regulatory Compliance Risks".