CompTIA SY0-701 Practice Exams
Last updated on Oct 22,2026- Exam Code: SY0-701
- Exam Name: CompTIA Security+
- Certification Provider: CompTIA
- Latest update: Oct 22,2026
The Cruel Information Security Officer (CISO) asks a security analyst to install an OS update to a production VM that has a 99% uptime SLA. The CISO tells me analyst the installation must be done as quickly as possible.
Which of the following courses of action should the security analyst take first?
- A . Log in to the server and perform a health check on the VM.
- B . Install the patch Immediately.
- C . Confirm that the backup service is running.
- D . Take a snapshot of the VM.
An employee fell for a phishing scam, which allowed an attacker to gain access to a company PC. The attacker scraped the PC’s memory to find other credentials. Without cracking these credentials, the attacker used them to move laterally through the corporate network.
Which of the following describes this type of attack?
- A . Privilege escalation
- B . Buffer overflow
- C . SQL injection
- D . Pass-the-hash
After a security incident, a systems administrator asks the company to buy a NAC platform.
Which of the following attack surfaces is the systems administrator trying to protect?
- A . Bluetooth
- B . Wired
- C . NFC
- D . SCADA
A security administrator needs a method to secure data in an environment that includes some form of checks so that the administrator can track any changes.
Which of the following should the administrator set up to achieve this goal?
- A . SPF
- B . GPO
- C . NAC
- D . FIM
A security operations center determines that the malicious activity detected on a server is normal.
Which of the following activities describes the act of ignoring detected activity in the future?
- A . Tuning
- B . Aggregating
- C . Quarantining
- D . Archiving
An administrator is Investigating an incident and discovers several users’ computers were Infected with malware after viewing files mat were shared with them. The administrator discovers no degraded performance in the infected machines and an examination of the log files does not show excessive failed logins.
Which of the following attacks Is most likely the cause of the malware?
- A . Malicious flash drive
- B . Remote access Trojan
- C . Brute-forced password
- D . Cryptojacking
A security analyst locates a potentially malicious video file on a server and needs to identify both the creation date and the file’s creator.
Which of the following actions would most likely give the security analyst the information required?
- A . Obtain the file’s SHA-256 hash.
- B . Use hexdump on the file’s contents.
- C . Check endpoint logs.
- D . Query the file’s metadata.
Various company stakeholders meet to discuss roles and responsibilities in the event of a security breach affecting offshore offices.
Which of the following is this an example of?
- A . Tabletop exercise
- B . Penetration test
- C . Geographic dispersion
- D . Incident response
A network administrator deployed a DNS logging tool that togs suspicious websites that are visited and then sends a daily report based on various weighted metrics.
Which of the following best describes the type of control the administrator put in place?
- A . Preventive
- B . Deterrent
- C . Corrective
- D . Detective
Which of the following is prevented by proper data sanitization?
- A . Hackers’ ability to obtain data from used hard drives
- B . Devices reaching end-of-life and losing support
- C . Disclosure of sensitive data through incorrect classification
- D . Incorrect inventory data leading to a laptop shortage