CompTIA Security+ practice test
CompTIA Security+ Practice Test (SY0-701)
Twenty-five original practice questions, weighted the same way the real exam is weighted, with a full explanation for every answer, including why the tempting wrong option is wrong. Two performance-based question (PBQ) walkthroughs. No signup, no email, no paywall.
How this test is weighted (and why that matters)
Most free practice tests give you a random pile of questions. The real exam does not work like that. SY0-701 draws from five domains with fixed weightings, and Security Operations alone is more than a quarter of your exam:
| Domain | Weight | Questions in a max-90 exam | Questions in this 25-question test |
|---|---|---|---|
| 1.0 General Security Concepts | 12% | ~11 | 3 |
| 2.0 Threats, Vulnerabilities, and Mitigations | 22% | ~20 | 6 |
| 3.0 Security Architecture | 18% | ~16 | 4 |
| 4.0 Security Operations | 28% | ~25 | 7 |
| 5.0 Security Program Management and Oversight | 20% | ~18 | 5 |
Two practical consequences most candidates miss:
- You cannot pass by being brilliant at cryptography and vague about security operations. Domain 4 is 28% of the exam. Domain 1, the conceptual material everyone starts with and enjoys, is only 12%.
- Score yourself per domain, not overall. A 78% overall that hides a 50% in Domain 4 is a fail waiting to happen. Track five numbers, not one. The "Check my score" button below does this for you.
How to use this practice test
- Do it closed-book, timed. Give yourself 25 minutes for the 25 questions (the real exam is a maximum of 90 questions in 90 minutes, so roughly a minute each). If you cannot answer under time pressure, you cannot answer.
- Choose your answer before you reveal. The single most common self-deception in exam prep is reading the explanation, thinking "yes, obviously", and marking yourself correct. Select an option first, then open the explanation.
- Read the explanation even when you got it right. Half the value here is in the distractor analysis: knowing why the plausible wrong answer is wrong is what protects you when the real exam asks the same concept from the other direction.
- Score per domain. Then go and restudy the weakest domain, not the whole syllabus.
What score means you are ready
Be careful with the number you have probably read elsewhere. The SY0-701 passing score is 750 on a scale of 100 to 900. It is a scaled score, not a percentage. You cannot convert it to "83% of questions correct"; anyone telling you that has misunderstood how the exam is scored, and the raw number of questions you need right is not published. So use a practical heuristic instead of false precision:
- Under 70% on fresh questions: not ready. You are still learning the material, not testing it.
- 70% to 80%: borderline. Keep studying; you are relying on luck for the judgement questions.
- Consistently 85% or higher on questions you have never seen before, with no single domain under 75%: that is the point at which most well-prepared candidates sit the exam.
- The word "fresh" is load-bearing. Scoring 95% on a question bank you have already been through twice tells you about your memory, not your readiness.
Domain 1: General Security Concepts (12%)
A finance application from a vendor that has gone out of business cannot support multi-factor authentication, and the security policy mandates MFA for all systems handling payment data. The application cannot be replaced this financial year. The security team isolates the application on its own VLAN, restricts access to four named accounts, and requires those users to authenticate with MFA to a jump server before they can reach it. Which type of control have they implemented?
Show answer and explanation
Correct answer: B. Compensating.
A compensating control is what you deploy when the required control cannot be implemented and you need an alternative that achieves an acceptable level of protection. That is exactly what has happened here: MFA on the application itself is impossible, so isolation, restricted accounts, and MFA on the jump server stand in for it.
A. Corrective is the trap. Corrective controls act after an incident to fix or limit damage (restoring from backup, removing malware, applying a patch after exploitation). Nothing here is responding to an incident; the team is pre-emptively substituting for a control they cannot deploy. The problem being fixed is a control gap, not an incident.
C. Detective controls identify that something has happened (log review, IDS, video surveillance). The VLAN and jump server prevent access; they do not detect it.
D. Directive controls tell people what to do: a policy, a standard, an acceptable use agreement. The policy that mandates MFA is directive; the workaround is not.
In a Zero Trust architecture, a user's device requests access to a database. The request is evaluated against policy, a decision is made, and the decision is then applied at the boundary of the resource so the session is either allowed or blocked. Which component applies the decision in the data plane?
Show answer and explanation
Correct answer: C. Policy Enforcement Point.
In CompTIA's Zero Trust model, the control plane makes decisions and the data plane carries them out. The Policy Enforcement Point (PEP) sits in the data plane and is the component that actually allows, denies, or terminates the session at the resource boundary.
A. Policy Engine is the trap. The Policy Engine makes the decision, but it lives in the control plane, and the question specifically asks what applies it in the data plane. This is a classic move: give you the component you were thinking of, then add a qualifier in the stem that rules it out. Read qualifiers first.
B. Policy Administrator communicates the Policy Engine's decision and establishes or shuts down the connection. It is the messenger between control plane and data plane, not the enforcement boundary.
D. Policy Decision Point is a real term in Zero Trust literature generally, but in the SY0-701 objectives the control-plane pairing is Policy Engine plus Policy Administrator, with the PEP in the data plane. Learn CompTIA's vocabulary, because CompTIA marks CompTIA's vocabulary.
A supplier disputes having submitted an electronic invoice, claiming their account was misused. The finance system needs to be able to prove, to a third party, that the invoice originated from the supplier and could not have originated from anyone else. Which cryptographic mechanism provides this?
Show answer and explanation
Correct answer: B. Digital signature.
Non-repudiation requires that only one party could have produced the artefact. A digital signature is created with the sender's private key, which only the sender holds, and verified with their public key, so a third party can prove origin and the sender cannot credibly deny it.
A. HMAC is the trap. An HMAC does provide integrity and authentication of origin, which is why it feels right. But it uses a shared secret key: both parties hold it, so either party could have produced the HMAC. It proves the message came from someone holding the key; it cannot prove which one. No non-repudiation.
C. Symmetric encryption with a shared key has the same defect, plus it provides confidentiality rather than proof of origin.
D. Key stretching (bcrypt, PBKDF2, Argon2) makes weak passwords expensive to brute-force. It has nothing to do with proving who sent something.
Trap pattern in play: classify the question by security goal first. This one is non-repudiation, so anything built on a shared secret is eliminated immediately.
Domain 2: Threats, Vulnerabilities, and Mitigations (22%)
A SIEM raises an alert: an account authenticated successfully from Melbourne at 09:14 and successfully from Warsaw at 09:41 the same morning. Which indicator of malicious activity does this describe?
Show answer and explanation
Correct answer: B. Impossible travel.
Two successful authentications from locations that could not be physically traversed in the elapsed time. The strong implication is credential compromise, or less excitingly a VPN, which is why this is an indicator rather than a verdict.
A. Concurrent session usage is the trap. Two sessions do exist, so this feels correct. But concurrent session usage describes the same account being used in multiple sessions at once, regardless of where from. The distinguishing signal here is the geography and the time gap, and CompTIA has a specific term for exactly that. When two answers both partly describe the facts, pick the one that explains the most specific fact in the stem.
C. Out-of-cycle logging is log activity at an unusual time, for example a batch job writing at 3am when it only ever runs at 6pm. Not what is described.
D. Account lockout is a failed-authentication indicator. Both of these logins succeeded.
An attacker registers mindsetcbyer.com.au and stands up a login page that mirrors a company's supplier portal, waiting for staff to fat-finger the address. Which threat vector is this?
Show answer and explanation
Correct answer: B. Typosquatting.
Registering a domain that is a plausible misspelling of a legitimate one, and waiting for the mistake. When it is combined with a lookalike login page it is often also called brand impersonation, but the vector here is the domain typo.
A. Watering hole attack is the trap. Both attacks work by waiting for the victim to come to the attacker, which is why this one catches people. The difference: a watering hole compromises a legitimate site the target group already visits. Typosquatting creates a new, attacker-owned domain that resembles the real one. No legitimate site is compromised here.
C. Business email compromise requires an email account (usually an executive's) being compromised or spoofed to instruct a fraudulent action. There is no email in the stem.
D. Pretexting is inventing a scenario to manipulate a person directly, for example "I'm from IT, I need your MFA code". This attack involves no direct interaction at all.
A backup script checks that a file is owned by a privileged service account, and then, a few milliseconds later, opens the file and writes to it. An attacker replaces the file with a symbolic link to a system configuration file in the gap between the check and the write. Which vulnerability class is being exploited?
Show answer and explanation
Correct answer: C. Race condition (TOC/TOU).
Time-of-check to time-of-use. The state the program validated is no longer the state it acts on, because an attacker changed it in the window between the two operations. The tell in the stem is always the gap in time between a check and an action.
D. Directory traversal is the trap. A symlink is involved, and the outcome is that the script writes somewhere it should not, so "traversal" feels close. But directory traversal is an attacker supplying path input (../../etc/passwd) to escape an intended directory. Here the script's own logic is sound; the flaw is that its validation and its action are not atomic. Ask "what did the developer get wrong?" and the answer is sequencing, not input handling.
A. Buffer overflow requires writing beyond an allocated memory boundary. No memory boundary is crossed.
B. Memory injection involves inserting code into a running process's memory space. Not described.
An organisation's public DNS server is receiving a flood of small, spoofed queries. The responses, far larger than the queries, are all being sent to a single victim IP address that does not belong to the organisation. Which attack is the organisation's server being used in?
Show answer and explanation
Correct answer: A. Reflected and amplified DDoS.
Two signals, both explicitly in the stem: reflection (spoofed source address, so responses go to the victim, not the requester) and amplification (responses much larger than the requests). The organisation's DNS server is not the target; it is the unwitting weapon.
C. DNS poisoning is the trap. It involves DNS, and it is the DNS attack most candidates can name, so it gets picked reflexively. But poisoning means corrupting the records in a resolver's cache so users are sent to the wrong address. Nothing in this stem alters a record; the records are being served correctly, just to the wrong recipient in enormous volume. If the impact is availability, it is not poisoning.
B. On-path attack requires the attacker to sit between two communicating parties and intercept or alter traffic. The attacker here never sees the responses, which is the entire point of reflection.
D. Credential replay is capturing and re-sending authentication material. No credentials involved.
Without any approval or IT involvement, a marketing team signs up for a cloud file-sharing service, connects it to the corporate identity provider, and begins storing customer contact lists in it. Which threat actor category best describes the marketing team?
Show answer and explanation
Correct answer: B. Shadow IT.
CompTIA lists Shadow IT as a threat actor category in its own right: internal people deploying technology outside sanctioned processes, creating risk without malicious intent. The stem is almost a verbatim restatement of that definition.
A. Insider threat is the trap. They are insiders, and they are creating risk, so this looks like a clean fit. But the SY0-701 objectives list both as separate threat actors, and Shadow IT is the more precise answer because it names the unsanctioned technology itself. Insider threat is the broader category of an internal person causing an incident, intentional or unintentional (CompTIA counts negligent insiders too). When two categories overlap, the exam wants the more specific one.
C. Unskilled attacker ("script kiddie") uses tools built by others to attack a target. The marketing team is not attacking anyone.
D. Hacktivist is motivated by political or philosophical belief. Nothing of the kind here.
A ransomware incident spread from one compromised workstation to eleven servers because the initial account was a member of a group with local administrator rights across the estate, and the flat internal network allowed SMB between every host. Which TWO mitigation techniques would most directly limit lateral movement in a repeat incident? (Select two.)
Show answer and explanation
Correct answer: A. Segmentation and B. Least privilege.
The stem names two enabling conditions and asks you to close them. Segmentation attacks the flat network (the ransomware could reach every host over SMB). Least privilege attacks the over-permissioned account (it had admin everywhere). Each mitigation maps to one named failure in the stem, and that mapping is how multi-select questions are usually built.
C. Encryption of data at rest is the trap. It is a genuinely good control and it sounds relevant because ransomware is about data. But it does nothing here: the ransomware is executing with a legitimate administrator's rights, so the data is decrypted for it exactly as it would be for the real admin. Encryption at rest defends against theft of the storage medium, not against an authorised process on a running host.
D. Log aggregation improves your ability to see the movement. It does not limit it. The qualifier in the stem is "most directly limit", and detection controls are not limitation controls.
Format note: multi-select questions on the real exam tell you exactly how many to pick, and they are scored all-or-nothing. Two right out of three still scores zero. Never leave a required selection blank.
Domain 3: Security Architecture (18%)
A hospital deploys a network security appliance in line with traffic to its clinical systems. During the design review, the team must decide what happens to traffic if the appliance itself crashes. Patient-monitoring systems must remain reachable during a device failure. Which failure mode should the appliance be configured with, and what is the trade-off?
Show answer and explanation
Correct answer: B. Fail-open; traffic passes uninspected, so availability is preserved but traffic is uninspected during the outage.
Fail-open means that when the device fails, traffic continues to flow without inspection. Given a hard requirement that patient-monitoring systems stay reachable, availability wins, and the security team must accept, document, and compensate for an inspection gap during the outage (typically with a high-availability pair so it never happens).
A. Fail-closed is the trap. It is the security-instinct answer, and it correctly describes what fail-closed does. It is wrong because the stem gives you a business requirement, patient monitoring must remain reachable, and the question asks what you should configure. This is a favourite structure: a technically true option that ignores the constraint in the scenario. Always answer the scenario, not the reflex.
C and D simply invert the definitions. If you know what the two terms mean, they are free eliminations, which is exactly why CompTIA includes them: they let you lose the mark on definitional confusion alone.
A retailer must let its analytics team work with customer records in a development environment. The analysts need data with the same format and referential behaviour as production (so joins and validation still work), but the real card numbers must not exist anywhere in that environment, and there must be a way for the payment system to map the substituted values back to the originals. Which technique fits?
Show answer and explanation
Correct answer: B. Tokenization.
Tokenization substitutes a sensitive value with a format-preserving token, and the mapping back to the original is held in a separate, protected token vault. That gives the analysts usable, correctly-shaped data, keeps card numbers out of dev, and preserves reversibility for the authorised system, which is the requirement that decides this question.
A. Data masking is the trap. Masking also replaces or obscures real values with realistic-looking ones (4111 **** **** 1234) and is genuinely used for exactly this scenario, so it is a defensible answer right up until the last clause of the stem. Masking is generally not reversible; that is its point. The requirement "map the substituted values back to the originals" is the qualifier that eliminates it. Read the whole stem before you commit.
C. Hashing is one-way by design and destroys format. You cannot get the card number back, and the output is not a card-shaped value.
D. Steganography hides data inside other data (an image, an audio file). Irrelevant here.
A security team wants to add an IDS that inspects a copy of network traffic for indicators of compromise. Under no circumstances may the device's presence add latency to production traffic or cause an outage if it fails. Which deployment satisfies this?
Show answer and explanation
Correct answer: C. Tap/monitor, passive.
A tap (or SPAN/mirror port) receives a copy of traffic. The device is not in the forwarding path, so it cannot add latency and cannot break the path when it dies. Passive means it observes rather than modifying or blocking. That is a textbook IDS deployment.
A. Inline, active is the trap. This is how you deploy an IPS, and candidates blur IDS and IPS constantly, which is precisely the pairing CompTIA is testing. An inline active device can block, which sounds better, and it is better in many scenarios. It is wrong here because the stem forbids latency and forbids the device breaking traffic when it fails, and an inline device does both by definition. "Better control" is not the same as "the control the scenario asks for".
B. Inline, passive still puts the device in the traffic path, so it can still fail the path; it just cannot do anything useful when traffic arrives.
D. Tap/monitor, active is close to a contradiction: on a mirrored copy, there is nothing to act on. You cannot block a packet that has already been forwarded.
An organisation's business impact analysis sets a four-hour RTO for its order-processing system. Budget is constrained, so a fully-mirrored, always-on standby facility has been rejected. The chosen alternative is a facility with hardware, network, and power in place, but with data and applications restored from the most recent backup at failover time. Which type of recovery site is this?
Show answer and explanation
Correct answer: B. Warm site.
A warm site has the infrastructure standing and ready, but not live data. You restore and cut over, which takes hours, not minutes. That fits a four-hour RTO and a rejected budget for full mirroring.
A. Hot site is the trap. It is the answer that guarantees the RTO, so it is attractive. But the stem explicitly rules it out: "a fully-mirrored, always-on standby facility has been rejected" is the definition of a hot site. When a stem rules something out in a clause you skimmed past, you will pick it. Slow down on the constraints sentence.
C. Cold site is space, power, and cooling only. You are procuring and racking hardware; four hours is not achievable.
D. Geographic dispersion is a property of where you place sites (far enough apart that one disaster cannot take both), not a type of site. Right vocabulary, wrong category, a very common distractor shape.
Domain 4: Security Operations (28%)
A SIEM rule generates 400 alerts a day for a legitimate vulnerability scanner's weekly sweep. Analysts have started closing all alerts from that rule without reading them, and a genuine port scan from an external host was missed last month. Which activity most directly addresses the root problem?
Show answer and explanation
Correct answer: A. Alert tuning.
The problem is a high false-positive rate producing alert fatigue, and the missed detection is the consequence. Alert tuning (refining rule logic, thresholds, and exclusions, for example suppressing the known scanner's source IP on its known schedule while keeping the rule live for everything else) is the named activity for this in the objectives.
D. Quarantine is the trap. It is a real alert-response action and it sounds decisive. But quarantine is what you do to a confirmed malicious asset or file. Quarantining the internal vulnerability scanner would break the vulnerability management programme. Note the qualifier: "most directly addresses the root problem", and the root problem is rule quality, not any single alert.
B. Log aggregation gets more data into the SIEM. More data into a badly-tuned rule generates more noise, not less.
C. Archiving is retention of old log data. It does nothing to the alerting rule.
A contractor plugs a laptop into a wall port in a meeting room. Before the port is allowed to carry any traffic beyond authentication, the switch requires the device to present credentials to a RADIUS server; unauthenticated devices are placed on a guest VLAN with internet access only. Which standard enforces this network access control?
Show answer and explanation
Correct answer: A. 802.1X.
This is network access control (NAC) enforced at the switch port. 802.1X is port-based NAC: the supplicant (laptop) authenticates via EAP to the authenticator (switch), which relays to the authentication server (RADIUS). It works identically on wired ports and on enterprise wireless.
B. WPA3 is the trap. WPA3-Enterprise also uses 802.1X and RADIUS, so if you have only ever met 802.1X in a Wi-Fi context this feels right. But WPA3 is a wireless security standard, and the stem says "plugs a laptop into a wall port". A single word in the stem, "plugs", is doing all the elimination work.
C. SAML federates identity for web applications (browser-based SSO). It does not authenticate a switch port.
D. 802.11ax (Wi-Fi 6) is a wireless transmission standard, not a security or access-control mechanism at all. Similar-looking number, entirely different job.
A company has published SPF and DKIM records. Attackers are still successfully spoofing its domain, because receiving mail servers are choosing to deliver the failing messages to inboxes rather than reject them, and the company has no visibility of who is spoofing it. Which control should be added?
Show answer and explanation
Correct answer: A. DMARC.
DMARC is the layer that tells receiving servers what policy to apply when SPF/DKIM alignment fails (none, quarantine, reject), and provides reporting back to the domain owner. The two gaps in the stem, receivers deciding for themselves and no visibility, are exactly the two things DMARC exists to fix.
B. A stricter SPF record with -all is the trap. This is the answer a technically-minded candidate reaches for, and it is not useless: -all is a hard fail. But SPF only expresses "this server was not authorised"; the receiver still decides what to do with that, and SPF gives you no reporting whatsoever. It moves one of the two problems slightly and the other not at all. DMARC addresses both, which is why it is the best answer, not merely a valid one.
C. A second DKIM selector is key-management housekeeping. It changes nothing about receiver behaviour.
D. A secure email gateway protects mail coming in to your organisation. The stem is about your domain being spoofed to other people. Right technology, wrong direction of traffic.
Database administrators currently hold standing sa-equivalent accounts. The organisation wants those privileges to exist only while a change ticket is open, to be issued for the specific window of that change, and to expire automatically afterwards, with the underlying password never known to the DBA. Which capability delivers this?
Show answer and explanation
Correct answer: B. Just-in-time permissions with password vaulting and ephemeral credentials.
This is the privileged access management (PAM) toolset, and every clause in the stem maps to one of its features: privileges only while a ticket is open (just-in-time), password never known to the DBA (vaulting or brokering), expires automatically (ephemeral credentials).
D. Attribute-based access control is the trap. ABAC can evaluate attributes including time, and time-of-day restrictions are a real access-control concept, so it looks like it could do this. But ABAC is a model for deciding whether an identity may access a resource; it does not eliminate the standing privileged credential, does not vault the password, and does not issue and expire credentials. The stem's requirements are about the lifecycle of a privileged credential, which is PAM's territory, not an access-control model's.
A. Federation allows identities from one domain to be trusted in another. Unrelated.
C. Attestation is the periodic review and sign-off that an entitlement is still appropriate. It is how you find the standing sa accounts. It is not how you remove them.
Ransomware is actively encrypting files on three file servers. The malware's persistence mechanism has not yet been identified, and forensic imaging has not started. Which action comes next in the incident response process?
Show answer and explanation
Correct answer: B. Containment: isolate the affected servers from the network.
CompTIA's incident response process is preparation, then detection, then analysis, then containment, then eradication, then recovery, then lessons learned. Containment comes first because the damage is ongoing; you stop the bleeding before you operate.
A. Eradication is the trap. It is the satisfying answer, kill the malware. It is wrong for two reasons the stem hands you: the encryption is still spreading (so isolation is urgent), and the persistence mechanism has not been identified (so you would eradicate the part you can see and leave the part you cannot, and it would come straight back). "First" and "next" questions are almost always testing process order, and the answer is almost always the less exciting step.
C. Recovery before eradication restores clean files into a still-compromised environment, where they get encrypted again.
D. Lessons learned happens after the incident is closed. Doing it now would be a striking act of optimism.
An analyst images a compromised laptop's drive. The organisation's lawyers expect the matter to end up in court. Which forensic practice specifically ensures the image will be admissible by proving who handled the evidence, when, and what they did with it?
Show answer and explanation
Correct answer: B. Chain of custody.
Chain of custody is the documented, unbroken record of everyone who has handled the evidence, when they took possession, and what was done with it. It is what defeats a defence argument that the evidence could have been altered.
A. Legal hold is the trap. It is genuinely part of the same workflow, and it does concern litigation, which is why it draws picks. But a legal hold is an instruction to preserve; it stops routine deletion of potentially relevant data. It says nothing about who handled what. The stem asks specifically about "who handled the evidence, when, and what they did with it", and only one term answers that.
C. E-discovery is the process of identifying and producing electronically stored information for legal proceedings. It is the broader process, not the handling record.
D. Preservation is the objective (keep the evidence unaltered). Chain of custody is the documented mechanism that demonstrates you achieved it.
A development team must identify vulnerabilities such as SQL injection and unsafe deserialisation in a web application before it is deployed, by examining the source code itself without running it. Which technique is this?
Show answer and explanation
Correct answer: A. Static code analysis.
Static analysis inspects source code (or compiled bytecode) without executing it. The stem's "without running it" is a direct definitional match.
B. Dynamic analysis (fuzzing) is the trap. It finds many of the same vulnerability classes, and it is often the better tool for injection flaws in practice, so people who know the material well can talk themselves into it. It requires the application to be running so inputs can be thrown at it. The stem forbids execution. Knowing more than the exam requires is only a problem if you stop reading the constraints.
C. Package monitoring watches third-party dependencies for known vulnerabilities. It would not find a SQL injection flaw in code the team wrote themselves.
D. Penetration testing is performed against a deployed, running system. Again ruled out by "before it is deployed".
Domain 5: Security Program Management and Oversight (20%)
A logistics company values its warehouse management system at $500,000. A ransomware event is assessed as destroying 40% of that value, and is expected to occur once every four years. What is the annualised loss expectancy (ALE)?
Show answer and explanation
Correct answer: A. $50,000.
Single Loss Expectancy (SLE) equals asset value times exposure factor: $500,000 times 0.40 equals $200,000. Annualised Rate of Occurrence (ARO) is once every four years, so 0.25. ALE equals SLE times ARO: $200,000 times 0.25 equals $50,000.
B. $200,000 is the trap, and the most-picked wrong answer on this style of question. It is the SLE, a real, correctly-calculated number from the stem, just not the one asked for. CompTIA reliably plants the intermediate value in the option list. Before you compute, underline what is actually being asked for; after you compute, check that the number you produced answers that term.
C. $125,000 comes from dividing the asset value by four (ignoring the exposure factor entirely).
D. $800,000 comes from multiplying by four instead of by 0.25 (inverting the ARO). If the event is rarer than annual, the ALE must be smaller than the SLE. A sanity check on direction catches this one in three seconds.
After an outage, an executive asks two questions: "How long can we be down before the business is materially harmed?" and "How much data can we afford to lose?" Which two metrics is she asking for, in order?
Show answer and explanation
Correct answer: B. RTO, then RPO.
RTO (Recovery Time Objective) is the maximum tolerable downtime: "how long can we be down". RPO (Recovery Point Objective) is the maximum tolerable data loss, expressed as time: "how much data can we afford to lose". An RPO of four hours means backups or replication must be no more than four hours apart.
C. RPO, then RTO is the trap. Both metrics are correct, and the only error is the order. This is a deliberate, cheap trick and it works constantly, because candidates recognise the pair, feel confident, and stop reading. When an option list contains the same items in different orders, the order is the question.
A. MTTR (mean time to repair) and MTBF (mean time between failures) are reliability metrics describing how a component behaves. They are inputs to planning, not statements of business tolerance.
D correctly identifies RTO but then substitutes a reliability metric for the data-loss metric.
Two organisations agree, in a legally binding document, on the overall terms that will govern all future work between them (payment terms, liability, IP, confidentiality), with the specific deliverables, timelines, and acceptance criteria for each individual project to be documented separately as work is commissioned. Which agreement type is the overarching document?
Show answer and explanation
Correct answer: C. MSA.
An MSA (Master Service Agreement) sets the umbrella legal terms once, so that each subsequent engagement can be commissioned quickly under a short document that references it. See the agreement-acronym table below for the full set.
B. SOW is the trap. The Statement of Work is the "specific deliverables, timelines, and acceptance criteria" document the stem describes being written separately, per project. The stem hands you the SOW's definition and then asks you for the other document. Half-reading the stem produces this answer reliably.
A. MOU (Memorandum of Understanding) records mutual intent and is typically not legally binding. The stem says "legally binding", which eliminates it on the spot.
D. SLA (Service Level Agreement) defines measurable service commitments: uptime, response times, penalties. It is about performance levels, not overarching commercial terms.
A cloud provider handles a regulated dataset for a bank. During contract negotiation, the bank's risk team insists on a clause allowing the bank (or its appointed assessor) to inspect the provider's controls directly during the life of the contract. Which vendor management mechanism is this?
Show answer and explanation
Correct answer: A. Right-to-audit clause.
A right-to-audit clause is a contractual right for the customer to examine the supplier's controls. The defining feature is that the customer gets the right, and it is written into the agreement.
B. Independent third-party audit is the trap. It is the more common way the assurance need actually gets met (the provider hands you a SOC 2 or an ISO 27001 certificate produced by an external auditor). It is wrong here because the stem says the bank or its appointed assessor inspects, which is the bank exercising a right, not the bank reading someone else's report. The option describing what usually happens is not the option describing what the stem says happens.
C. Due diligence is the pre-contract investigation of a vendor. The stem is about a right that persists during the life of the contract.
D. Rules of engagement define scope, timing, and constraints for a penetration test. Related territory, different document.
A legacy industrial controller cannot be patched against a published vulnerability without voiding its safety certification. The business accepts the residual risk, documents it, records the rationale and an owner, sets a review date, and formally records that this system is not required to meet the patching standard. Which risk management outcome is this?
Show answer and explanation
Correct answer: C. Risk acceptance with an exemption.
The organisation is keeping the risk knowingly (acceptance), and formally relieving this system of a standing requirement (an exemption, a documented, ongoing carve-out from a policy or standard, as distinct from a one-off, time-bound exception).
D. Risk mitigation is the trap. It attracts picks because the organisation is clearly doing things (documenting, assigning an owner, setting reviews), and doing things feels like mitigating. But none of those actions reduce the likelihood or the impact of the vulnerability being exploited. They are governance around an accepted risk. Mitigation would be patching, compensating controls, or segmentation. Documentation is not a control.
A. Risk avoidance means ceasing the activity, decommissioning the controller. The business is doing the opposite.
B. Risk transference means shifting the financial consequence to someone else, typically via insurance or a contract. Not described.
Score yourself per domain
Answer the questions above, then check your result. This scores each domain separately, because a strong overall number can hide a weak domain that will fail you on exam day. Your selections are saved in this browser only.
Performance-based questions (PBQs): what they actually are
PBQs are the part candidates fear, and the part almost nobody explains properly. CompTIA defines them as items "designed to test a candidate's ability to solve problems in real-world settings", delivered as either simulations or virtual environments.
| Simulation | Virtual environment | |
|---|---|---|
| What it is | An approximation of a tool or environment: a firewall UI, a network diagram, a terminal, an OS | A real VM running actual software |
| Wrong paths | Restricted; the simulation only lets you do certain things | Anything is possible, including making a real mess |
| Reset button | Yes, resets that question only | No |
| Skip and return? | Yes. Your work is saved | No. You get a warning screen, then you must finish it there and then |
| Scoring | Multiple valid solution paths accepted; partial credit may be given | Same |
Three consequences that change how you sit the exam:
- PBQs are the only place partial credit exists. Multiple-choice is all-or-nothing (including multi-select). So a half-finished PBQ is worth something; a half-finished multi-select is worth nothing.
- If a PBQ is skippable, skip it and come back. Do not burn 15 minutes of a 90-minute exam on question 2. Bank the multiple-choice marks, which are fast, then return with whatever time remains. Your work is saved.
- There are multiple correct solution paths. You are not trying to guess the one arrangement the item writer had in mind; you are trying to produce a configuration that satisfies the stated requirements.
What CompTIA publishes about what PBQs simulate is not a mystery: the exam objectives list Kali Linux, packet-capture tools, a SIEM, a vulnerability scanner, network emulators, MDM, hardware tokens, and sample logs and network diagrams. Practise reading a log excerpt, reading a network diagram, and ordering firewall rules, and you have covered most of the surface area.
PBQ walkthrough 1: firewall rule ordering
Scenario. You are given an empty firewall rule table and five rules to place. The requirements:
- Web servers in the DMZ (
10.10.20.0/24) must be reachable from the internet on TCP 443 only. - The internal LAN (
10.10.10.0/24) may browse the internet on TCP 80 and 443. - All internal subnets (
10.10.0.0/16) may reach the internal database server (10.10.30.15) on TCP 1433, except the contractors' subnet (10.10.50.0/24), which must never reach it. - Anything not explicitly permitted must be denied and logged.
| Rule | Source | Destination | Port | Action |
|---|---|---|---|---|
| W | 10.10.50.0/24 | 10.10.30.15 | 1433 | Deny |
| X | Any | 10.10.20.0/24 | 443 | Allow |
| Y | 10.10.10.0/24 | Any | 80, 443 | Allow |
| Z | 10.10.0.0/16 | 10.10.30.15 | 1433 | Allow |
| V | Any | Any | Any | Deny (log) |
Show worked solution
Worked solution, one valid order: W, X, Y, Z, V.
The reasoning that gets the marks:
- Firewalls evaluate top-down and stop at the first match. Every ordering question is really a question about which rule would be shadowed by a rule above it.
- The specific deny (W) must sit above the broad allow it overrides (Z). Rule Z permits all of
10.10.0.0/16to reach the database, and the contractor subnet10.10.50.0/24falls inside that range. If Z is evaluated before W, contractors match Z and reach the database, silently breaking the "never" requirement, and the rule table still looks correct. That is the load-bearing lesson: a specific deny must precede the broader allow it needs to override. - X and Y are both Allow rules, so their relative order does not change behaviour. Even where they overlap (a LAN host reaching the DMZ on 443 matches both X and Y), the action is identical, so it makes no difference which is evaluated first. This is why PBQs accept multiple valid solution paths: do not agonise over a choice that has no security effect.
- V (deny any/any, logged) must be last. An implicit deny usually exists anyway, but the requirement says denied traffic must be logged, and an implicit deny typically logs nothing. Placing V anywhere but last shadows every rule beneath it and breaks the entire ruleset.
The two errors that cost people this question: putting the any/any deny too high (nothing works), and putting the specific deny below the broad allow it is meant to override (the thing you were told to prevent is quietly allowed). The two real constraints are: W before Z, and V last. Check both, every time, before you submit.
PBQ walkthrough 2: match the log evidence to the attack
Scenario. Four log excerpts. Drag the correct attack type onto each. Attack types available: password spraying, SQL injection, on-path (ARP poisoning), data exfiltration over DNS, privilege escalation. (Note: five options, four excerpts, so one is a decoy. PBQs do this.)
Excerpt 1: authentication log
09:01:02 FAIL user=a.chen src=203.0.113.44
09:01:03 FAIL user=b.okafor src=203.0.113.44
09:01:04 FAIL user=c.rossi src=203.0.113.44
09:01:05 FAIL user=d.nguyen src=203.0.113.44
... (612 distinct usernames, 1 failure each)
09:14:41 SUCCESS user=r.patel src=203.0.113.44Show answer
Password spraying.
The signature is one attempt per account across many accounts, deliberately staying under the lockout threshold. The give-away is not the volume, it is the shape: 612 usernames, one failure each. Brute force is the mirror image, many passwords against one account, which trips lockout fast. The account-lockout counters here would never fire, which is exactly the point of the technique, and exactly why it is invisible to a lockout-based detection.
Excerpt 2: DNS query log
14:22:01 qtype=TXT name=a8f3d91e2c.exfil.attacker-cdn.net
14:22:02 qtype=TXT name=b1c07e44af.exfil.attacker-cdn.net
14:22:03 qtype=TXT name=9d2be6710c.exfil.attacker-cdn.net
[1,847 more queries, same domain, all unique 10-char subdomains, one per second]Show answer
Data exfiltration over DNS.
Three signals together: TXT record queries (a channel that can carry arbitrary data), high-entropy unique subdomains (that is the encoded payload), and an even, machine-like cadence to a single external domain. Humans and normal applications do not generate 1,850 unique random-looking subdomains at one per second. DNS is allowed out of almost every network, which is why attackers use it as a covert channel.
Excerpt 3: web server log
GET /products?id=14%20OR%201%3D1-- 200 8842
GET /products?id=14%20UNION%20SELECT%20null%2Cusername%2Cpassword%20FROM%20users-- 200 41221Show answer
SQL injection.
URL-decode it: id=14 OR 1=1-- and id=14 UNION SELECT null,username,password FROM users--. A classic tautology, then a UNION-based extraction. The tell that it worked: the response code is 200 and the response size jumps from 8,842 to 41,221 bytes, so the application returned far more data on the UNION request than on a normal product lookup. Always read the status code and the response size, not just the payload. A 500 would suggest a failed attempt; a 200 with a bloated body suggests a successful one, and that changes your incident severity.
Excerpt 4: endpoint and switch log
10:44:12 ARP reply: 10.10.10.1 is-at 00:1B:44:11:3A:B7
10:44:12 ARP reply: 10.10.10.1 is-at 6C:2F:09:D4:81:E0
10:44:13 MAC flap detected: 10.10.10.1 moved port Gi1/0/4 -> Gi1/0/22Show answer
On-path (ARP poisoning).
One IP address, the default gateway 10.10.10.1, is claimed by two different MAC addresses within the same second, and the switch logs the gateway's address flapping between two ports. That is the signature of ARP cache poisoning: the attacker sends forged ARP replies binding the gateway's IP to the attacker's MAC, so hosts send their upstream traffic to the attacker instead of the router. Once the attacker sits between the hosts and the gateway, they can read, alter, or relay the traffic, which is why CompTIA files ARP poisoning under on-path attacks. The tell is always one IP mapping to two MACs, plus the MAC flap; a healthy network almost never does this. The decoy, privilege escalation, leaves a different trace: a low-privileged account suddenly performing admin actions, not Layer 2 address confusion.
The agreement acronyms candidates keep confusing
Question 23 above is one of a family. MOU, MOA, MSA, SOW, BPA, SLA, and NDA are a top-three source of lost marks in Domain 5, because the exam tests whether you can tell nearly-identical documents apart. Learn a one-sentence discriminator for each:
| Acronym | Full name | One-line discriminator |
|---|---|---|
| MSA | Master Service Agreement | Sets the umbrella legal terms once (payment, liability, IP, confidentiality); each project is commissioned under a short document that references it. |
| SOW / WO | Statement of Work / Work Order | The specific deliverables, timeline, and acceptance criteria for one engagement; lives under an MSA. |
| MOU | Memorandum of Understanding | Records the mutual intent of the parties; typically not legally binding. |
| MOA | Memorandum of Agreement | More formal than an MOU; defines each party's responsibilities and can be legally binding. |
| BPA | Business Partners Agreement | Governs a partnership between two companies: roles, responsibilities, and how profit or loss is shared. |
| SLA | Service Level Agreement | Measurable service commitments: uptime, response times, and the penalties if they are missed. |
| NDA | Non-Disclosure Agreement | Confidentiality: protects information shared between the parties from disclosure. |
Keep going
This test pairs with the rest of the Security+ material on this site:
- A weighted, week-by-week plan in the CompTIA Security+ study guide.
- The full domain breakdown in the SY0-701 exam objectives and format guide.
- What the exam and voucher actually cost in the Security+ exam cost breakdown.
- Moving on to AI security? Try the CompTIA SecAI+ (CY0-001) practice test.
Frequently asked questions
What is the passing score for CompTIA Security+ (SY0-701)?
750 on a scale of 100 to 900. It is a scaled score, not a percentage. You cannot convert it to "83% of questions correct"; anyone telling you that has misunderstood how the exam is scored, and the raw number of questions you need right is not published by CompTIA. Use a practical heuristic instead: consistently 85% or higher on questions you have never seen before, with no single domain under 75%, is the point most well-prepared candidates sit the exam.
How many performance-based questions (PBQs) are on the exam?
CompTIA does not publish how many PBQs appear, where they appear, or exactly how they are scored; its own FAQ declines to disclose this. Candidates commonly report a handful, often near the start, but that is community anecdote, not policy. What is official: PBQs are simulations or virtual environments, they are the only item type that awards partial credit, and a skippable PBQ can be marked and returned to later with your work saved.
What happens if I fail CompTIA Security+?
You can re-book immediately after a first fail, though you will need a new voucher. CompTIA requires a 14-day waiting period before a third or subsequent attempt. Mindset Cyber sells a Retake Assurance bundle that includes a second voucher for use if your first attempt does not pass.
Are these real CompTIA exam questions?
No. Every question on this page is original, written from CompTIA's published SY0-701 exam objectives to test the same knowledge the exam tests. They are not real exam questions, they are not paraphrased exam questions, and they are not from a dump. There is no legitimate source of real CY0-001 or SY0-701 questions; CompTIA revokes certifications for using dumps, and memorising leaked answers does not build the decision-making the exam is designed to test.
Is SY0-701 still the current CompTIA Security+ exam?
Yes, as of this page's last update (August 2026), SY0-701 is the current version and the one you should study for. A successor (widely referred to as SY0-801) has been discussed by third parties but has not been confirmed by CompTIA, so we do not treat it as a live consideration yet. If you have a voucher now, study SY0-701.
When you are ready, buy your voucher
An important note on what this is: Mindset Cyber is an Australian CompTIA Authorised Partner and we sell the exam voucher. We do not deliver Security+ training or courseware. This practice test is free study material, not a course.
And a genuine one: if you are not scoring consistently above 85% on fresh questions, do not buy a voucher yet. Keep studying. A voucher spent on an attempt you are not ready for is money lost, and this page exists to help you time it right, not to rush you.
Single user
Security+ voucher
One official SY0-701 exam voucher, priced in your local currency, redeemable at any Pearson VUE centre worldwide.
View the voucher → Most popularVoucher + Retake Assurance
Voucher + retake
The same voucher plus a second attempt if the first does not pass, for candidates who want the safety net.
View the options →Australian buyers: vouchers are priced in AUD with a GST tax invoice, and the exam is sat at any Australian Pearson VUE centre or online via OnVUE. Buyers outside Australia are billed in their local currency at checkout.