Free CompTIA SY0-701 Practice Questions & Answers 2026 Part2 | CompTIA Security+

An engineer needs to find a solution that creates an added layer of security by preventing unauthorized access to internal company resources. Which of the following would be the best solution?

A security administrator notices numerous unused, non-compliant desktops are connected to the network. Which of the following actions would the administrator most likely recommend to the management team?

An analyst is performing a vulnerability scan against the web servers exposed to the internet without a system account. Which of the following is most likely being performed?

An employee clicked a link in an email from a payment website that asked the employee to update contact information. The employee entered the log-in information but received a “page not found” error message. Which of the following types of social engineering attacks occurred?

A company is changing its mobile device policy. The company has the following requirements:Company-owned devicesAbility to harden the devicesReduced security riskCompatibility with company resourcesWhich of the following would best meet these requirements?

An enterprise is trying to limit outbound DNS traffic originating from its internal network. Outbound DNS requests will only be allowed from one device with the IP address 10.50.10.25. Which of the following firewall ACLs will accomplish this goal?

A penetration tester was able to gain unauthorized access to a hypervisor platform. Which of the following vulnerabilities was most likely exploited?

In order to maintain system stability, a company's software developers cannot merge updates into the code base without supervisor approval. Which of the following is the best description of this practice?

A Chief Security Officer signs off on a request to allow inbound SMB and RDP from the internet to a single VLAN. Which of the following is the most likely explanation for this activity?

An administrator notices that several users are logging in from suspicious IP addresses. After speaking with the users, the administrator determines that the employees were not logging in from those IP addresses and resets the affected users’ passwords. Which of the following should the administrator implement to prevent this type of attack from succeeding in the future?

Which of the following is the most likely to be used to document risks, responsible parties, and thresholds?

Which of the following would be the most helpful in restoring data in the event of a ransomware infection?

Which of the following methods can be used to detect attackers who have successfully infiltrated a network? (Choose two.)

Which of the following is used to improve security and overall functionality without losing critical application data?

In which of the following scenarios is tokenization the best privacy technique 10 use?

Which of the following will a global company doing business in the European Union need to be concerned with to avoid legal privacy implications?

An organization wants to improve the company's security authentication method for remote employees. Given the following requirements:Must work across SaaS and internal network applicationsMust be device manufacturer agnosticMust have offline capabilitiesWhich of the following would be the most appropriate authentication method?

A network team segmented a critical, end-of-life server to a VLAN that can only be reached by specific devices but cannot be reached by the perimeter network. Which of the following best describe the controls the team implemented? (Choose two.)

A security administrator is hardening corporate systems and applying appropriate mitigations by consulting a real-world knowledge base for adversary behavior. Which of the following would be best for the administrator to reference?

A network administrator wants to ensure that network traffic is highly secure while in transit. Which of the following actions best describes the actions the network administrator should take?

A systems administrator would like to deploy a change to a production system. Which of the following must the administrator submit to demonstrate that the system can be restored to a working state in the event of a performance issue?

A company relies on open-source software libraries to build the software used by its customers. Which of the following vulnerability types would be the most difficult to remediate due to the company's reliance on open-source libraries?

A security administrator is performing an audit on a stand-alone UNIX server, and the following message is immediately displayed:(Error 13): /etc/shadow: Permission denied.Which of the following best describes the type of tool that is being used?

Which of the following is a common data removal option for companies that want to wipe sensitive data from hard drives in a repeatable manner but allow the hard drives to be reused?

Which of the following security concepts is accomplished with the installation of a RADIUS server?

Of the following options, which risk/threat does SDP mitigate by mandating micro - segmentation and implementing least privilege?

A small business initially plans to open common communications ports (21, 22, 25, 80, 443) on its firewall to allow broad access to its screened subnet. However, their security consultant advises against this action. Which of the following security principles is the consultant addressing? The correct answer is Attack surface because opening multiple common service ports unnecessarily increases the number of potential entry points an attacker can target. In the Security+ SY0-701 exam objectives, the attack surface is defined as the total number of exposed interfaces, services, ports, protocols, and access points that an attacker could attempt to exploit. Each open port corresponds to a listening service, and every exposed service represents an opportunity for reconnaissance, exploitation, or abuse. In this scenario, the business intends to open ports for FTP, SSH, SMTP, HTTP, and HTTPS without clearly limiting access. While some of these services may be required, opening all of them broadly---especially to a screened subnet---significantly expands the attack surface. If any of these services are misconfigured, unpatched, or vulnerable, attackers could exploit them to gain unauthorized access. The SY0-701 study guide emphasizes minimizing exposed services as a foundational defensive strategy, often referred to as reducing attack surface area. Option C, least privilege, is related but not the best answer. Least privilege focuses on granting users or systems only the minimum access required, whereas this question specifically concerns exposed network services rather than access rights. Option A, secure access service edge (SASE), is a cloud-based architecture model and is unrelated to basic firewall port exposure decisions. Option D, separation of duties, applies to role and responsibility distribution, not network exposure. By advising against opening multiple common ports, the consultant is recommending a reduction in exposed services to limit opportunities for attack. This aligns directly with SY0-701 guidance on secure network design, firewall hardening, and minimizing externally accessible services. In summary, limiting open ports reduces the organization's attack surface, making Attack surface the correct and best answer.

Which of the following best describes a social engineering attack that uses a targeted electronic messaging campaign aimed at a Chief Executive Officer?

A company wants to ensure that the software it develops will not be tampered with after the final version is completed. Which of the following should the company most likely use?

An administrator needs to perform server hardening before deployment. Which of the following steps should the administrator take? (Choose two.)

A company is utilizing an offshore team to help support the finance department. The company wants to keep the data secure by keeping it on a company device but does not want to provide equipment to the offshore team. Which of the following should the company implement to meet this requirement?

A company's online shopping website became unusable shortly after midnight on January 30, 2023. When a security analyst reviewed the database server, the analyst noticed the following code used for backing up data:Which of the following should the analyst do next?

An attacker posing as the Chief Executive Officer calls an employee and instructs the employee to buy gift cards. Which of the following techniques is the attacker using?

An employee used a company's billing system to issue fraudulent checks. The administrator is looking for evidence of other occurrences of this activity. Which of the following should the administrator examine?

A company wants to reduce the time and expense associated with code deployment. Which of the following technologies should the company utilize?

A multinational bank hosts several servers in its data center. These servers run a business-critical application used by customers to access their account information. Which of the following should the bank use to ensure accessibility during peak usage times?

Which of the following is the best reason an organization should enforce a data classification policy to help protect its most sensitive information?

A security analyst is reviewing the logs on an organizations DNS server and notices the following unusual snippet:Which of the following attack techniques was most likely used?

ZTA utilizes which of the following to improve the network's security posture?

A security administrator is working to secure company data on corporate laptops in case the laptops are stolen. Which of the following solutions should the administrator consider?

Which of the following most likely describes why a security engineer would configure all outbound emails to use S/MIME digital signatures?

For which of the following reasons would a systems administrator leverage a 3DES hash from an installer file that is posted on a vendor's website?

A company prevented direct access from the database administrators’ workstations to the network segment that contains database servers. Which of the following should a database administrator use to access the database servers?

Which of the following is a feature of a next-generation SIEM system?

Which of the following agreement types is used to limit external discussions?

A utility company is designing a new platform that will host all the virtual machines used by business applications. The requirements include:A starting baseline of 50% memory utilizationStorage scalabilitySingle circuit failure resilienceWhich of the following best meets all of these requirements?

A company prevented direct access from the database administrators’ workstations to the network segment that contains database servers. Which of the following should a database administrator use to access the database servers?

Which of the following should an organization use to protect its environment from external attacks conducted by an unauthorized hacker?

A systems administrator is concerned about vulnerabilities within cloud computing instances. Which of the following is most important for the administrator to consider when architecting a cloud computing environment?