Most free Security+ practice test material online has the same problem. The questions are recall drills, the answers come with one line of justification, and nothing tells you why the other three options were wrong. That is the opposite of how the real exam works, because SY0-701 rarely asks you to define a term. It asks you to pick the best control for a described situation, and the wrong answers are usually real controls that solve a slightly different problem.
Below are 25 Security+ practice questions written to that standard. They are split across the five SY0-701 domains in roughly the proportions CompTIA uses on the live exam, so a weak run in one section tells you something useful about where to revise.
Exam Tip: SY0-701 gives you a maximum of 90 questions in 90 minutes and requires 750 on a scale of 100 to 900 to pass. That is one minute per question, including the performance-based ones. Practising against a clock matters as much as practising the content.
How to use these Security+ practice questions
Work through all 25 before you check anything. Write your answers down, then score yourself in one pass at the end.
Give yourself 25 minutes. That is the same per-question budget as the real exam, and it stops you from doing the thing that inflates every practice score: sitting on a hard question until the answer surfaces. On exam day you will not have that time.
When you review, read the explanation for every question you got right as well as every one you got wrong. Guessing correctly and knowing correctly produce the same score here and very different scores in November.
Domain 1: General Security Concepts (12% of the exam)
Question 1
An organisation is implementing a zero trust architecture. Engineers need to separate the systems that decide whether a request should be allowed from the systems that actually enforce that decision. Which two components handle these responsibilities?
A. Policy Engine and Policy Enforcement Point B. Policy Administrator and Policy Engine C. Policy Enforcement Point and Implicit Trust Zone D. Subject and System
Answer: A
The Policy Engine sits in the control plane and makes the allow or deny decision. The Policy Enforcement Point sits in the data plane and applies it to the actual traffic. Option B names two control plane components, so nothing in that pair enforces anything. Option C pairs an enforcement component with a network region rather than a decision-maker. Option D describes who is requesting access, not the machinery that evaluates the request.
Question 2
A supplier disputes having submitted a purchase order that your finance team acted on. The order was submitted through a portal that requires each supplier to sign submissions with a private key. Which security concept allows you to disprove the supplier's claim?
A. Confidentiality B. Integrity C. Non-repudiation D. Authentication
Answer: C
Non-repudiation is the property that stops a party denying an action they took, and a digital signature created with a private key only that supplier holds provides it. Integrity would tell you the order had not been altered in transit, which is a different question. Authentication proves who is connecting at the time of the session. Confidentiality is irrelevant, since the dispute is about authorship rather than disclosure.
Question 3
A change advisory board is reviewing a proposal to replace the authentication method on a customer-facing application. Which element of the change request most directly limits the impact if the new method fails in production?
A. The maintenance window B. The backout plan C. The impact analysis D. The test results
Answer: B
The backout plan is the documented procedure for reverting to the previous known-good state, so it is what caps the damage once a change has already gone wrong. The maintenance window controls when users are affected, not how badly. Impact analysis and test results are both done before the change and reduce the probability of failure rather than its consequences.
Domain 2: Threats, Vulnerabilities and Mitigations (22% of the exam)
Question 4
A group defaces a government website and publishes a manifesto about an environmental policy. The attack uses a publicly available exploit and no data is stolen. Which threat actor type and motivation best fit this activity?
A. Nation-state actor motivated by espionage B. Organised crime motivated by financial gain C. Hacktivist motivated by philosophical or political beliefs D. Insider threat motivated by revenge
Answer: C
Publishing a political message rather than stealing data or demanding payment is the defining hacktivist pattern, and the use of a public exploit points to modest resources. A nation-state actor typically has custom tooling and wants persistence and quiet access, not publicity. Organised crime monetises the intrusion. An insider would not need a public exploit against an external web server.
Question 5
Employees receive a text message claiming their delivery is held pending a small customs fee, with a link to a site whose domain is one character different from the real courier's domain. Which two techniques are being combined?
A. Vishing and pretexting B. Smishing and typosquatting C. Phishing and watering hole D. Whaling and business email compromise
Answer: B
Smishing is social engineering delivered over SMS, and typosquatting is registering a domain that differs from a legitimate one by a character or two. Vishing is voice-based, so option A misidentifies the delivery channel. A watering hole attack compromises a site the targets already visit rather than luring them to a lookalike. Whaling targets senior executives specifically, and nothing here indicates that.
Question 6
A developer finds that an application checks whether a user has permission to write to a file, then opens the file a moment later. An attacker can replace the file between those two steps. Which vulnerability class is this?
A. Buffer overflow B. Race condition C. SQL injection D. Privilege escalation
Answer: B
This is a time-of-check to time-of-use race condition, where the state validated during the check no longer holds when the resource is used. A buffer overflow involves writing past an allocated memory boundary. SQL injection involves untrusted input reaching a database query. Privilege escalation describes the attacker's outcome here, but the flaw being exploited is the timing gap.
Question 7
A vulnerability scan flags an internet-facing server running a library with a known remote code execution flaw. The vendor has not released a patch. Which mitigation is the most appropriate immediate response?
A. Accept the risk and rescan next quarter B. Apply compensating controls such as virtual patching at the WAF and restrict inbound access C. Decommission the server D. Reclassify the finding as a false positive
Answer: B
Compensating controls are exactly what you deploy when the preferred fix is unavailable, and blocking the exploit pattern at the web application firewall while narrowing exposure reduces risk without waiting on the vendor. Accepting the risk on an internet-facing remote code execution flaw is not defensible. Decommissioning is disproportionate when the service is presumably needed. Reclassifying a confirmed finding as a false positive is falsifying the record.
Question 8
A software vendor's build server is compromised and a malicious update is signed with the vendor's legitimate certificate, then distributed to customers. Which threat vector does this represent?
A. Supply chain attack B. Shadow IT C. Removable media D. Default credentials
Answer: A
Compromising a trusted upstream provider so that its customers install the attacker's code is the definition of a supply chain attack, and the legitimate signature is what makes it effective. Shadow IT is unsanctioned technology introduced by staff. Removable media and default credentials are both vectors, but neither describes what happened here.
Domain 3: Security Architecture (18% of the exam)
Question 9
A hospital wants to ensure that a compromised workstation in radiology cannot communicate with medical imaging devices on the same physical network unless a policy explicitly permits it. Which approach best achieves this?
A. VLAN segmentation B. Microsegmentation C. Air gap D. Screened subnet
Answer: B
Microsegmentation applies policy at the individual workload level, so lateral movement between two devices is denied unless a rule allows it. VLAN segmentation separates broadcast domains but usually still permits free communication within a VLAN. An air gap removes network connectivity entirely, which would stop the imaging devices working as intended. A screened subnet is for hosting services reachable from an untrusted network.
Question 10
A payment application must retain the ability to link repeat transactions to the same card without storing the card number. Which technique meets this requirement?
A. Data masking B. Tokenisation C. Hashing with a salt D. Full disk encryption
Answer: B
Tokenisation replaces the card number with a surrogate value that maps back to the original in a separate vault, and reissuing the same token for the same card is what allows repeat transactions to be linked. Data masking obscures values for display but is not designed as a consistent reversible mapping. Salted hashing produces a different output per salt, which breaks the linking requirement. Full disk encryption protects data at rest on the device and does nothing about what the application stores.
Question 11
After a ransomware incident, an organisation states that the maximum tolerable data loss for its order system is 15 minutes, and the system must be functioning again within four hours. Which two metrics are being defined?
A. RPO of 15 minutes and RTO of four hours B. RTO of 15 minutes and RPO of four hours C. MTTR of 15 minutes and MTBF of four hours D. RPO of 15 minutes and MTTR of four hours
Answer: A
The recovery point objective describes how much data you can afford to lose, which sets backup frequency, so 15 minutes is the RPO. The recovery time objective describes how long restoration may take, so four hours is the RTO. Option B reverses them. Mean time to repair and mean time between failures are measured averages of past performance rather than targets set by the business.
Question 12
Administrators need to reach management interfaces on production servers, but those interfaces must not be reachable directly from the corporate network. Which control addresses this?
A. Jump server B. Proxy server C. Load balancer D. Network tap
Answer: A
A jump server is a hardened, closely monitored host that acts as the single controlled entry point into a protected network segment, which is precisely the described requirement. A proxy server mediates outbound client traffic to external resources. A load balancer distributes inbound requests across a pool of servers. A network tap copies traffic for monitoring and grants no access.
Question 13
An organisation runs a critical database on a single server. It wants the service to survive the loss of that server without staff having to restore from backup. Which architectural choice delivers this?
A. Snapshot the server nightly B. Deploy an active-passive cluster with automatic failover C. Increase the server's RAM and add redundant power supplies D. Replicate backups to a second site
Answer: B
Clustering with automatic failover moves the workload to a surviving node without a manual restore, which is what the requirement asks for. Nightly snapshots and offsite backup replication both still require a restore process. Redundant power supplies improve component-level resilience but do nothing when the server itself is lost.
Domain 4: Security Operations (28% of the exam)
Question 14
A scan returns four findings. Which should be remediated first?
A. CVSS 9.8, internet-facing, exploit code publicly available B. CVSS 9.8, internal only, no known exploit C. CVSS 7.5, internet-facing, no known exploit D. CVSS 10.0, on a system scheduled for decommissioning next week
Answer: A
Prioritisation combines severity with exposure and exploitability rather than reading the CVSS number alone, and a critical flaw that is reachable from the internet with working public exploit code is the highest real risk. Option B has the same base score but no exposure or exploit. Option C is exposed but less severe and not weaponised. Option D has the highest score and the shortest remaining life, so effort spent there is largely wasted.
Question 15
A security team wants alerts raised automatically when a user account triggers a failed login spike followed by a successful login from a new country. They also want the resulting ticket created and the account disabled without an analyst clicking anything. Which two capabilities are required?
A. SIEM for both B. SIEM for the correlation, SOAR for the automated response C. DLP for the correlation, SIEM for the response D. IDS for the correlation, SOAR for the response
Answer: B
A SIEM aggregates and correlates events across sources, which is how the failed-login and geolocation pattern gets detected. SOAR executes the playbook that opens the ticket and disables the account. A SIEM alone alerts but does not orchestrate the response. DLP watches data movement, and an IDS inspects network traffic rather than correlating authentication events across systems.
Question 16
Database administrators currently hold permanent administrative rights on production database servers. Security wants them to hold those rights only while an approved task is running. Which control implements this?
A. Role-based access control B. Just-in-time permissions C. Mandatory access control D. Federation
Answer: B
Just-in-time permissions grant elevated rights for a defined window tied to an approved request and revoke them automatically afterwards, which removes standing privilege. Role-based access control assigns rights by job function but leaves them in place. Mandatory access control enforces access by labels and clearance. Federation allows identities from one domain to be trusted in another and says nothing about how long privileges last.
Question 17
An analyst confirms malware on 12 endpoints and immediately isolates them from the network while the investigation continues. Which incident response phase is this?
A. Preparation B. Detection C. Containment D. Eradication
Answer: C
Containment is the phase where you limit the spread and prevent further damage, and network isolation is its most common form. Detection is the phase that has already concluded, since the malware is confirmed. Eradication is removing the malware and closing the vector, which comes after the bleeding has stopped. Preparation covers the work done before any incident.
Question 18
An analyst copies a disk image from a compromised laptop and records who handled the drive, when, and for what purpose at every step. What is this documentation called, and why does it matter?
A. Legal hold, because it prevents data deletion B. Chain of custody, because it establishes that the evidence was not tampered with C. E-discovery, because it identifies relevant records D. Provenance, because it identifies the data owner
Answer: B
Chain of custody is the unbroken record of who controlled evidence and when, and it is what makes the evidence defensible if the incident reaches court or arbitration. Legal hold is the instruction to preserve data once litigation is anticipated. E-discovery is the process of locating and producing records for legal proceedings. Provenance concerns where data originated.
Question 19
A company requires a password and a code from a hardware token. It wants to add a third factor that is genuinely distinct from the first two. Which option qualifies?
A. Security questions B. A one-time code sent by SMS C. A fingerprint scan D. A longer minimum password length
Answer: C
A fingerprint is something you are, which is a different factor category from something you know (the password) and something you have (the token). Security questions are another knowledge factor. An SMS code is another possession factor, and a weaker one. Increasing password length strengthens an existing factor rather than adding a new one.
Question 20
Finance staff have started emailing spreadsheets containing customer bank details to personal accounts. Which control detects and blocks this specific behaviour?
A. EDR B. DLP C. NGFW geolocation blocking D. FIM
Answer: B
Data loss prevention inspects content against policy and can block or quarantine messages containing patterns such as account numbers, which is exactly the described problem. EDR monitors endpoint process and behaviour for malicious activity, not the sensitivity of outbound file contents. Geolocation blocking filters by source or destination country. File integrity monitoring alerts on changes to files rather than their exfiltration.
Domain 5: Security Program Management and Oversight (20% of the exam)
Question 21
An organisation buys a cyber insurance policy covering losses from a ransomware event. Which risk response strategy has it used?
A. Risk avoidance B. Risk mitigation C. Risk transference D. Risk acceptance
Answer: C
Transference shifts the financial consequence of a risk to a third party, and insurance is its standard example. Avoidance would mean ceasing the activity that creates the risk. Mitigation reduces likelihood or impact through controls, which insurance does not do. Acceptance means taking the loss internally with no offsetting arrangement.
Question 22
Two organisations are entering a partnership. They need a document that sets out the specific performance metrics the vendor must meet, including uptime and response times, with penalties for failure. Which agreement type is this?
A. MOU B. SLA C. NDA D. BPA
Answer: B
A service level agreement defines measurable performance commitments and the consequences of missing them. A memorandum of understanding states shared intent and is usually not binding on specifics. A non-disclosure agreement governs confidentiality of shared information. A business partnership agreement sets out the commercial terms of the relationship rather than service metrics.
Question 23
A server is valued at £200,000. A flood would destroy an estimated 25% of its value, and the site floods roughly once every four years. What is the annualised loss expectancy?
A. £12,500 B. £25,000 C. £50,000 D. £200,000
Answer: A
Single loss expectancy is asset value multiplied by exposure factor, so £200,000 × 0.25 gives £50,000. Annualised rate of occurrence for a once-in-four-years event is 0.25, so ALE is £50,000 × 0.25, which is £12,500. Option C is the SLE, which is the most common mistake on this question type. Option B applies the wrong ARO, and option D ignores both the exposure factor and the frequency.
Question 24
A client commissions a penetration test and provides the testers with network diagrams, source code and credentials. Which type of assessment is this?
A. Unknown environment test B. Partially known environment test C. Known environment test D. Physical assessment
Answer: C
A known environment test gives testers full information up front, which maximises coverage per hour spent because no time goes on reconnaissance. An unknown environment test provides nothing and simulates an external attacker. A partially known environment test supplies limited information such as a network range. A physical assessment tests site access controls rather than systems.
Question 25
An organisation wants its third-party suppliers to be contractually obliged to allow security assessments of their controls. Which clause achieves this?
A. Right-to-audit clause B. Indemnity clause C. Force majeure clause D. Termination clause
Answer: A
A right-to-audit clause reserves the customer's ability to inspect or commission an inspection of the supplier's controls, which is what turns vendor assurance from a questionnaire into something verifiable. An indemnity clause allocates liability for losses. A force majeure clause excuses performance during extraordinary events. A termination clause governs how the contract ends.
What your score means
Score one point per question, then compare against this table. These bands are a readiness indicator based on the pass threshold, not a prediction of your scaled exam score.
| Score out of 25 | Percentage | What it suggests |
|---|---|---|
| 22 to 25 | 88% and above | Exam-ready on knowledge. Shift your remaining time to performance-based questions and timing. |
| 19 to 21 | 76% to 84% | Close. Identify which domains lost you points and revise those specifically rather than restarting the syllabus. |
| 15 to 18 | 60% to 72% | Borderline. You know the vocabulary but not the scenario application. More practice questions, not more reading. |
| Below 15 | Under 60% | Not ready. Work back through the objectives for your two weakest domains before testing again. |
Pay attention to the pattern rather than the total. Losing four points spread evenly across five domains means something different from losing four points all in Security Operations, which is the largest section of the exam at 28%.
What changes when SY0-801 arrives
SY0-701 launched on 7 November 2023 and CompTIA lists its estimated retirement as 2026. The replacement, SY0-801, has been discussed on CompTIA's Instructors Network with a target launch in November 2026, though CompTIA has not published a formal announcement, so treat the date as provisional.
The draft objectives point to two shifts that affect how you should read questions like the ones above. Domain weights move, with General Security Concepts growing and Security Program Management shrinking. More significantly, AI enters the objectives properly for the first time, covering large language models as a vulnerability class, AI-assisted attacks such as deepfakes and generated phishing, and AI used defensively in security operations.
Nothing in this set becomes wrong under SY0-801. Question 7 on compensating controls, question 14 on prioritisation and question 21 on risk response are version-independent, because they test reasoning that CompTIA has carried across every revision since SY0-401. If you are sitting the exam before November 2026, SY0-701 is the version to prepare for. We cover the differences in detail in our SY0-801 vs SY0-701 comparison.
Frequently Asked Questions
Is Security+ a hard test?
Security+ is harder than its entry-level reputation suggests, mainly because of format rather than content depth. Candidates who memorise definitions struggle, because most questions describe a situation and ask for the best control, and several options are usually valid controls for a different situation. The performance-based questions at the start also cost more time than people expect, which is where a lot of failures originate.
How do you pass the Security+ exam?
Answer practice questions under time pressure rather than reading a study guide repeatedly, and review the reasoning behind every distractor. Skip and flag the performance-based questions at the start, clear the multiple-choice items, then return to them with whatever time remains. Weight your revision towards Security Operations, which is 28% of the exam and the largest single domain.
What is a passing score for Security+?
You need 750 on a scale of 100 to 900. The exam is scaled rather than a straight percentage, so there is no fixed number of questions you must answer correctly, and CompTIA does not publish a raw-score equivalent. Aiming for 85% or better on quality practice material gives you a sensible margin.
How many questions are on the Security+ exam?
SY0-701 has a maximum of 90 questions, delivered in 90 minutes, and mixes multiple-choice items with performance-based questions. The word maximum matters: you may see fewer than 90.
Is Security+ worth it in 2026?
For anyone entering security or moving into it from IT support or networking, Security+ remains the most widely requested baseline certification in job adverts and it satisfies DoD 8140 requirements for several work roles. It will not on its own move an experienced engineer forward, and at that level CySA+ or a specialist certification is the better investment.
Ready to Start Practising?
Twenty-five questions tell you where you stand. They do not tell you whether you can hold that standard across 90 questions in 90 minutes, which is the actual test.
CertCrush's Security+ course gives you a full question bank with the same explanation depth used above, performance-based question practice, and timed mock exams that mirror the live format. You can see which domains are costing you points and drill those specifically instead of rereading material you already know.
Create a free account and take your first timed Security+ practice exam today.