Free SY0-701 Practice Test Questions 2026

Explanation:
Peer review and approval is a process where multiple developers examine and approve code changes before they are integrated into the main codebase. This practice is highly effective at preventing malicious code insertion by an insider because it introduces oversight and accountability. Other team members can detect suspicious or unauthorized changes, ensuring that only vetted and legitimate code is added. This collaborative scrutiny acts as a critical human-layer defense against insider threats.

Why the others are incorrect:
A. Code scanning for vulnerabilities:
This is an automated tool that checks for security flaws (e.g., SQL injection, buffer overflows) but is not designed to detect intentional malicious code inserted by an insider. It focuses on unintentional vulnerabilities, not malicious intent.

B. Open-source component usage:
While using open-source components can introduce risks (e.g., known vulnerabilities), it does not prevent an insider from adding malicious code. In fact, overreliance on open-source might increase attack surfaces if not properly vetted.

C. Quality assurance testing:
QA testing focuses on functionality, performance, and user experience, not necessarily on identifying malicious code. It is unlikely to catch intentionally hidden malicious logic unless specifically designed for security testing.

Reference:
This aligns with SY0-701 Objective 3.2 ("Given a scenario, implement host or application security solutions") and best practices in secure software development. Peer review is a cornerstone of DevSecOps, as emphasized in frameworks like NIST SSDF (Secure Software Development Framework), which recommends code review to mitigate risks, including insider threats.

Explanation: An NGFW (Next-Generation Firewall) utilizing application inspection could have identified and blocked the unusual use of HTTP over port 53. Application inspection allows NGFWs to analyze traffic at the application layer, identifying and blocking suspicious or non-standard protocol usage, such as HTTP traffic on DNS port 53. NGFW utilizing application inspection: Inspects traffic at the application layer and can block non-standard protocol usage, such as HTTP over port 53. WAF utilizing SSL decryption: Focuses on protecting web applications and decrypting SSL traffic but may not detect the use of HTTP over port 53. UTM utilizing a threat feed: Provides comprehensive security but may not focus specifically on application layer inspection. SD-WAN utilizing IPSec: Enhances secure WAN connections but is not primarily designed to inspect and block specific application traffic. Reference: CompTIA Security+ SY0-701 Exam Objectives, Domain 4.5 - Modify enterprise capabilities to enhance security (Next-generation firewall).

Explanation:

Why A is Correct:
An insider threat involves malicious or negligent actions taken by individuals who have authorized access to an organization's systems or data. In this scenario, the attack was performed using a legitimate domain user account, indicating the actor had authorized access. The encryption of files (consistent with ransomware or data sabotage) by this authorized user aligns perfectly with the definition of an insider threat.

Why B is Incorrect:
Social engineering is a technique used to manipulate people into divulging confidential information or performing actions (e.g., phishing). While social engineering might have been used to obtain the domain user's credentials, the scenario does not provide evidence of this. The logs show the attack was carried out directly by the domain user, pointing to the user as the threat, not an external actor using social engineering.

Why C is Incorrect:
A watering-hole attack involves compromising a website frequently visited by a target group to infect their systems. This is an external attack vector and does not involve authorized domain users directly accessing and encrypting files on a server.

Why D is Incorrect:
An unauthorized attacker typically refers to an external threat actor without legitimate access. Here, the security logs confirm the data was accessed by a domain user, meaning the attacker (or the account used) was authorized, making "unauthorized attacker" incorrect.

Reference:
This question falls under Domain 1.0: Threats, Attacks, and Vulnerabilities, specifically covering insider threats. The SY0-701 exam emphasizes the risk posed by authorized users and the importance of monitoring for malicious insider activity, as evidenced by legitimate credentials being used in attacks.

Explanation:
The chain of custody is a documented process that tracks the seizure, custody, control, transfer, analysis, and disposition of physical and electronic evidence. It ensures that evidence is handled in a secure, documented manner from the moment it is collected until it is presented in court. This includes recording who accessed the evidence, when, for what purpose, and any changes made. A proper chain of custody is critical for maintaining the integrity and admissibility of evidence in legal proceedings, as it proves the evidence has not been tampered with or altered.

Analysis of Incorrect Options:

A. E-discovery:
E-discovery (electronic discovery) is the process of identifying, collecting, and producing electronically stored information (ESI) in response to a legal request or investigation. While it involves handling evidence, it is a broader process and does not specifically focus on the detailed logging and control that the chain of custody provides.

C. Legal hold:
A legal hold (or litigation hold) is a notification sent to an organization instructing them to preserve all relevant information (including electronic data) because it may be needed for upcoming litigation or an investigation. It ensures evidence is not destroyed, but it does not dictate how the evidence is handled or tracked once collected.

D. Preservation:
Preservation refers to the steps taken to protect evidence from alteration or destruction. This is a critical first step in evidence handling (e.g., making a forensic image of a hard drive to preserve its state), but it does not encompass the ongoing documentation and tracking of who controls the evidence over time, which is the role of the chain of custody.

Reference:
This question falls under Domain 4.0: Security Operations, specifically related to digital forensics and incident response. The chain of custody is a fundamental concept in forensic procedures, ensuring evidence integrity for potential legal action. It is emphasized in frameworks like NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response).

Explanation:
An air gap is a physical security measure that isolates a system or network from unsecured networks (e.g., the internet or other parts of the corporate network). For an application server running unsupported software (which no longer receives security patches and is highly vulnerable), air gapping is the most effective way to protect it from network-based threats. By disconnecting it entirely from any network, attackers cannot reach it remotely, eliminating the risk of exploitation via vulnerabilities.

Why the others are incorrect:

B. Barricade:
This refers to a physical barrier (e.g., a fence or wall) to prevent unauthorized physical access. It does not protect against network threats.

C. Port security:
This is a network switch feature that restricts access based on MAC addresses. It is useful for preventing unauthorized devices from connecting to a network port but does not protect the server itself from attacks if it is still connected to the network.

D. Screen subnet:
Also known as a DMZ (Demilitarized Zone), this is a segmented network area that hosts public-facing services. It provides some isolation but still allows controlled network access. An unsupported server in a DMZ remains vulnerable to attacks that bypass the DMZ's controls.

Reference:
This aligns with SY0-701 Objective 3.4 ("Given a scenario, implement secure network designs"). Air gapping is a extreme but effective measure for protecting critical or vulnerable systems, as recommended in guidelines like NIST SP 800-82 ("Guide to Industrial Control Systems Security") for high-risk environments. It is the ultimate form of network isolation.

Explanation:
Server hardening is the process of securing a server by reducing its attack surface. This involves minimizing potential vulnerabilities that could be exploited. The steps chosen should be actions taken before deployment to achieve this goal.

Why A is Correct:
Default accounts (e.g., "admin," "guest") are well-known and are prime targets for attackers. Disabling or renaming them is a fundamental hardening step to prevent unauthorized access using these common credentials.

Why C is Correct:
Any running service or application represents a potential attack vector. Removing unnecessary services, software, and roles minimizes the number of ways an attacker can potentially compromise the server. This is a core principle of system hardening.

Why the Other Options Are Incorrect:

B. Add the server to the asset inventory:
This is a crucial step for asset management and will be done, but it is not a hardening technique. Hardening focuses on technical security configurations, not administrative tracking.

D. Document default passwords:
This is the opposite of hardening. Default passwords should be changed immediately and not documented in an insecure manner. Documenting them creates a security risk.

E. Send server logs to the SIEM:
This is an important step for monitoring and detection that should be configured after the server is deployed and on the network. It is not part of the pre-deployment hardening process.

F. Join the server to the corporate domain:
This is a configuration step for access and management that would be performed during or after deployment. It applies group policies (which may include security settings) but is not itself a specific hardening action taken on the server's base configuration.

Reference:
This question falls under Domain 2.0: Architecture and Design, specifically covering the concepts of secure systems design and deployment. Server hardening is a critical task within this domain, and the exam expects knowledge of its specific steps, such as disabling default accounts and removing unnecessary components.

Explanation:
Input sanitization is a defensive coding practice that involves cleaning, filtering, or rejecting user input to ensure it is safe to process. Its primary purpose is to prevent injection attacks by removing or neutralizing malicious characters and code.

The example <script>alert ("Warning!") ,-</script> is a classic, simple example of a cross-site scripting (XSS) payload. If a web application accepts this input from a user (e.g., in a comment field, search bar, or form) and then displays it to other users without sanitizing it, the malicious script would execute in their browsers. Input sanitization would mitigate this by stripping out or escaping the HTML <script> tags, rendering the input harmless text instead of executable code.

Why the other options are incorrect:

B. nmap - 10.11.1.130:
This is a command for a network scanning tool (Nmap). This would be best mitigated by network-level security controls like firewalls, intrusion prevention systems (IPS), and proper network segmentation—not by sanitizing input on a single application.

C. Email message:
"Click this link to get your free gift card.": This is a classic phishing attempt. This is best mitigated by user security awareness training (to teach users not to click suspicious links) and email security gateways (which filter and block malicious emails)—not by input sanitization, as the attack vector is user deception, not malicious data input into a form.

D. Browser message:
"Your connection is not private.": This is a browser warning indicating an issue with a website's SSL/TLS certificate (e.g., it is expired, self-signed, or doesn't match the domain). This is best resolved by the website administrator fixing the certificate issue. It is not something an application would mitigate through input sanitization, as it's a problem with the transport layer security, not malicious user input.

Reference:
This question tests knowledge of secure coding practices and application security.

This falls under Domain 3.2: Given a scenario, implement security applications for enterprise infrastructure and Domain 1.4: Given a scenario, analyze potential indicators of malicious activity of the CompTIA Security+ SY0-701 exam objectives.

Input sanitization is a primary defense against injection attacks, especially XSS, as outlined in frameworks like the OWASP Top 10, where injection flaws are consistently a critical security risk.

Explanation: A detective control is a type of security control that monitors and analyzes events to detect and report on potential or actual security incidents. A SIEM system is an example of a detective control, as it collects, correlates, and analyzes security data from various sources and generates alerts for security teams. Corrective, preventive, and deterrent controls are different types of security controls that aim to restore, protect, or discourage security breaches, respectively. References: CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 33; What is Security Information and Event Management (SIEM)?

Explanation:
A SIEM (Security Information and Event Management) system is specifically designed to aggregate log data from various sources (e.g., servers, network devices, applications), correlate events, and create alerts based on predefined rules or anomalous patterns. It provides centralized visibility and analysis, enabling security teams to detect and respond to threats like intrusions, malware, or unusual user behavior.

Why the others are incorrect:

B. WAF (Web Application Firewall):
This protects web apps by filtering HTTP traffic and blocking attacks (e.g., SQL injection). It does not aggregate logs from diverse sources or create alerts for broader anomalous activity.

C. Network taps:
These are passive devices that copy network traffic for monitoring but do not aggregate logs or generate alerts. They feed data to other tools (e.g., IDS, SIEM).

D. IDS (Intrusion Detection System):
This monitors network or host activity for signs of attacks and generates alerts but typically focuses on specific signatures or anomalies. It does not centrally aggregate and correlate logs from multiple sources like a SIEM.

Reference:
This aligns with SY0-701 Objective 4.3 ("Given an incident, utilize appropriate data sources to support an investigation"). SIEMs are critical for log aggregation and analysis, as outlined in frameworks like NIST SP 800-92 ("Guide to Computer Security Log Management"). They enable proactive threat detection through correlation and alerting.

Explanation:
Threat hunting is a proactive security practice where analysts actively search for signs of malicious activity or threats that may have evaded existing detection tools (like SIEM alerts, which are not yet configured in this scenario). Given that the cyber operations team provided intelligence about a new tactic, the security analyst should use this information to hypothesize and hunt for indicators of this behavior across the network—manually examining logs, endpoint data, network traffic, and other sources to identify potential compromises. Threat hunting bridges the gap between known threats and undetected attacks, especially when automated alerts are not in place.

Analysis of Incorrect Options:

A. Digital forensics:
Digital forensics involves the detailed investigation and analysis of incidents after they have been detected to gather evidence (e.g., for legal purposes). It is reactive, not proactive, and assumes an incident has already occurred.

B. E-discovery:
E-discovery is a legal process for identifying, collecting, and producing electronic information in response to litigation or investigations. It is not related to identifying active malicious behavior.

C. Incident response:
Incident response is the structured process for managing and mitigating security incidents after they are detected. Since no incident has been confirmed yet, this is premature; threat hunting is the step to determine if an incident exists.

Reference:
This aligns with Domain 4.0: Security Operations, specifically proactive threat management. Threat hunting is emphasized in frameworks like MITRE ATT&CK and NIST SP 800-53 (CA-7) as a means to improve detection capabilities and reduce dwell time. It relies on analyst expertise and threat intelligence to uncover stealthy attacks.

Explanation:
The scenario describes a Business Email Compromise (BEC) or phone-based social engineering attack (vishing), where the accounting clerk was tricked into sending money to a fraudulent account. The most effective prevention is to update the wire transfer process to include robust verification steps, such as:

Requiring multi-person approval for transfers.

Verifying changes to account details via a secondary, trusted channel (e.g., in-person confirmation or a pre-established phone number).

Implementing callback procedures to validate requests.

These measures add layers of authentication to prevent unauthorized transactions.

Why the others are incorrect:

A. Standardizing security incident reporting:
This improves response after an incident but does not prevent the initial social engineering attack.

B. Executing regular phishing campaigns:
These train users to recognize email phishing, but the attack occurred via phone (vishing), not email.

C. Implementing insider threat detection measures:
This focuses on malicious insiders, not external attackers using social engineering.

Reference:
This aligns with SY0-701 Objective 1.1 ("Compare and contrast common social engineering techniques"). Mitigating BEC/vishing attacks requires process controls like dual authorization and verification, as recommended by the FBI and financial institutions. Updated wire transfer procedures are a core defense against such fraud.

Explanation:

B) Placing the system in an isolated VLAN is the correct answer.
An end-of-life (EOL) operating system no longer receives security patches, making it highly vulnerable to exploits. While the ideal long-term solution is to upgrade or replace the system (decommissioning might not be feasible if it's critical for transactions), network segmentation via an isolated VLAN is a practical immediate control. This technique:

Limits the system's network exposure by restricting communication to only necessary hosts/services (e.g., placing it in a DMZ or dedicated segment).

Reduces the attack surface by preventing lateral movement from compromised systems to/from this vulnerable host.

Contains potential breaches, minimizing impact on the broader enterprise network.

Why the others are incorrect:

A) Installing HIDS (Host-based Intrusion Detection System):
While HIDS can monitor for suspicious activity on the host, it cannot patch the underlying EOL OS vulnerabilities. It is a detective control but does not prevent exploits targeting unpatched flaws.

C) Decommissioning the system:
Although decommissioning would eliminate the risk, the scenario states the system is critical for processing customer transactions. Decommissioning is likely not an option without causing business disruption, so it is not the best immediate security improvement.

D) Encrypting the system's hard drive:
Encryption protects data at rest (e.g., if the drive is stolen), but it does not mitigate risks related to network-based attacks, remote exploits, or vulnerabilities in the live OS. The system remains exposed to threats while operational.

Reference:
This question tests knowledge of Domain 2.4: Explain the importance of security concepts in an enterprise environment (addressing legacy systems) and Domain 3.3: Given a scenario, implement secure network designs (segmentation). Isolating vulnerable systems is a core compensating control when patching is not possible, as emphasized in risk management strategies.