Free SY0-701 Practice Test Questions 2026

Explanation:
A cryptographic hash function is an algorithm specifically designed to verify the integrity of data. It takes an input (or 'message') and returns a fixed-size string of bytes, typically a digest that is unique to the unique input.

The process for verifying integrity is:

A sender calculates the hash of the original data.

The data and its hash are sent to the recipient.

The recipient independently calculates the hash of the received data.

The recipient compares their calculated hash with the hash that was sent.

If the two hashes match exactly, it proves the data was not modified in transit. Even the smallest change to the original data will produce a completely different hash value.

This property is fundamental to ensuring data has not been tampered with and is a core function of integrity verification.

Why the other options are incorrect:

B. Code check:
This is not a standard cryptographic term. It could refer to error-correcting codes in programming or data transmission, but it is not the precise algorithm used for cryptographic verification of integrity.

C. Encryption:
Encryption is an algorithm designed to provide confidentiality by transforming data into ciphertext to hide its content. While some encryption modes can also provide integrity, its primary purpose is not verification. It is possible to modify encrypted data in a way that is not detectable without an additional integrity mechanism. Hashing is the primary tool for pure verification.

D. Checksum:
A checksum is a value used to verify the integrity of a file or a data transfer. The key difference is that a checksum is designed to detect accidental errors (like those from network noise or disk faults), but it is not cryptographically secure. A malicious actor can easily modify the data and calculate a new valid checksum to match the altered data. A cryptographic hash function is designed to be computationally infeasible to reverse or to find two different inputs that produce the same output, making it suitable for detecting intentional, malicious modification.

Exam Objective Reference:
This question relates to Domain 2.0: Architecture and Design, specifically the concepts of cryptography and the core security service of integrity. It tests the understanding of the different purposes of hashing (integrity) versus encryption (confidentiality).

Explanation:
In the cloud shared responsibility model, the division of security duties depends on the service model (IaaS, PaaS, SaaS). The question specifies an IaaS (Infrastructure as a Service) model.

IaaS Model:
The cloud provider is responsible for the security of the cloud. This includes the physical infrastructure, network connectivity, and the hypervisor that virtualizes the compute, storage, and networking resources.

The client (the company using the service) is responsible for security in the cloud. This includes securing:

The guest operating systems on their virtual machines

The applications installed on those VMs

The data, including the company's database and its configuration

Identity and Access Management (IAM) for their users

Since the database is an application installed and managed by the company on the virtual infrastructure provided by the cloud provider, securing it is the client's responsibility.

Why the other options are incorrect:

B. Third-party vendor (Incorrect):
A third-party vendor might provide the database software (e.g., Oracle, MongoDB), but the responsibility for securing the installation, configuration, patching, and access to that database instance falls on the client who owns and operates it in their IaaS environment.

C. Cloud provider (Incorrect):
The cloud provider's responsibility in IaaS ends at the virtualization layer. They ensure the underlying infrastructure is available and secure, but they have no access to or responsibility for the operating systems, applications, or data you deploy on that infrastructure.

D. DBA (Incorrect):
A Database Administrator (DBA) is a role within the client's organization. While the DBA would be the individual tasked by the client with implementing the technical controls to secure the database (e.g., configuring authentication, encryption, auditing), the ultimate responsibility belongs to the client organization itself, as defined in the contract with the cloud provider.

Reference:
This question falls under Domain 2.0: Threats, Vulnerabilities, and Mitigations and Domain 3.0: Security Architecture, specifically testing knowledge of cloud service models (IaaS, PaaS, SaaS) and the shared responsibility matrix. Understanding what security tasks are the client's duty in each model is a critical objective for the SY0-701 exam.

Explanation:

Why B is Correct:
Port security is a feature on network switches that directly mitigates MAC address table flooding attacks. In this type of attack, an attacker sends a large number of frames with spoofed source MAC addresses to overwhelm the switch's MAC address table, causing it to enter a "fail-open" state where it broadcasts traffic to all ports (like a hub), allowing the attacker to eavesdrop. Port security can be configured to:

Limit the number of MAC addresses allowed on a specific port.

Dynamically learn and sticky-MAC addresses to prevent spoofing.

Take action (e.g., shut down the port) if unauthorized MAC addresses are detected.

This prevents the switch's MAC address table from being flooded.

Why A is Incorrect:
A load balancer distributes network traffic across multiple servers to optimize resource use and ensure availability. It operates at higher layers (e.g., Layer 4 or 7) and is not designed to protect Layer 2 switch functionality like MAC address tables.

Why C is Incorrect:
An Intrusion Prevention System (IPS) monitors network traffic for malicious activity and can block attacks. While some IPS systems might have signatures for MAC flooding, they are not as effective or direct as port security, which is implemented on the switch itself where the attack occurs. Port security is a preventive control, while IPS is more reactive.

Why D is Incorrect:
A Next-Generation Firewall (NGFW) provides advanced network security by inspecting traffic at multiple layers and applying policies. However, it is typically deployed at the network perimeter or between segments and does not protect internal switches from Layer 2 attacks like MAC flooding.

Reference:
This question falls under Domain 2.0: Architecture and Design, specifically covering network security controls. Port security is a fundamental switch configuration best practice to prevent Layer 2 attacks, including MAC address table flooding, and is a key objective for the SY0-701 exam.

Explanation:
Ransomware-as-a-Service (RaaS) is a cybercrime business model where developers create ransomware and lease it to affiliates, who then carry out the attacks. The profits are shared between the developers and the affiliates.

D. Organized crime is correct.
This business model is a hallmark of cyber-organized crime. These groups operate like sophisticated businesses, with developers, distributors, and customer support, all focused on financial profit. Their structured, profit-driven approach aligns perfectly with the characteristics of organized crime.

A. Insider threat is incorrect.
An insider threat is a current or former employee, contractor, or business partner who has inside access and misuses it to harm the organization. While an insider might use ransomware, the RaaS model itself is operated and promoted by external criminal organizations, not typically by insiders.

B. Hacktivist is incorrect.
Hacktivists are motivated by ideology or social/political causes, not financial gain. Their goal is to raise awareness or disrupt services for their cause. They would not typically develop and sell a service for profit; their actions are meant to send a message.

C. Nation-state is incorrect.
Nation-state actors are sponsored by governments and are primarily motivated by espionage, intellectual property theft, or sabotage to achieve strategic goals. While they may use ransomware as a tool for disruption or to create plausible deniability, their primary motive is not financial profit. The RaaS model is fundamentally a for-profit criminal enterprise, not a nation-state intelligence operation.

Reference:
CompTIA Security+ SY0-701 Objective 1.5: "Explain different threat actor models and attributes." This objective requires understanding the motivations and characteristics of different threat actors. Organized crime is explicitly defined by its financial motivation and increasingly sophisticated, business-like operations, such as Ransomware-as-a-Service (RaaS).

Explanation: Software as a Service (SaaS) is the cloud model that best meets the goal of outsourcing the management, including patching, of firmware, operating systems, and applications to the cloud vendor. In a SaaS environment, the cloud provider is responsible for maintaining and updating the entire software stack, allowing the organization to focus on using the software rather than managing its infrastructure.

Explanation:
A File Integrity Monitoring (FIM) tool alerts when a system file has been altered, which is a significant event, especially for a critical system file like cmd.exe.

D. A rootkit was deployed is correct.
A rootkit is a type of malware designed to gain privileged access to a system while actively hiding its presence. A common technique for maintaining persistence and avoiding detection is to replace or modify core system files (like cmd.exe) with malicious versions. The fact that no patches were applied rules out a legitimate change from an OS update, making unauthorized modification by a rootkit the most likely cause of the altered hash.

A. The end user changed the file permissions is incorrect.
Changing file permissions (e.g., read, write, execute) does not alter the actual contents of the file. The FIM tool is alerting that the hash has changed, which means the binary data of the file itself is different. Permissions are metadata, not file content.

B. A cryptographic collision was detected is incorrect.
A cryptographic collision occurs when two different inputs produce the same hash output. While theoretically possible with older algorithms like MD5, it is computationally infeasible with modern hashing algorithms (like SHA-256) used by FIM tools. This is an extremely unlikely event and would not be the assumed cause without evidence.

C. A snapshot of the file system was taken is incorrect.
Taking a snapshot (a point-in-time copy of a filesystem) is a read-only operation. It does not modify the original file or change its hash.

Reference:
CompTIA Security+ SY0-701 Objective 1.4: "Given a scenario, analyze indicators of malicious activity." The alteration of a core OS file is a primary indicator of compromise (IOC), often associated with malware like rootkits that attempt to hide their activity by subverting the operating system.

Explanation:

C) Subject is the correct answer.
In data protection and privacy contexts, the data subject is the individual whose personal data is being collected, processed, or stored. In this scenario, the customer is the data subject because their sensitive data is being handled by the company.

Why the others are incorrect:

A) Processor:
A data processor is an entity that processes data on behalf of the data controller. Here, the marketing department (or the company) acts as the processor or controller, not the customer.

B) Custodian:
The data custodian (or steward) is responsible for the technical handling and security of the data, such as the infrastructure team securing data in transit and at rest.

D) Owner:
The data owner is typically the entity (or individual) that determines the purposes and means of processing the data. In this case, the company (or its marketing department) is the data owner, not the customer.

Reference:
This question tests knowledge of Domain 5.1: Explain the importance of data protection and data roles defined in frameworks like GDPR. Understanding the distinctions between data subject, controller, processor, and custodian is essential for compliance and security responsibilities, as covered in the SY0-701 objectives.

Explanation:
The scenario describes a system that is monitoring for the transmission of specific, sensitive files (identified via fingerprinting) and will generate an alert if those files are attempted to be emailed externally. This is a classic function of Data Loss Prevention (DLP) software.

A. DLP (Data Loss Prevention) (Correct):
DLP tools are designed to detect and prevent the unauthorized exfiltration or transmission of sensitive data. They work by:

Fingerprinting/Fingerprinting Files:
Creating a unique digital signature (a "fingerprint") for sensitive files.

Content Awareness:
Inspecting content in motion (e.g., network traffic like email), at rest (e.g., on file servers), and in use (e.g., on endpoints).

Policy Enforcement:
Generating alerts, blocking emails, or taking other actions based on predefined policies (e.g., "block any outbound email containing a file that matches the fingerprint of our proprietary design documents").

Why the other options are incorrect:

B. SNMP traps (Incorrect):
SNMP (Simple Network Management Protocol) traps are messages sent from network devices (like routers or switches) to a central monitoring system to alert about specific events or conditions (e.g., a port going down, high CPU usage). They are used for network performance and fault monitoring, not for inspecting email content for sensitive data.

C. SCAP (Incorrect):
SCAP (Security Content Automation Protocol) is a suite of standards used to automate vulnerability management, measurement, and policy compliance (e.g., checking if systems are configured according to a security baseline like DISA STIGs). It is not used for monitoring outbound email traffic for specific files.

D. IPS (Incorrect):
An Intrusion Prevention System (IPS) is a network security tool that monitors network traffic for signatures of known attacks or patterns of malicious behavior (e.g., exploit attempts, malware communication). Its primary focus is on stopping threats coming into the network or moving laterally, not on preventing sensitive data from leaving the network. While some next-generation IPS systems may have DLP features, the core function described is the specialty of a dedicated DLP solution.

Reference:
This question falls under Domain 2.0: Threats, Vulnerabilities, and Mitigations and Domain 4.0: Security Operations. It specifically tests knowledge of data security controls, with DLP being the primary technology for preventing data exfiltration.

Explanation: A Service Level Agreement (SLA) is a formal document between a service provider and a client that defines the expected level of service, including what resources will be provided and the agreed-upon time frames. It typically includes metrics to evaluate performance, uptime guarantees, and response times. MOU (Memorandum of Understanding) and MOA (Memorandum of Agreement) are less formal and may not specify the exact level of service. BPA (Business Partners Agreement) focuses more on the long-term relationship between partners.

Explanation:
An Acceptable Use Policy (AUP) is a managerial control. Managerial controls are high-level policies, plans, and guidelines that form the foundation of an organization's security program. They are focused on governance and defining rules for behavior. The AUP is a policy document that outlines the rules and guidelines for the appropriate use of an organization's IT resources, making it a classic example of a managerial control.

Why the other options are incorrect:

A. Physical:
Physical controls are tangible measures to protect facilities and hardware (e.g., locks, security guards, fences). An AUP is a document, not a physical barrier.

C. Technical:
Technical controls (also called logical controls) are implemented through technology (e.g., firewalls, encryption, access control lists). While technical controls may enforce aspects of the AUP (e.g., blocking unauthorized websites), the AUP itself is a policy, not a technical tool.

D. Operational:
Operational controls are day-to-day procedures and practices executed by people (e.g., user access reviews, backup procedures, incident response). The AUP sets the rules, but the operational controls are the actions taken to implement and enforce those rules.

Reference:
This question tests the understanding of security control types and their examples.

This falls under Domain 5.6: Explain the importance of using appropriate security controls of the CompTIA Security+ SY0-701 exam objectives.

The classification of controls into managerial, operational, and technical (with physical as a subset) is a standard model in frameworks like NIST SP 800-53 (Security and Privacy Controls for Information Systems and Organizations). Policies like the AUP are clearly defined as managerial controls that guide the implementation of operational and technical controls.

Explanation:
Critical data refers to information that is essential for the immediate operation and survival of an organization. The loss of critical data (e.g., core financial records, key operational data, intellectual property) would have the most severe impact, potentially causing significant financial harm, operational disruption, or even business failure. This category is defined by the impact of loss rather than just sensitivity or confidentiality.

Why the other options are incorrect:

A. Confidential:
Confidential data requires protection from unauthorized access (e.g., trade secrets, PII), but its loss might not always be immediately catastrophic if backups exist. The impact depends on the context—some confidential data may also be critical, but "critical" specifically denotes the highest level of operational impact.

B. Public:
Public data is intentionally made available to everyone (e.g., marketing materials). Its loss would have minimal to no impact, as it can easily be reproduced or redistributed.

C. Private:
This is often used interchangeably with "confidential" (e.g., private data = PII). Like confidential data, it is sensitive but may not always be critical to immediate operations.

Reference:
This question tests understanding of data classification based on impact.

This falls under Domain 5.5: Explain the importance of compliance with applicable regulations, standards, or frameworks and general risk management concepts in the SY0-701 exam objectives.

Data classification schemes (e.g., NIST FIPS 199) define categories based on the impact of loss (e.g., low, moderate, high). "Critical" aligns with high-impact data where loss could result in severe operational, financial, or reputational damage. Organizations prioritize protecting critical data above all else.

Explanation:

Why B is Correct:
The Common Vulnerability Scoring System (CVSS) provides a standardized method for rating the severity of security vulnerabilities. It generates a numerical score (from 0.0 to 10.0) that reflects the characteristics and potential impact of a vulnerability (e.g., exploitability, impact on confidentiality, integrity, and availability). A security director can use these scores to prioritize patching efforts, focusing resources on remediating the most severe vulnerabilities (those with the highest CVSS scores) first. This is a fundamental practice in vulnerability management.

Why A is Incorrect:
SOAR (Security Orchestration, Automation, and Response) is a platform that helps automate and streamline security operations workflows (e.g., incident response, vulnerability management). While a SOAR platform can automate the prioritization process by ingesting CVSS scores and other data, the platform itself is not the scoring framework used to determine priority. It uses tools like CVSS to make decisions.

Why C is Incorrect:
A SIEM (Security Information and Event Management) system aggregates and correlates log data to identify potential security incidents. It is crucial for detection and monitoring but is not a scoring system used to assign a severity rating to a software vulnerability for patching prioritization.

Why D is Incorrect:
CVE (Common Vulnerabilities and Exposures) is a list of common identifiers for publicly known cybersecurity vulnerabilities. A CVE entry gives a vulnerability a standard name and number (e.g., CVE-2024-12345) but does not provide a severity score. The CVSS score is often provided alongside a CVE ID to quantify its severity.

Reference:
This question falls under Domain 4.0: Operations and Incident Response, specifically covering vulnerability management processes. Understanding the roles of CVE (identification) and CVSS (scoring/prioritization) is essential for the SY0-701 exam.