Free SY0-701 Practice Test Questions 2026

Explanation:

B) Infrastructure as code (IaC) is the correct answer.
IaC is a key practice in cloud computing that allows systems administrators to define and manage infrastructure (e.g., virtual machines, networks, storage) using machine-readable configuration files (e.g., YAML, JSON) rather than manual processes. This enables:

Easy deployment:
Resources can be provisioned consistently and rapidly through automated scripts.

Version control:
Infrastructure configurations can be tracked, reviewed, and rolled back like code.

Reproducibility:
Environments (e.g., development, testing, production) can be replicated exactly.

Scalability:
Changes can be applied across the infrastructure with minimal effort.

Why the others are incorrect:

A) Software as a service (SaaS):
This is a cloud service model where applications are hosted and managed by a third party (e.g., email, CRM). It does not help in deploying or managing underlying infrastructure resources.

C) Internet of Things (IoT):
Refers to interconnected devices collecting and exchanging data. It is unrelated to cloud resource deployment.

D) Software-defined networking (SDN):
This is an approach to network management that simplifies configuration and operation through programmability. While useful in cloud environments, it is specific to networking and not the broader scope of resource deployment (e.g., compute, storage)

Reference:
This question tests knowledge of Domain 2.2: Summarize virtualization and cloud computing concepts. Infrastructure as code (IaC) is a fundamental DevOps practice for automating cloud deployments, as emphasized in the SY0-701 objectives. Tools like Terraform, AWS CloudFormation, or Azure Resource Manager exemplify IaC.

Explanation:
The core security issue described is password fatigue and weak password management caused by employees managing multiple, separate sets of credentials (usernames and passwords) with different complexity rules for each SaaS application. This leads to users writing down passwords, reusing them, or creating weak ones to meet varying requirements.

Integrating each SaaS solution with the Identity Provider (IdP) via a standard like SAML (Security Assertion Markup Language) or OpenID Connect (OIDC) resolves this. This implementation of Single Sign-On (SSO) allows employees to use a single, strong set of corporate credentials (enforced by a unified complexity policy) to access all integrated applications. The identity provider handles authentication, eliminating the need for separate logins and passwords for each SaaS solution.

Why the others are incorrect:

A) Creating a unified password complexity standard:
While this is a good practice, it does not solve the problem of having separate logins. Employees would still have to create and remember a unique, complex password for every single SaaS application, which is the root cause of the issue.

C) Securing access to each SaaS by using a single wildcard certificate:
Certificates are used for encrypting traffic (TLS/SSL) and authenticating servers, not users. A wildcard certificate might secure the connections to various subdomains but does nothing to simplify or secure user authentication and password management.

D) Configuring geofencing on each SaaS solution:
Geofencing restricts access based on geographic location. It is a useful access control for preventing unauthorized logins from strange locations, but it does not address the fundamental problem of credential management and multiple passwords.

Reference:
This aligns with SY0-701 Objective 3.3 ("Given a scenario, implement secure identity and access management"). The solution describes implementing Federated Identity Management, a key concept where an identity provider (like Azure AD or Okta) is used to manage authentication across multiple systems, greatly improving security and user experience.

Explanation:

Why D is Correct:
An invoice scam is a specific type of business email compromise (BEC) where a threat actor sends a fraudulent invoice for goods or services that were never rendered, hoping that an employee will process the payment without proper verification. The key indicators in this scenario are: The email contains a demand for payment.

The vendor is unknown and "not in the vendor management database."

This is a classic social engineering attack that preys on the routine processes of accounting departments, relying on haste or a lack of rigorous verification to succeed.

Why A is Incorrect:
Pretexting is a broader social engineering technique where an attacker creates a fabricated scenario (a pretext) to steal information. For example, an attacker might pretend to be from IT support to trick an employee into revealing their password. While an invoice scam might use a pretext (the false pretext of being a legitimate vendor), the specific attack described is more precisely defined as an invoice scam.

Why B is Incorrect:
Impersonation is a technique used within many types of attacks, including this one. The attacker is impersonating a vendor. However, "impersonation" is too general a term. It describes the method of the attack (spoofing an identity), but not the specific goal or type of attack, which is financial fraud via a fake invoice.

Why C is Incorrect:
Ransomware is a type of malware that encrypts files and demands a ransom payment to decrypt them. This scenario describes a phishing email with a fraudulent payment demand, not a malware infection that holds data hostage. There is no indication of system encryption or a ransom note.

Reference:
This question falls under Domain 1.0: Threats, Attacks, and Vulnerabilities. It tests the ability to identify different types of social engineering attacks and business email compromises (BEC), specifically invoice scams, which are a common threat vector targeting financial departments.

Explanation:
The correct answer is A. Mitigate.

The scenario describes a legacy application that is critical to business operations but lacks preventative controls. This presents a clear risk.

Mitigation is the risk management strategy that involves implementing controls to reduce either the likelihood or the impact of a risk.

The question explicitly states that there are preventative controls "not yet implemented." The most logical and proactive strategy is to implement those controls to reduce the vulnerability of the critical system. This directly addresses the risk by strengthening the system's defenses.

Mitigation is often the preferred strategy for critical systems because it actively reduces the risk to an acceptable level, allowing the business to continue using the essential application without undue danger.

Why the other options are incorrect:

B. Accept:
Acceptance means understanding the risk and consciously deciding to take no action because the cost of addressing the risk outweighs the potential loss. For a critical application with known, unimplemented controls, simply accepting the risk would be negligent. The business would be knowingly leaving a vital asset unprotected.

C. Transfer:
Transfer shifts the financial burden of a risk to a third party, typically through insurance or outsourcing. While you could purchase cyber insurance (transfer), it does not reduce the technical vulnerability of the application itself. The system would still be unprotected, and a successful attack would disrupt critical operations even if insurance covered the financial cost. Insurance is a form of financial mitigation for impact, but the question focuses on the lack of preventative controls, making technical mitigation the primary and most direct strategy.

D. Avoid:
Avoidance involves eliminating the risk entirely by discontinuing the risky activity. For a critical legacy application, avoidance is likely not a viable option. Avoiding the risk would mean shutting down the application, which would directly halt business operations. This strategy is used for risks with extreme consequences, but it is not practical when the system is essential to the business.

Reference:
This question tests the understanding of the four core risk response strategies, a fundamental concept in risk management covered in the CompTIA Security+ SY0-701 objectives under Domain 5.4: Explain the importance of policies to organizational security.

The decision of which strategy to use is based on factors like criticality of the asset and feasibility of controls. For a critical asset with available controls that are not yet implemented, mitigation is the most responsible and effective first course of action.

Explanation:
Automation is the best way to consistently determine on a daily basis if security settings have been modified. This is because:

Consistency and Frequency:
Automated tools can be scheduled to run scans and checks every day without fatigue, error, or deviation from the procedure.

Speed and Scale:
Automation can check hundreds or thousands of servers rapidly, a task that is infeasible to perform manually on a daily basis.

Immediate Alerting:
Automated systems can be configured to immediately alert the security team upon detecting any change, enabling a rapid response.

Baseline Comparison:
Tools like Security Content Automation Protocol (SCAP) scanners or configuration management tools can automatically compare current server settings against a hardened security baseline.

Why not B?
Compliance checklist: A checklist is a valuable tool for guiding a manual process, but it is not automated. Having a human run through a checklist for all servers daily is not scalable, consistent, or efficient.

Why not C?
Attestation: Attestation is a process where a system owner or administrator formally confirms (attests) that a system is compliant. This is a manual, periodic process (e.g., quarterly or annually), not a daily automated check for modifications.

Why not D?
Manual audit: A manual audit is a resource-intensive, slow, and error-prone process. It is impossible to perform a comprehensive manual audit of all servers on a daily basis. Manual audits are typically conducted periodically (e.g., annually).

Reference:
Domain 5.3: "Explain the importance of policies to organizational security." This domain covers the implementation of security policies. Automation is a key tool for enforcing and monitoring compliance with these policies (like configuration baselines) continuously, which is a core requirement of modern security frameworks.

Explanation: HTTP headers can be used to mitigate risks associated with Cross-Site Scripting (XSS). Security-related HTTP headers such as Content Security Policy (CSP) and X-XSS-Protection can be configured to prevent the execution of malicious scripts in the context of a web page. XSS (Cross-Site Scripting): A vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. HTTP headers like CSP help prevent XSS attacks by specifying which dynamic resources are allowed to load. SQLi (SQL Injection): Typically mitigated by using parameterized queries and input validation, not HTTP headers. DoS (Denial of Service): Mitigated by network and application-level defenses rather than HTTP headers. SSL (Secure Sockets Layer): Refers to securing communications and is not directly mitigated by HTTP headers; rather, it's implemented using SSL/TLS protocols.

Explanation:
Data Loss Prevention (DLP) is the solution specifically designed to address the risk of data exfiltration. DLP systems monitor, detect, and block sensitive data while it is in use (on an endpoint), in motion (over the network), or at rest (in storage). After a data classification initiative has identified what constitutes "sensitive data," DLP tools can be configured with policies to look for that classified data and prevent it from leaving the organization's environment. This directly mitigates the risk of sensitive data being exfiltrated by either malicious actors or through accidental leakage by employees.

Why the Other Options are Incorrect:

A. XDR (Extended Detection and Response):
XDR is a comprehensive security platform that collects and correlates data from multiple sources (email, endpoints, servers, cloud workloads, etc.) to improve threat detection, investigation, and response. While it could potentially detect exfiltration activity as part of a broader attack, its primary focus is on threat hunting and incident response, not proactively preventing the specific act of sensitive data from being sent out. DLP is the dedicated tool for that mitigation.

B. SPF (Sender Policy Framework):
SPF is an email authentication protocol designed to detect email spoofing. It allows a domain owner to specify which mail servers are authorized to send email on behalf of their domain. This helps prevent phishing but does nothing to scan the content of outbound emails for sensitive data or prevent its exfiltration.

D. DMARC (Domain-based Message Authentication, Reporting & Conformance):
DMARC builds on SPF and DKIM (another email authentication method) to give domain owners control over how receiving mail servers should handle emails that fail authentication checks (e.g., quarantine or reject them). Like SPF, its purpose is to protect against domain spoofing and phishing, not to inspect and block the transmission of sensitive data within emails.

Reference:
This question falls under CompTIA SY0-701 Objective 3.3: "Given a scenario, implement secure network designs." DLP is a core network security control for enforcing data handling policies and is a direct mitigation for exfiltration risks identified through data classification, which is covered in Objective 5.3: "Explain the importance of data privacy and protection."

Explanation:
The Common Vulnerability Scoring System (CVSS) is an open framework specifically designed for assessing the severity of software vulnerabilities and providing a numerical score (ranging from 0.0 to 10.0) representing their criticality. This quantitative score is calculated based on metrics that evaluate exploitability (e.g., attack vector, complexity), impact (on confidentiality, integrity, and availability), and in later versions, temporal and environmental factors. Security teams use these scores to prioritize remediation efforts, focusing on the most critical vulnerabilities first.

Analysis of Incorrect Options:

A. CVE (Common Vulnerabilities and Exposures):
A CVE is a standardized identifier (e.g., CVE-2024-12345) for a specific vulnerability. It provides a common name and a brief description but does not include a measure of its severity. The CVE system and the CVSS scoring system are often used together, but they serve different purposes: CVE identifies, while CVSS scores.

C. CIA (Confidentiality, Integrity, Availability):
Known as the CIA Triad, this is the fundamental model of information security. It represents the core goals of security programs—protecting data from unauthorized access (confidentiality), unauthorized modification (integrity), and ensuring authorized access (availability). While the "Impact" metrics in a CVSS score are based on the CIA triad, the triad itself is a conceptual model, not a measurement tool.

D. CERT (Computer Emergency Response Team):
A CERT (or CSIRT) is an organization or team that responds to cybersecurity incidents. They may publish advisories about vulnerabilities, which often include CVSS scores, but the team itself is not the scoring framework.

Reference:
This question falls under Domain 2.0: Threats, Vulnerabilities, and Mitigations, specifically objective 2.4: Given a scenario, analyze indicators of malicious activity. Part of this analysis involves understanding vulnerability scans and the tools used to prioritize their results. CVSS is the industry standard for quantitatively measuring vulnerability criticality.

Explanation:
Encryption is the primary method used to protect data at rest by using cryptographic algorithms and a key to transform plaintext data into unreadable ciphertext. Only authorized parties with the correct decryption key can revert the ciphertext back to its original, readable form. This directly fulfills the requirement to render sensitive data "unreadable."

Why not A?
Hashing is a one-way function that generates a unique fixed-size string (a hash) from data. It is primarily used for verifying data integrity (ensuring data has not been altered) and storing passwords. It is not reversible, so hashed data cannot be rendered readable again, making it unsuitable for protecting data that needs to be retrieved and used in its original form.

Why not B?
Tokenization is the process of replacing sensitive data with a non-sensitive equivalent, called a token, which has no exploitable value. The token can be mapped back to the original data only through a secure tokenization system. While it does protect data at rest, it is more specialized and often used for specific use cases like protecting credit card numbers (PCI DSS compliance). Encryption is a more universal and directly applicable solution for rendering general sensitive data unreadable at rest.

Why not D?
Segmentation (or network segmentation) is a network security architecture that divides a network into smaller subnetworks. This is used to control traffic flow, isolate breaches, and reduce the attack surface. It protects data in transit across networks or in use by controlling access, but it does not directly render the data itself unreadable on the storage medium.

Reference:
Domain 2.4: Encryption. The SY0-701 objectives specifically list encryption as the technology for ensuring the confidentiality of data at rest, in motion, and in use.

Explanation:
DLP (Data Loss Prevention) is a security solution specifically designed to detect and prevent the unauthorized transmission or exfiltration of sensitive data, such as Personally Identifiable Information (PII).

In this scenario:
DLP tools are configured with policies that can identify PII (e.g., Social Security numbers, credit card numbers, customer IDs) within files and emails. When an employee attempts to email a file containing PII, the DLP system can detect the sensitive content based on these policies.

Depending on its configuration, it can then block the email, quarantine it, or send an alert to security personnel, thereby preventing accidental data leakage.

This makes DLP the ideal tool for addressing the exact situation described.

Why the other options are incorrect:

A. SCAP (Security Content Automation Protocol):
SCAP is a framework of open standards used for automating vulnerability management, measurement, and policy compliance evaluation (e.g., checking system configurations against benchmarks). It is not designed to monitor data in motion (like emails) or detect sensitive content.

B. NetFlow:
NetFlow is a network protocol developed by Cisco for collecting IP traffic information and monitoring network traffic flow. It is useful for bandwidth monitoring, traffic analysis, and anomaly detection but cannot inspect the content of emails or files for sensitive data like PII.

C. Antivirus:
Antivirus software is designed to detect, prevent, and remove malware (e.g., viruses, worms, trojans). It focuses on malicious code rather than the accidental leakage of sensitive data. It would not typically flag an email containing PII unless that data was part of a known malware signature.

Exam Objective Reference:
This question relates to Domain 5.0: Governance, Risk, and Compliance, specifically the implementation of data security controls like DLP to protect sensitive information (e.g., PII) and ensure compliance with privacy regulations. It also touches on Domain 4.0: Operations and Incident Response regarding monitoring for data exfiltration.

Explanation:
The question asks for the best method to detect fraud by specifically assigning employees to different roles. This is a key distinction.

D. Job rotation is correct.
Job rotation is the practice of moving employees between different roles or duties over time. This strategy helps detect fraud because a new person in a role is likely to review existing processes and uncover any irregularities or suspicious activities left by the previous employee. It acts as a detective control by bringing a fresh set of eyes to a position.

A. Least privilege is incorrect.
Least privilege is the principle of giving users only the access absolutely necessary to perform their job functions. It is an excellent preventive control that can reduce the opportunity for fraud by limiting what users can do, but it does not inherently involve assigning them to different roles to detect existing fraud.

B. Mandatory vacation is incorrect.
Mandatory vacation requires employees to take time off, allowing another person to perform their duties. Like job rotation, this can help detect fraud because the substitute may discover discrepancies. However, it is a temporary measure (a week or two), whereas job rotation is a more permanent or long-term reassignment to a new role. The question specifically says "assigning employees to different roles," which describes job rotation more accurately.

C. Separation of duties (SoD) is incorrect.
SoD is a preventive control that splits critical tasks among multiple people so that no single individual has complete control over a process. This prevents fraud by requiring collusion to commit it. It is designed to prevent fraud from occurring in the first place, not to detect it after the fact by moving people to new roles.

Reference:
CompTIA Security+ SY0-701 Objective 5.1: "Explain the importance of personnel policies." Both job rotation and mandatory vacation are listed as important security policies. Job rotation is explicitly noted for its benefits in cross-training and fraud detection, as it reduces the risk of collusion and helps uncover malicious activities when responsibilities change hands.

Explanation:
Unidentified removable devices (such as USB drives, external hard drives, or other portable storage) are a common and effective tool for insider threats attempting data exfiltration. Insiders with physical access to systems can easily connect these devices to copy and steal data quickly and discreetly, often bypassing network-based monitoring tools. This method is particularly dangerous because it is direct, hard to detect in real-time, and does not require external communication that might trigger security alerts.

Why the other options are incorrect:

B. Default network device credentials:
While default credentials are a risk, they are typically exploited by external attackers who gain initial access to networks or devices. Insiders usually already have authorized access and credentials, making this less relevant for them. Insiders do not need to rely on default passwords; they often use their own legitimate access.

C. Spear phishing emails:
This is primarily an external attack vector used to trick employees into revealing credentials or installing malware. While an insider might fall for phishing, it is not their typical method for exfiltration—they already have access and would not need to phish themselves. Spear phishing is more commonly associated with external threat actors.

D. Impersonation of business units through typosquatting:
Typosquatting involves registering domain names similar to legitimate ones to deceive users. This is again an external tactic used for phishing or distributing malware. Insiders do not need to impersonate business units externally; they are already inside the organization and can access data directly.

Reference:
This question tests knowledge of insider threats and their common tactics.

This falls under Domain 1.5: Explain different threat actor types and attributes and Domain 3.1: Given a scenario, implement security configuration techniques on enterprise assets of the CompTIA Security+ SY0-701 exam objectives.

Mitigating insider threats often involves controls like device control policies (blocking unauthorized removable media), data loss prevention (DLP) tools, and monitoring of user activity, as recommended by frameworks such as NIST SP 800-53 (Security and Privacy Controls) and CIS Controls. The use of removable media for data theft is a well-documented insider threat tactic.