Free SY0-701 Practice Test Questions 2026

Explanation:
An Acceptable Use Policy (AUP) is a document that outlines the rules and guidelines for the appropriate use of an organization's information technology resources, including systems, software, networks, and data. It communicates the responsibilities of employees and other users, specifying what is and is not allowed regarding system operation, software installation, internet usage, and data handling. This directly aligns with conveying responsibilities for the general operation of systems and software.

Why the others are incorrect:

A) Business continuity plan:
This focuses on maintaining or resuming business operations during and after a disruption (e.g., disaster recovery). It does not address day-to-day responsibilities for system and software operation.

B) Change management procedure:
This is a process for managing changes to systems or software in a controlled manner to minimize risks. It is procedural and technical, not focused on communicating general user responsibilities.

D) Software development life cycle policy:
This governs how software is designed, developed, tested, and deployed. It is aimed at developers and IT staff, not general users, and does not cover broader system operation expectations.

Reference:
This aligns with SY0-701 Objective 5.5 ("Explain the importance of policies to organizational security"). The Acceptable Use Policy (AUP) is a foundational document that sets expectations for users' behavior and responsibilities, as emphasized in security frameworks and best practices for governance.

Explanation:
The script described validates the OS version, patch levels, and installed applications during user logon. This is a classic example of baseline enforcement. A security baseline defines the minimum required configuration standards for systems (e.g., specific OS versions, approved patches, allowed applications). By running this script at logon, the organization ensures that devices comply with these standards before granting access, maintaining a secure and consistent environment.

Analysis of Incorrect Options:

A. Resource scaling:
This refers to dynamically allocating computing resources (e.g., CPU, memory) based on demand. The script checks configuration compliance, not resource usage.

B. Policy enumeration:
Enumeration involves listing or discovering policies, not enforcing them. The script actively validates and enforces compliance.

D. Guardrails implementation:
Guardrails are broader governance controls (often in cloud environments) that prevent deviations from best practices. The script is a specific technical control for endpoint compliance, not a overarching guardrail.

Reference:
This falls under Domain 3.0: Security Architecture, specifically configuration management and endpoint security. Baseline enforcement is a key practice in frameworks like NIST SP 800-53 (CM-2: Baseline Configuration) and CIS Benchmarks, ensuring systems meet security standards before accessing network resources.

Explanation:
Host isolation is a direct and immediate action taken to completely remove a device from the network. This can be done manually by an administrator or automatically by a security system (like EDR or NAC). Once isolated, the device cannot communicate with any other network-connected resources, effectively containing a threat and preventing lateral movement. This is the most effective method to ensure a device is inaccessible.

Why the others are incorrect:

A) Disablement of unused services:
This is a critical security hardening practice that reduces the attack surface of a device. However, it does not make the device itself inaccessible to the network. The device can still be reached on its enabled services and can still initiate connections to other resources.

B) Web application firewall (WAF):
A WAF is designed to protect a specific web application by filtering and monitoring HTTP traffic between the web app and the internet. It is not used to control general network access for an entire device or to make a host inaccessible.

D) Network-based IDS (NIDS):
A NIDS monitors network traffic for suspicious activity and generates alerts. Its primary function is detection and monitoring, not enforcement or access control. It cannot actively make a device inaccessible to the network; it can only report on the malicious traffic it sees.

Reference:
This aligns with SY0-701 Objective 4.4 ("Given an incident, apply mitigation techniques or controls to secure an environment"). A key step in the containment phase of incident response is isolation or segmentation of affected systems to prevent the threat from spreading, which is precisely what host isolation achieves.

Smishing is a type of phishing attack that uses SMS text messages to deceive recipients into taking actions such as revealing sensitive information. The urgency in the text indicates this vector.

Explanation:
User provisioning script (D) is the correct answer. This is a script or automated process that handles the creation, modification, and deletion of user accounts across systems and applications. By automating account creation, the script ensures that every new account is set up consistently according to predefined rules and templates (e.g., based on the user's role, department, or other attributes). This eliminates human error and ensures that correct access rights and permissions are assigned every time, directly addressing the management team's concern.

Why the others are incorrect:

A) Guard rail script:
This is not a standard term in IT automation. "Guardrails" typically refer to policies or controls that prevent actions outside defined boundaries (e.g., in cloud environments). It is not directly related to automating the account creation process.

B) Ticketing workflow:
A ticketing workflow is a process for managing requests (like a ticket for a new user account) through stages such as submission, approval, and fulfillment. While it can help organize and track requests, it does not itself automate the technical steps of creating the account and assigning permissions. It often still requires manual intervention by an administrator.

C) Escalation script:
An escalation script is used to automatically elevate issues or alerts to higher-level support or management based on specific conditions (e.g., if a critical ticket is not resolved within a set time). It is related to incident or service management, not to the automation of user account provisioning.

Reference:
This question tests knowledge of Domain 5.5: Explain the importance of physical security controls and Domain 5.3: Explain the importance of policies to organizational security, but more directly, it aligns with Identity and Access Management best practices. Automated user provisioning is a key principle of Identity Lifecycle Management and is often part of larger solutions like Identity as a Service (IDaaS) or directory services, ensuring accuracy and compliance in access control.

Explanation:
The correct answer is C. Standard operating procedure (SOP).

A Standard Operating Procedure (SOP) is a detailed, step-by-step set of instructions compiled by an organization to help workers carry out complex routine operations. Its primary purpose is to ensure consistency, efficiency, and quality of output, while also ensuring compliance with industry regulations and internal policies, such as a secure baseline.

In the context of applying a patch update:
A secure baseline defines the required security state of a system (e.g., specific configuration settings, approved software versions).

An SOP for patch management would provide the exact, standardized steps to update a system without deviating from that baseline. This would include steps like:

Downloading patches only from approved vendor sources.

Verifying patch hashes for integrity.

Testing the patch in a staging environment first.

Applying the patch using specific commands or tools that do not alter other secure configurations.

Validating the system post-patch to confirm it still meets the baseline security requirements.

By following the SOP, the administrator ensures the patch is applied in a consistent, repeatable, and secure manner that maintains the system's compliance with its defined baseline.

Why the other options are incorrect:

A. Information security policy:
This is a high-level management document that outlines the organization's overall security goals, vision, and responsibilities. It defines what needs to be protected and why, but it does not provide the specific, step-by-step how-to instructions for a technical task like applying a patch. The policy might mandate that systems must adhere to a secure baseline, but the SOP is the document that operationalizes that mandate.

B. Service-level expectations (SLE) / Service-level agreement (SLA):
These are agreements between a service provider and a customer that define the expected level of service, often measured by metrics like uptime, performance, and response time. While an SLA might require the system to be kept patched and secure, it is a business agreement, not a technical guide for an administrator to follow during an update.

D. Test result report:
This is an output from a process, not a guide for performing the process. A test result report from a staging environment would be used to inform the decision of whether a patch is safe to deploy (i.e., it doesn't break applications or violate the baseline). However, the administrator uses the SOP to know how to conduct that test and how to proceed with the deployment based on the report's results.

Reference:
This distinction between policy, standard, procedure, and guideline is a core concept in security governance. It is often represented in a hierarchy:

Policy (High-level, "what" and "why")

Standard (Mandatory technical requirements, like the secure baseline itself)

Procedure (Step-by-step "how-to" instructions - this is the SOP)

Guideline (Non-mandatory best practices)

The CompTIA Security+ SY0-701 exam objectives explicitly cover these concepts under Domain 5.1: "Explain the importance of compliance with applicable laws, regulations, policies, and procedures." Using an SOP to ensure consistent and compliant operational work is a key part of this.

Explanation:
Authorization is the process of granting or denying access to specific resources or actions after a user has been authenticated (i.e., after they have logged in and proven their identity). It determines what an authenticated user is allowed to do, such as accessing files, running applications, or modifying data. This aligns directly with the scenario of granting access post-login.

Why the others are incorrect:

B. Identification:
This is the initial step where a user claims an identity (e.g., by providing a username). It occurs before logging in and does not involve granting access.

C. Non-repudiation:
This ensures that a user cannot deny having performed an action (e.g., through digital signatures or audit logs). It is unrelated to granting access after login.

D. Authentication:
This is the process of verifying a user's identity (e.g., via password, biometrics) during login. It occurs before authorization and does not itself grant access to resources.

Reference:
This aligns with SY0-701 Objective 3.3 ("Given a scenario, implement secure identity and access management"). The concepts of authentication (verifying identity) and authorization (granting permissions) are fundamental to access control, as defined in frameworks like NIST SP 800-53 (Security and Privacy Controls for Information Systems and Organizations).

Explanation:
Pass-the-hash (PtH) is an attack where a threat actor steals the hashed version of a user's password (NTLM hash) and uses it to authenticate to other systems without needing to decrypt it to the plaintext password. This attack is particularly effective against privileged accounts, like domain administrators, because it bypasses standard password defenses.

A Privileged Access Management (PAM) solution is specifically designed to mitigate such attacks. It works by:

Isolating privileged credentials in a secure vault.

Enforcing just-in-time (JIT) access, where privileges are granted only for specific tasks and short periods.

Rotating passwords automatically after each use, making stolen hashes useless.

Monitoring and auditing all privileged sessions.

This strategy directly prevents the misuse of domain admin accounts even if a hash is stolen.

Why the others are incorrect:

A) Audit each domain administrator account weekly for password compliance:
While auditing is good practice, it is reactive. It might catch non-compliant passwords but does nothing to prevent the use of a stolen hash in real-time. PtH attacks do not require knowledge of the plaintext password.

C) Create IDS policies to monitor domain controller access:
An Intrusion Detection System (IDS) can detect suspicious access attempts but cannot prevent the attack from occurring. It is a monitoring tool, not a preventive control.

D) Use Group Policy to enforce password expiration:
Regularly expiring passwords is a general hygiene practice, but it is ineffective against PtH attacks. If a hash is stolen, it can be used immediately before the password expires. Furthermore, frequent password changes can lead to weaker passwords and are not recommended by modern security guidelines (e.g., NIST).

Reference:
This aligns with SY0-701 Objective 3.3 ("Given a scenario, implement secure identity and access management"). Mitigating pass-the-hash attacks is a key security goal, and Privileged Access Management (PAM) is the industry-standard solution, as outlined in frameworks like Microsoft's "Mitigating Pass-the-Hash Attacks" and other best practices for protecting privileged accounts.

Explanation
The scenario describes a program designed to change employee behavior by applying game-like elements to a serious security topic.

Why D. Gamification is the Correct Answer
Gamification is the application of typical elements of game playing (e.g., point scoring, competition with others, rules of play, rewards) to other areas of activity—in this case, security awareness—to encourage engagement and participation. Let's break down the scenario:

"After multiple phishing simulations":
This establishes a baseline and a recurring activity (the "game").

"announces a new program that incentivizes employees":
This is the core of gamification. An incentive (e.g., a prize, recognition, a bonus, or a points system) is introduced to reward desired behavior.

"to not click phishing links in the upcoming quarter":
This is the specific rule or goal of the "game." Employees are being challenged to achieve a perfect score or improve their performance over a defined period.

The program transforms the serious task of avoiding phishing from a passive training exercise into an active, competitive, and rewarding challenge. This technique is highly effective for improving engagement and long-term retention of security principles.

Why the Other Options Are Incorrect

A. Computer-based training

What it is:
This is a form of education where users complete interactive, often mandatory, training modules on their computers. It is a common method for delivering security awareness content.

Why it's incorrect:
The scenario does not describe a training module. It describes an incentive program built on top of the existing phishing simulations. Computer-based training is the tool used to educate employees, while gamification is the technique used to motivate them to apply that education.

B. Insider threat awareness

What it is:
This is a specific topic or subject of security awareness training. It educates employees on the risks posed by malicious or negligent insiders and how to report suspicious activity.

Why it's incorrect:
This is a distractor. While phishing is a common method used by outsiders to gain access and become an insider threat, the technique described is not "insider threat awareness." The technique is about how the training is executed (gamification), not the subject of the training (phishing).

C. SOAR playbook

What it is:
A SOAR (Security Orchestration, Automation, and Response) playbook is a predefined, automated workflow for security analysts to follow in response to a specific type of security incident (e.g., a phishing email reported by an employee).

Why it's incorrect:
A SOAR playbook is an internal tool for the security operations center (SOC), not an awareness technique for general employees. It is a technical response mechanism, not a motivational or educational program for staff.

Reference to Exam Objectives
This question aligns with the CompTIA Security+ (SY0-701) Exam Objective 5.2: Explain the importance of applicable regulations, standards, or frameworks that impact organizational security posture.

Part of a strong security posture is an effective security awareness and training program. Frameworks like NIST often recommend using innovative techniques like gamification to increase the effectiveness of training and ensure employees are engaged and retain critical information, such as how to identify phishing attempts.

Explanation
The scenario describes a multi-stage attack where the key detail is how the attacker reused credentials to move laterally without needing to know the plaintext passwords.

Why D. Pass-the-hash is the Correct Answer
Pass-the-hash (PtH) is a lateral movement technique that exploits the authentication process in Windows and other systems.

How it works:
Instead of cracking passwords to get the plaintext, attackers steal the hashed version of the password from memory (RAM) on a compromised machine. These hashes are stored to facilitate single sign-on (SSO) to other network resources.

"Without cracking these credentials":
This is the definitive clue. In a PtH attack, the attacker does not need to crack the hash to reveal the password. They can simply take the stolen hash and use it directly to authenticate to other systems (e.g., file shares, remote desktop, admin tools) as the user whose hash they stole. The system accepts the hash as proof of identity.

Matching the Scenario:

Initial Access:
Gained via phishing.

Credential Access:
The attacker "scraped the PC’s memory" to find hashed credentials.

Lateral Movement:
The attacker used the stolen hashes "without cracking" them to move to other systems.

This sequence of steps is a classic example of a Pass-the-hash attack.

Why the Other Options Are Incorrect

A. Privilege escalation

What it is:
Privilege escalation is the act of exploiting a bug, design flaw, or configuration oversight to gain elevated access to resources that are normally protected from an application or user.

Why it's incorrect:
While the attacker's ultimate goal might be to escalate privileges, the specific technique described for moving laterally is not privilege escalation. Lateral movement is about expanding access to other systems at the same privilege level. PtH is a method for achieving that movement.

B. Buffer overflow

What it is:
A buffer overflow is a software vulnerability that occurs when a program writes more data to a block of memory (a buffer) than it was allocated to hold. This can corrupt data, crash the program, or allow an attacker to execute malicious code.

Why it's incorrect:
The scenario describes a post-exploitation technique using stolen credentials. There is no mention of the attacker exploiting a software vulnerability to overwrite memory. The memory is being "scraped" or read, not overflowed.

C. SQL injection

What it is:
SQL injection (SQLi) is a web application vulnerability that allows an attacker to interfere with the queries an application makes to its database. This can be used to view, modify, or delete data they shouldn't have access to.

Why it's incorrect:
The initial compromise was via phishing, not attacking a web application. The lateral movement technique involves using stolen Windows authentication hashes from memory, not injecting SQL commands into a database query.

Reference to Exam Objectives
This question aligns with the CompTIA Security+ (SY0-701) Exam Objective 1.4: Given a scenario, analyze potential indicators to determine the type of attack.

Specifically, it tests knowledge of credential access and lateral movement techniques. Pass-the-hash is a critical attack method to understand, as it highlights why protecting credential stores in memory is essential and why simply having complex passwords is not enough if hashes can be stolen.

Explanation
The question asks for the security principle whose core tenet is to verify explicitly (validate) before granting any access, including network traffic between systems.

Why C. Zero Trust Architecture is the Correct Answer
Zero Trust is a security model founded on the principle of "never trust, always verify." It assumes that no entity—whether inside or outside the network perimeter—should be trusted by default.

"Requires validation before allowing traffic":
This is the fundamental rule of Zero Trust. Under this model, every request to access a resource (including traffic between two systems on the same network) is treated as if it originates from an untrusted source. Before any communication is allowed, the system must:

Verify Identity:
Authenticate the user and device.

Validate Permissions:
Check authorization policies to ensure the request is permitted.

Assess Device Health:
Ensure the device meets security standards (e.g., is patched, has antivirus running).

This continuous validation happens regardless of the source or destination of the traffic, making it the principle that most likely requires this strict verification step.

Why the Other Options Are Incorrect

A. Policy enforcement

What it is:
Policy enforcement is the mechanism or action of applying security rules (e.g., using a firewall to block a port). It is the result of a decision, not the principle that mandates the decision-making process itself.

Why it's incorrect:
A policy could be "allow all traffic between these two systems," which requires no validation. Zero Trust is the principle that dictates the policy should be "deny all, then validate each request before allowing it."

B. Authentication

What it is:
Authentication is the process of verifying an identity (e.g., with a username and password). It is a crucial component of validation but is only one part of it.

Why it's incorrect:
Authentication alone does not necessarily happen before allowing traffic. In traditional network security models, once a user is authenticated at the network perimeter, their internal traffic is often trusted. Zero Trust is the principle that mandates authentication (and more) is required specifically for allowing traffic.

D. Confidentiality

What it is:
Confidentiality is a goal of security—ensuring that data is not disclosed to unauthorized individuals. It is often achieved through encryption.

Why it's incorrect:
Confidentiality protects the content of traffic after it is allowed to flow. It does not dictate whether the traffic should be allowed in the first place. Zero Trust is the principle that governs the decision to permit or deny the traffic flow itself.

Reference to Exam Objectives
This question aligns with the CompTIA Security+ (SY0-701) Exam Objective 3.3: Given a scenario, implement secure network designs.

Zero Trust architecture is a modern, critical secure network design principle. The exam requires you to understand that its core implementation involves micro-segmentation and strict identity and access management, which enforce validation at every step before allowing any communication.

Explanation:

Why A. Containment is the Correct Answer
The scenario states that the security analyst "identifies an incident." This means the Detection phase is complete. The immediate priority after confirming an incident is to prevent it from causing further damage.

Containment is the next logical step. The goal of containment is to isolate the affected systems to limit the scope and impact of the incident. This can involve:

Disconnecting infected machines from the network.

Blocking malicious IP addresses at the firewall.

Disabling compromised user accounts.

Redirecting traffic away from a attacked server.

This step is crucial to stop the attacker's lateral movement, prevent further data exfiltration, and stabilize the situation before moving on to more permanent solutions.

Why the Other Options Are Incorrect

B. Detection

What it is:
Detection is the phase where indicators of a potential incident are discovered and investigated to determine if a security breach has actually occurred.

Why it's incorrect:
The question explicitly states the analyst has already "identified an incident." Therefore, the Detection phase is complete, and it is not the next step.

C. Eradication
What it is:
Eradication is the phase where the root cause of the incident is removed from the affected systems. This involves actions like:

Removing malware.

Patching vulnerabilities.

Rebuilding compromised servers from clean backups.

Why it's incorrect:
Eradication is a permanent removal of the threat. It is unsafe and illogical to attempt eradication before the threat is contained. If you try to remove malware from a system while it's still connected to the network, the attacker could still have access or could re-infect the system. Containment must come first.

D. Recovery

What it is:
Recovery is the phase where systems are restored and returned to normal operational status. This involves: Restoring data from backups.

Restarting services.
Monitoring systems to ensure they are functioning normally and the threat has not returned.

Why it's incorrect:
Recovery is one of the final steps. You cannot recover a system to a known good state until after the threat has been eradicated. Attempting recovery before eradication would likely result in immediately re-introducing the vulnerability or malware.

Reference to Exam Objectives
This question aligns with the CompTIA Security+ (SY0-701) Exam Objective 4.4: Explain the key aspects of digital forensics.

The incident response process is deeply intertwined with digital forensics. The exam requires you to know the order of operations/volatility during an investigation. Containment is a priority to prevent evidence from being destroyed or altered and to prevent further damage, making it the critical step immediately after detection and analysis.