Free SY0-701 Practice Test Questions 2026

Explanation
This question tests your knowledge of a fundamental risk management formula: the Annualized Loss Expectancy (ALE). The ALE calculates the expected monetary loss from a risk per year. It allows organizations to budget for security investments and understand the financial impact of risks over time.

The formula for ALE is:
ALE = Annualized Rate of Occurrence (ARO) × Single Loss Expectancy (SLE)

Let's break down the components using the information given in the scenario:

Single Loss Expectancy (SLE):
This is the cost of a single occurrence of the risk event.

The scenario states:
"a financial impact of $15,000."

Therefore, SLE = $15,000

Annualized Rate of Occurrence (ARO):
This is the number of times you expect the risk event to happen in a single year.

The scenario states the event is "expected to occur twice within a three-year period."

To find the ARO, you divide the number of occurrences by the number of years: 2 occurrences / 3 years = 2/3 ≈ 0.666 Therefore, ARO = 2/3

Calculate the ALE:
ALE = ARO × SLE

ALE = (2/3) × $15,000

ALE = $30,000 / 3

ALE = $10,000

Why the Other Options Are Incorrect

A. $7,500:
This might be a miscalculation, perhaps by incorrectly averaging the cost ($15,000 / 2) without considering the time period correctly.

C. $15,000:
This is the Single Loss Expectancy (SLE), or the cost of one incident. It is an input to the ALE calculation, not the final result.

D. $30,000:
This is the total cost over the three-year period (2 occurrences × $15,000). However, the question asks for the Annualized Loss Expectancy, which must be expressed as a cost per year.

Reference to Exam Objectives
This question aligns with the CompTIA Security+ (SY0-701) Exam Objective 5.4: Explain the importance of risk management processes and concepts.

Understanding quantitative risk analysis, including the concepts of ALE (Annualized Loss Expectancy), SLE (Single Loss Expectancy), and ARO (Annualized Rate of Occurrence), is a critical part of the risk management process. This calculation is used to justify cybersecurity spending—a control should not cost more than the ALE of the risk it mitigates.

Explanation
The organization is dealing with a business-critical legacy system. Legacy systems often cannot be secured using modern methods (e.g., they can't be patched to current standards, may not support modern encryption, or might rely on outdated protocols).

The actions taken are:

Disabling unneeded services:
This reduces the system's attack surface by removing potential vulnerabilities.

Placing a firewall in front of it:
This controls and monitors all network traffic to and from the system, blocking unauthorized access and potentially malicious traffic.

These controls are implemented because the system itself likely lacks sufficient built-in (inherent) security controls. They compensate for the weaknesses of the legacy system, thereby reducing its risk to an acceptable level without altering the core system itself, which could be risky or impossible.

Why the Other Options Are Incorrect

A. Exception:
An exception is a formal, temporary allowance to bypass a security policy. It doesn't describe the proactive security measures (disabling services, adding a firewall) that were implemented. The organization is securing the system, not making an excuse to leave it unsecured.

B. Segmentation:
While placing a firewall in front of the system is a form of network segmentation (it isolates the system into a different network segment), this term is too narrow. It does not encompass the action of "disabling unneeded services" on the host itself. "Compensating controls" is the broader and more accurate term that includes both network-based and host-based actions taken to compensate for a lack of inherent security.

C. Risk transfer:
This involves shifting the financial burden of a risk to a third party, such as by purchasing insurance. The organization is not transferring the risk; it is actively implementing technical measures to reduce (mitigate) the risk itself.

Reference
CompTIA Security+ (SY0-701) Exam Objectives: This scenario directly aligns with Domain 5.2: Explain the importance of applicable regulations, standards, or frameworks that impact organizational security posture.

The concept of compensating controls is a fundamental principle in risk management and is featured in many frameworks. For example, the NIST Risk Management Framework (RMF) and NIST SP 800-53 discuss compensating controls as alternative measures used when a primary security control is not feasible. The actions described are classic examples of using compensating controls to manage the risk of a legacy system.

Explanation
A Virtual Machine (VM) escape attack is a specific, severe type of vulnerability in a virtualized environment. In this attack, an attacker who has achieved code execution within a guest virtual machine (VM) breaks out of the isolation provided by the hypervisor. This allows the attacker to interact directly with the host operating system or, critically, with other guest VMs running on the same host.

"Attacking a system" refers to compromising the initial guest VM.
"To access adjacent hosts" refers to breaking out of the isolated VM environment to access the host machine or other VMs on that host, which are the "adjacent" systems in this architecture.

This is considered one of the most critical vulnerabilities in cloud and virtualized data centers because it breaches the fundamental security boundary (isolation) between tenants.

Why the Other Options Are Incorrect

B. Side loading:
This is an application-based attack, typically on mobile devices, where a user is tricked into installing an unverified application from a source outside the official app store. It does not involve breaking out of an isolated environment to access other systems on the same host; it's about bypassing distribution controls.

C. Remote code execution (RCE):
This is a very broad category of vulnerability where an attacker can execute arbitrary code or commands on a target system from a remote location. While an RCE vulnerability could be the initial vector used to gain access to a VM, it does not specifically describe the action of then breaking out of that environment to access adjacent hosts. RCE is the how, not the what of the final objective (which in this case is VM escape).

D. Resource exhaustion:
This is a type of denial-of-service (DoS) attack. The goal is to consume all available system resources (like CPU, memory, or bandwidth) to make a service or system unavailable for its intended users. It does not involve gaining access to or executing code on adjacent systems; its goal is to disrupt service, not to access data.

Reference
CompTIA Security+ (SY0-701) Exam Objectives: This question falls under Domain 1.2: Explain common threat vectors and attack surfaces. Virtualization-specific threats, like VM escape, are explicitly part of the modern threat landscape that the exam covers.

The severity of VM escape vulnerabilities is a key topic in cloud security discussions and is highlighted in security advisories from major hypervisor vendors like VMware, Microsoft (Hyper-V), and Citrix (Xen).

Explanation
When a security analyst is prioritizing a large list of vulnerabilities from a scan, they need a standardized, objective, and efficient way to compare the inherent severity of one vulnerability against another. The Common Vulnerability Scoring System (CVSS) provides a framework for doing exactly that.

Efficiency:
CVSS scores are typically provided automatically by vulnerability scanning tools. The analyst doesn't have to calculate them manually for each finding. The score (ranging from 0.0 to 10.0) allows for immediate, at-a-glance prioritization. A critical vulnerability with a CVSS score of 9.8 can be immediately identified as a higher priority to patch than one with a score of 4.3.

Risk-Based Approach:
While CVSS measures severity (based on exploitability and impact), severity is the primary technical input for calculating risk. It provides a consistent and common language for the initial triage of vulnerabilities before layering on organizational context.

Why the Other Options Are Incorrect

A. Business Impact Analysis (BIA):
A BIA is a high-level process that identifies and evaluates the potential effects of disruptions to critical business operations. It is not an efficient tool for prioritizing individual technical vulnerabilities. Its output is too broad (e.g., "the e-commerce server is a critical asset") and not granular enough to decide which specific CVE on that server to patch first.

C. Risk Register:
A risk register is a repository of identified risks, often with their assessed level of risk and mitigation plans. It is an output of the risk management process, not an efficient input for the initial technical prioritization of raw vulnerability scan results. The analyst would add the highest-priority vulnerabilities to the risk register after assessment.

D. Exposure Factor (EF):
Exposure Factor is a component of the quantitative risk calculation formula (Single Loss Expectancy = Asset Value x Exposure Factor). It represents the percentage of loss a realized threat would have on a specific asset. Like the BIA, it is a high-level business metric that is not efficiently applied to the initial prioritization of a long list of technical vulnerabilities. Calculating SLE for every vulnerability in a scan would be incredibly time-consuming and inefficient.

Reference
CompTIA Security+ (SY0-701) Exam Objectives: This question falls under Domain 1.5: Explain vulnerability management activities and tools.

The objectives specifically mention the importance of "Prioritization of vulnerabilities based on CVSS" as a key activity. CVSS is the industry standard for scoring vulnerabilities, making it the most efficient starting point for any risk-based prioritization effort.

FIRST.org: The Forum of Incident Response and Security Teams (FIRST) is the official maintainer of the CVSS standard, which underscores its role as a critical resource for security professionals.

Explanation
Data is categorized into three primary states, each requiring specific security controls:

Data at rest:
Data stored on a medium (e.g., on a hard drive, in a database file, on a USB drive). It is typically protected by encryption (e.g., full-disk encryption).

Data in transit (or in motion):
Data actively moving between systems across a network (e.g., from a web server to a user's browser). It is typically protected by encryption protocols (e.g., TLS/SSL).

Data in use:
Data that is being actively processed by a computer's CPU or memory. This includes data being created, retrieved, updated, or deleted by an application.

When a database server is actively processing a query (e.g., performing calculations, sorting records, updating values), the relevant data is loaded from storage (at rest) into the server's memory (RAM) and registers for processing. This state is the very definition of "in use."

Why the Other Options Are Incorrect

B. At rest:
This describes the data when it is stored on the database server's disk. The moment the server reads it from the disk to process it, the state changes from "at rest" to "in use."

C. In transit:
This would apply to data moving to or from the database server over a network. For example, a query sent from a web application to the database or the results sent back are "in transit." However, the question specifies the data is "being actively processed by" the server itself, which happens internally after the data has been received.

D. Being hashed:
Hashing is a specific type of processing. Therefore, data that is "being hashed" is a subset of data that is "in use." The question asks for the general data state, and "in use" is the broader, correct category that encompasses all forms of active processing, including hashing, encrypting, compiling, or calculating.

Reference
CompTIA Security+ (SY0-701) Exam Objectives: Understanding data states is a fundamental concept covered under various domains, most notably Domain 4.3: Explain data security and privacy concepts. The objectives emphasize applying appropriate security controls to data based on its state (at rest, in transit, in use).

This classification is a core principle in cybersecurity frameworks from NIST (National Institute of Standards and Technology), which guides the selection of security controls for protecting information and information systems.

Explanation
A SQL injection attack occurs when a threat actor inserts malicious SQL code into input fields of a web application (like a login form or search bar). The application, failing to properly validate or sanitize this input, forwards the malicious code to the underlying database server.

The application log is the most direct source to identify the exact command used because:

It typically records the specific queries and requests made to the application.

For a web application, this would include the raw HTTP requests, which contain the parameters and input values sent by the user (the threat actor).

The malicious SQL snippet is often visible within these request parameters (e.g., in a POST body or a GET query string).

Reviewing the application log allows the forensic engineer to see the precise malicious input that triggered the compromise.

Why the Other Options Are Incorrect

A. Metadata:
Metadata is "data about data," such as file creation dates, author, or modification timestamps. While crucial in other forensic investigations (e.g., determining when a file was exfiltrated), it does not contain the contents of user requests or database queries. It cannot reveal the specific SQL command used in the attack.

C. System log:
System logs (e.g., Windows Event Logs or Linux syslog) record operating system events, such as user logins, service failures, and driver issues. While they might show that a service like a database server crashed or had high CPU usage (an effect of the attack), they do not record the specific application-level SQL query that was executed.

D. Netflow log:
Netflow (or similar data like sFlow or IPFIX) provides metadata about network traffic. It records information like source/destination IP addresses, ports, protocols, and the volume of data transferred. It could show a connection from the threat actor to the application server, but it does not capture the actual content or payload of the communication. It can show that communication happened, but not what was said—it cannot reveal the specific SQL command.

Reference

CompTIA Security+ (SY0-701) Exam Objectives:
This question falls under Domain 4.4: Given a scenario, analyze potential indicators of malicious activity. A key part of analysis is reviewing the correct log source to find evidence of a specific attack.

Digital Forensics and Incident Response (DFIR):
A core principle in forensics is identifying the right source of evidence. For application-layer attacks like SQL injection, cross-site scripting (XSS), or command injection, the application server logs are always the primary source for the initial malicious payload. This is a standard practice outlined in guides from organizations like NIST (SP 800-86) and the SANS Institute.

Explanation
The question states the need for "additional data about the executable running on the machine." This is a clear request for endpoint-level data.

Endpoint logs are generated by software running directly on the device (the laptop itself). This includes:

Operating System Logs:
Such as Windows Event Logs (e.g., Security, System, Application logs) that record process creation, authentication events, and service activity.

Endpoint Detection and Response (EDR) / Antivirus (AV) Logs:
These are specifically designed to provide deep visibility into processes, executable files, hashes, network connections made by processes, and parent/child process relationships.

This data is essential for investigating what a specific executable is doing, when it started, who launched it, and what other system changes it made.

Why the Other Options Are Incorrect

A. Application:
Application logs record events related to a specific software application (e.g., a web server, a database). They are useful for detecting application-level attacks like SQL injection but do not provide system-wide visibility into all executables running on an endpoint. They are too narrow for this request.

B. IPS/IDS:
Intrusion Prevention/Detection System logs alert on malicious network patterns or known attack signatures. They are excellent for identifying that malicious traffic exists (which is what started this investigation) but do not provide details about the specific executable on the endpoint that is generating that traffic. They see the symptom (bad traffic) but not the source (the process).

C. Network:
Network logs (e.g., NetFlow, PCAP, firewall logs) provide information about communication between devices—source/destination IPs, ports, protocols, and volume. Like IPS/IDS, they are critical for detecting the malicious traffic but cannot see inside the endpoint to identify the exact executable responsible for generating that traffic.

Reference
CompTIA Security+ (SY0-701) Exam Objectives: This question aligns with Domain 4.3: Given a scenario, analyze data using the appropriate tool. The objectives emphasize using the right tool for the job, specifically:

Endpoint analysis is performed with tools like EDR, which provide process monitoring, hashing, and asset management data. Network analysis is performed with tools like a SIEM’s network module, NGFW logs, and packet captures.

The key is to match the data source (endpoint) to the investigative need (information about a running executable).

Explanation
Quarantining a system in cybersecurity means isolating it to prevent a potential threat from spreading to other network resources. The goal is to contain the system while preserving its state for further investigation (forensics). Moving the device into an air-gapped environment is the most effective form of quarantine. This involves physically or logically disconnecting the device from all networks (wired, wireless, Bluetooth). This action:

Contains the Threat:
Prevents the malware from communicating with its command-and-control (C2) server or spreading laterally to other systems on the network.

Preserves Evidence:
Keeps the system's memory and disk state intact for malware analysis and forensic investigation.

Allows for Safe Analysis:
The system can then be analyzed in a controlled, isolated lab environment without risk to the production network.

Why the Other Options Are Incorrect

B. Disable remote log-in through Group Policy:
While this might seem like a containment action, it is slow, unreliable, and incomplete for quarantine.

Slow:
Group Policy updates are not instantaneous.

Unreliable:
If the system is already compromised, malware may interfere with Group Policy processing

Incomplete:
This only blocks one specific access method (remote login). The infected system would still be connected to the network, allowing the malware to continue spreading or communicating externally.

C. Convert the device into a sandbox:
A sandbox is an isolated testing environment used to analyze suspicious software. You do not "convert" a production machine into a sandbox; you would move a suspicious file into a pre-existing sandbox environment. This action is an analysis step that would happen after the infected system has been quarantined and the malware sample has been extracted.

D. Remote wipe the device using the MDM platform:
This is a destructive action of last resort, not a quarantine action. A remote wipe erases all data on the device.

Destroys Evidence:
It eliminates any possibility of performing forensic analysis to determine the root cause, extent of the infection, or data that was exfiltrated.

Not a Containment Tactic:
Wiping is a recovery action, not a containment action. It is typically used for lost or stolen devices to protect data confidentiality, not for infected devices on the corporate network that need to be investigated.

Reference
CompTIA Security+ (SY0-701) Exam Objectives: This scenario falls under Domain 4.2: Explain the importance of policies and processes for incident response. A key phase of the incident response process (e.g., NIST SP 800-61) is Containment. The objectives cover appropriate containment strategies, such as isolation and segmentation, to prevent an incident from causing further damage.

Explanation
The key constraint in the question is performing a risk assessment "without using proprietary company information." This means the administrator cannot use internal data, scan internal systems, or access confidential company resources.

Open-source intelligence (OSINT) is the collection and analysis of information that is publicly available. This includes data from:

Public websites and social media

News articles and press releases

Government databases (e.g., SEC filings)

Publicly accessible technical information (e.g., domain name registration details, certificates)

Threat intelligence feeds that discuss general vulnerabilities and threat actor tactics

Using OSINT, an administrator can identify potential threats, threat actors, and vulnerabilities that could target their industry or technology stack—all without ever touching an internal company system or using proprietary data.

Why the Other Options Are Incorrect

A. Network scanning:
This involves actively probing the company's internal network to discover devices, services, and vulnerabilities. This directly uses and interacts with proprietary company information (internal IP addresses, system configurations) and is therefore not permitted under the question's constraint.

B. Penetration testing:
This is an authorized simulated attack on company systems to evaluate security. It requires actively exploiting vulnerabilities in proprietary systems, making it the opposite of what the question asks for.

D. Configuration auditing:
This involves reviewing the security settings and configurations of internal systems, servers, and applications against a baseline or standard. This process requires direct access to proprietary company systems and their configuration data, which is explicitly ruled out.

Reference
CompTIA Security+ (SY0-701) Exam Objectives: This question aligns with Domain 5.3: Explain the processes for performing third-party risk assessment and management.

When assessing the risk posed by a vendor or partner, an organization will often start with OSINT gathering to understand the vendor's public footprint, history of security incidents, and overall reputation before requesting proprietary information. OSINT is a fundamental tool in the initial stages of external risk assessment.

Explanation
COPE (Corporate-Owned, Personally Enabled) is a mobile device management model where the organization purchases and issues the device to the employee. The employee is allowed to use the device for personal activities (email, apps, web browsing) in addition to work.

Because the device is corporate-owned and contains both corporate and personal data, the organization's policy must focus on protecting corporate data and assets while allowing some personal use.

The two most critical security controls for any corporate-owned device are:

B. Data Encryption:
This ensures that if the device is lost or stolen, the data stored on it is unreadable without the proper credentials. This protects both corporate and personal information from unauthorized access and is a fundamental security requirement.

A. Remote Wiping of the Device:
This is a crucial administrative control. If a COPE device is lost, stolen, or the employee is terminated, the organization must have the ability to remotely erase the device to prevent unauthorized data access. This primarily protects corporate data but also serves to protect the former employee's personal data from falling into the wrong hands.

Why the Other Options Are Incorrect

C. Requiring passwords with eight characters:
While password requirements are important, specifying an exact length like "eight characters" is a weak and outdated practice. Modern policies enforce complexity and minimum length (e.g., 12+ characters) rather than a specific short count. Furthermore, this is a single example of a security control, but the question asks for the best inclusions, and encryption and remote wipe are more comprehensive and critical.

D. Data usage caps:
This is a cost-control measure for cellular data plans, not a core security control for protecting data on the device itself. It is related to telecom expense management, not MDM security policy.

E. Employee data ownership:
This is a legal and HR concept, not a technical security control. In a COPE model, the device is owned by the company. The policy will define the boundaries between corporate data and personal data, but "employee data ownership" is not something "included" in the MDM policy; it's a principle that the policy is built around.

F. Personal application store access:
A key feature of COPE is that it allows personal use. Therefore, restricting personal application store access would contradict the "Personally Enabled" aspect of COPE. The policy would focus on ensuring security (e.g., by vetching apps for malware) rather than outright blocking access to personal stores.

Reference
CompTIA Security+ (SY0-701) Exam Objectives: This falls under Domain 3.5: Explain the importance of mobile device management (MDM) and mobility management concepts.

The objectives specifically differentiate between deployment models like COPE, BYOD (Bring Your Own Device), and CYOD (Choose Your Own Device).

Explanation
Data can be in one of three states: at rest, in transit, or in use. Data in transit (also called data in motion) is data actively moving from one location to another, such as across the internet or through a private network.

Encryption (A) is the primary and most often used method to protect data in transit. It uses cryptographic algorithms to transform readable data (plaintext) into an unreadable, scrambled format (ciphertext) during transmission. Only authorized parties with the correct decryption key can convert it back to plaintext. Common protocols like TLS (Transport Layer Security) for web traffic (HTTPS), SSH for secure remote access, and IPsec for VPNs all use encryption to secure data in transit against eavesdropping and man-in-the-middle attacks.

Why the other options are incorrect:

B. Obfuscation:
Obfuscation is the process of making data difficult to understand to deter reverse engineering, but it does not use a cryptographic key for security. It is easily reversible and is not considered a secure method for protecting sensitive data during transmission. It is more commonly used to hide code or data structures, not to secure communications.

C. Permission Restrictions:
Permission restrictions (or access controls) are crucial for protecting data at rest and in use. They dictate who or what can access data stored on a system. However, they do not inherently protect the data itself as it travels across a network between the source and the authorized destination. Once data is in transit, permissions are no longer the primary defense.

D. Hashing:
Hashing is a one-way cryptographic function that generates a unique fixed-size string (a hash) from data. It is primarily used to verify the integrity of data (e.g., ensuring a file was not altered in transit). However, it does not provide confidentiality. The original data is not hidden; if intercepted, the data is still fully readable. Therefore, hashing alone is not used to protect the data itself during transmission.

Reference
CompTIA Security+ SY0-701 Objective 4.1: Explain the importance of security concepts in an enterprise environment. The objective specifically lists "Data in transit" as a key concept, and encryption is the prescribed control for ensuring its confidentiality.

Explanation
The question states that the penetration tester gained unauthorized access to the hypervisor platform itself. The hypervisor is the underlying software, firmware, or hardware that creates and runs virtual machines (VMs). It is the host system that manages all guest VMs.

VM Escape (D) is a specific, severe vulnerability where an attacker breaks out of the isolated environment of a virtual machine (the guest) and gains unauthorized access to the hypervisor (the host) or other VMs on the same host. This directly aligns with the scenario described, as compromising the hypervisor gives an attacker control over all the resources and VMs it manages. This is a classic hypervisor-level compromise.

Why the other options are incorrect:

A. Cross-site scripting (XSS):
XSS is a vulnerability typically found in web applications. It allows an attacker to inject malicious scripts into content viewed by other users. It is not a vulnerability that would be used to compromise a hypervisor's core platform.

B. SQL injection (SQLi):
SQLi is a vulnerability that exploits improper input sanitization in applications that interact with a database. An attacker can manipulate SQL queries to view, modify, or delete database data. Like XSS, it is an application-layer attack and is not a typical vector for attacking a hypervisor's management system (unless that management system is itself a vulnerable web app, which is not the most likely exploit path for hypervisor access).

C. Race condition:
A race condition is a vulnerability where a system's output is dependent on the sequence or timing of uncontrollable events. Exploiting it (e.g., Time of Check to Time of Use - TOCTOU) can lead to privilege escalation or unauthorized actions. While a race condition could potentially exist in hypervisor software, it is a generic software flaw type and not the most specific or likely answer for a direct hypervisor compromise compared to VM escape.

Reference
CompTIA Security+ SY0-701 Objective 3.2: Explain concepts related to vulnerability management.

Understanding specific vulnerability types, like those associated with virtualization (VM escape), is key to vulnerability management.

CompTIA Security+ SY0-701 Objective 2.2: Explain the security implications of embedded and specialized systems.

Virtualization technologies are considered a type of specialized system. The hypervisor is a critical component, and VM escape is a paramount threat to its security model, which is based on isolating guest VMs from the host and from each other. A successful VM escape attack breaches this fundamental isolation.