Free SY0-701 Practice Test Questions 2026

Explanation
Sideloading is the process of installing an application on a mobile device (or sometimes other systems) without using the official, sanctioned app store (like the Apple App Store or Google Play Store). This often involves enabling "Unknown Sources" or using developer tools.

The primary security risk of sideloading is that the application does not undergo the security vetting and code review typically performed by the official app store. This allows malicious code to be easily introduced onto the device. Rootkit (B) is the most likely threat to be introduced via sideloading. A malicious actor can embed a rootkit within a seemingly legitimate application offered for download on a third-party website. Once the user sideloads and installs this app, the rootkit can gain privileged (root-level) access to the operating system, hide its presence, and create a persistent backdoor on the device. Sideloading is a common distribution vector for such deep-system malware.

Why the other options are incorrect:

A. User Impersonation:
User impersonation is a social engineering or identity theft technique where an attacker pretends to be another user. It is not a piece of malware or code that can be "introduced" or packaged inside an application. It is an action performed by an attacker, not a payload delivered via an app.

C. On-path Attack:
An on-path (or man-in-the-middle) attack is a network-based attack where an attacker intercepts or alters communication between two parties. It is not a software payload or malware that is contained within an application. It is an attack methodology that occurs during data transmission, not at the time of application installation.

D. Buffer Overflow:
A buffer overflow is a specific software vulnerability or coding error. While a malicious sideloaded app could exploit a buffer overflow vulnerability present on the device, the buffer overflow itself is not the thing being "introduced." The thing being introduced is the malicious app or its payload (e.g., a rootkit) that then takes advantage of the existing flaw.

Reference
CompTIA Security+ SY0-701 Objective 2.3: Explain the importance of secure development practices and controls.

This objective covers application security risks, including those from unvetted application sources. Sideloading bypasses the secure development and review controls enforced by official stores.

Mobile Device Management (MDM) / Application Management: A core security practice is to restrict sideloading on corporate devices precisely to prevent the introduction of malware like rootkits, spyware, and trojans that can compromise the entire device and corporate network.

Explanation
The process described involves determining the importance, sensitivity, and regulatory requirements of a file to assign it an appropriate label (e.g., Public, Internal, Confidential, Restricted).

Classification (C) is the exact process of categorizing data based on its value, sensitivity, and regulatory requirements to apply appropriate security controls, including labels. These labels then dictate how the data should be handled, stored, and transmitted.

Why the other options are incorrect:

A. Verification:
Verification is the process of confirming that something is true, accurate, or justified. For example, verifying a user's identity or verifying that a control is functioning correctly. It is not the process of initially selecting a category or label.

B. Certification:
Certification is a formal process where an authoritative body validates that a system, product, or process meets a specific set of standards. For example, a system may be certified against the ISO 27001 standard. It is a high-level assurance activity, not the granular process of labeling individual files.

D. Inventory:
Inventory is the process of creating a list or catalog of assets. A data inventory would list what data an organization has and where it is stored. While classification often relies on an inventory to know what data exists, the act of selecting a label for each data set based on its properties is classification itself.

Reference
CompTIA Security+ SY0-701 Objective 5.1: Explain the importance of data protection.

Data Classification is a fundamental concept under this objective. It is the first and most critical step in data protection, as it ensures that security controls (like encryption, access permissions, and retention policies) are applied appropriately based on the data's sensitivity level.

Explanation
The question asks for a method to provide proof of external security testing. "Proof" in this context implies independent, objective verification that the testing was performed and that the results are credible.

Third-party attestation (D) refers to a formal statement, opinion, or validation provided by an independent, external organization. In cybersecurity, this often takes the form of an audit report or a certificate (like a penetration test report from an unbiased consulting firm). This provides the highest level of assurance to stakeholders (like customers, partners, or regulators) that the testing was conducted thoroughly and professionally, as the third party has no vested interest in the outcome.

Why the other options are incorrect:

A. Business Impact Analysis (BIA):
A BIA is a process that identifies and evaluates the potential effects of an interruption to critical business operations. It is used for disaster recovery and business continuity planning. It does not provide proof of security testing.

B. Supply Chain Analysis:
This involves assessing the security risks posed by an organization's vendors and partners. While it might involve reviewing a partner's security test results, it is not itself a form of proof for the company's own testing.

C. Vulnerability Assessment:
This is the name of the activity itself (discovering, quantifying, and prioritizing vulnerabilities). A vulnerability assessment generates a report, but that report is a self-assertion from the company or the team that performed the test. It lacks the independent validation that "proof" or "attestation" implies. An internal report does not carry the same weight as one validated by an external, accredited third party.

Reference
CompTIA Security+ SY0-701 Objective 5.3: Explain the processes for third-party risk assessment and management.

This objective covers the importance of using independent third parties to assess and validate security controls. Third-party attestation is a cornerstone of building trust and demonstrating due diligence in security practices to external entities.

Explanation
The question asks which option allows an exploit to remain hidden from the operating system (OS). The key concept here is the level of privilege and control a component has over the OS itself.

Firmware vulnerabilities (A) can be used to create extremely stealthy and persistent exploits. Firmware (e.g., BIOS/UEFI, drive controllers, network cards) is the low-level software that initializes hardware and boots the operating system. An exploit at this level operates below the operating system. Because the OS relies on the firmware and has limited visibility into its operations, malware hiding in firmware can be nearly impossible for the OS to detect using traditional methods. This makes it a powerful technique for advanced, persistent threats.

Why the other options are incorrect:

B. Side loading:
Sideloading is a method of installing unauthorized applications, often by bypassing app store security. While it can be used to install malware, the malware itself still runs within the operating system and is subject to its detection mechanisms (like antivirus software). It does not inherently make the exploit undetectable.

C. Memory injection:
Memory injection (e.g., DLL injection, process hollowing) is a technique where malicious code is inserted into the memory space of a legitimate running process. This is a common way to evade basic detection that only scans files on disk. However, this activity still occurs within the OS's memory space. Modern Endpoint Detection and Response (EDR) systems and antivirus software are specifically designed to detect anomalous behavior and code execution in memory.

D. Encrypted payloads:
Encryption can be used to obfuscate malicious code while it is in transit over the network or at rest on a disk, potentially bypassing simple signature-based detection. However, for the code to execute, it must eventually be decrypted into plaintext in the system's memory. Once decrypted and running, the OS and security software can detect it.

Reference
CompTIA Security+ SY0-701 Objective 2.2: Explain the security implications of embedded and specialized systems.

This objective covers firmware security. Firmware operates at a lower level than the OS, and compromises at this level can subvert higher-level security controls and remain undetected, making them a significant threat. Advanced Persistent Threats (APTs):

Sophisticated attackers often target firmware to achieve long-term persistence on a device because it is difficult for traditional OS-level security tools to scan or analyze firmware code effectively.

Explanation
The incident described has two critical parts:

Initial Infection Vector:
The malware entered the system from an external hard drive that was plugged into the host.

Consequence:
The malware stole credentials stored in the browser.

The root cause of the incident was the user's action of connecting an untrusted external device to their computer. Removable Media and Cables (B) is the exact security awareness training topic that covers the risks associated with connecting unknown or untrusted USB devices, external hard drives, and other removable media. This training would teach the user to never plug in found media, to only use company-approved devices, and to scan any external media for malware before use. Addressing this behavior would directly prevent a recurrence.

Why the other options are incorrect:

A. Operational Security (OPSEC):
While OPSEC is a broad topic about protecting sensitive information, it is not the most specific or direct lesson here. OPSEC focuses more on behaviors that could inadvertently reveal information to adversaries (e.g., oversharing on social media, poor document disposal) rather than the specific physical act of connecting hardware.

C. Password Management:
Password management training focuses on creating strong, unique passwords and using password managers. While this could have mitigated the consequence (e.g., if the passwords were stored in a more secure, separate password manager instead of the browser), it does not address the cause of the infection, which was the use of removable media.

D. Social Engineering:
Social engineering involves manipulating people into breaking security procedures. The scenario does not indicate that the user was tricked into plugging in the drive (e.g., it was found in the parking lot as part of a baiting attack). It simply states it was "plugged in," which could have been a voluntary, uninformed action. Therefore, while related, it is not as directly applicable as the specific topic of removable media.

Reference
CompTIA Security+ SY0-701 Objective 5.7: Given a scenario, implement security awareness practices.

This objective explicitly includes Removable Media and External Devices as critical topics for security awareness and training programs. The goal is to educate users on the dangers of connecting untrusted devices, which can introduce malware and lead to data breaches, exactly as described in the scenario.

Explanation
The question asks for the best method to automate updating permissions for a large number of accounts. The key is to find a solution that allows a single change to automatically apply to many users.

Security Groups (A) are a core identity and access management concept. Permissions (like access to a shared folder, application, or network resource) are granted to a group, not to individual users. User accounts are then added as members of the appropriate groups. To update permissions for all those users, an administrator only needs to modify the permissions of the group itself, or simply move the users into a different group. This is highly automated and efficient for managing large sets of users.

Why the other options are incorrect:

B. Federation:
Federation (like SAML) is a technology that allows for single sign-on (SSO) and identity management across different organizations or systems. It is used to authenticate users (verify their identity) across domains, but it is not primarily used to manage detailed authorization permissions (what they are allowed to access) within a single system. It doesn't automate the task of bulk permission updates.

C. User Provisioning:
User provisioning is the overall process of creating, updating, and deactivating user accounts and their access. The question is asking for the specific tool or mechanism used to accomplish the automated update within that process. Security groups are the technical tool that enables the automation of permission updates, which is a key part of user provisioning.

D. Vertical Scaling:
Vertical scaling refers to adding more power (CPU, RAM) to an existing server to handle increased load. This is a hardware and performance concept and has absolutely nothing to do with managing user account permissions.

Reference
CompTIA Security+ SY0-701 Objective 3.1: Given a scenario, implement authentication and authorization controls.

This objective covers the use of groups (a type of access control object) to assign rights and permissions to users. Managing access through groups is a fundamental best practice for efficient and scalable identity management.

Explanation
The attack surface refers to the sum of all the different points (vectors) where an unauthorized user can try to enter or extract data from an environment. The best way to reduce it is to eliminate unnecessary entry points and functionality. Disable unused network services on servers (A) is the best method because every active network service (e.g., FTP, Telnet, older SMB versions) listens on a specific port, creating a potential entry point for an attacker. If a service is not needed, disabling it immediately closes that potential vulnerability. This is a fundamental principle of system hardening and provides a significant reduction in the number of ways a server can be attacked.

Why the other options are incorrect:

B. Use port security for wired connections:
Port security is a valuable security control that restricts which devices (by MAC address) can connect to a specific physical switch port. It is primarily used to prevent unauthorized devices from connecting to the internal network. While it reduces risk, it doesn't directly reduce the attack surface of the network itself; it reduces the threat of unauthorized physical access.

C. Change default passwords for network printers:
This is an absolutely critical security practice and falls under system hardening. However, it addresses a specific vulnerability (default credentials) on a specific device class. It does not systematically reduce the overall number of attack vectors across the entire enterprise network like disabling unneeded services does.

D. Create a guest wireless network for visitors:
This is a important security practice for network segmentation. It isolates untrusted guest devices from the trusted internal corporate network. This contains the damage an already-connected malicious device could do but it doesn't actively reduce the number of attack vectors (services, open ports) on the network itself. It manages risk rather than reducing the core attack surface.

Reference
CompTIA Security+ SY0-701 Objective 3.2: Given a scenario, implement security hardening.

The practice of disabling unnecessary services, accounts, and features is a cornerstone of system hardening, which is the primary method for reducing the attack surface of any device, especially servers.

Explanation
The core security principle is Authentication before Authorization:

Authentication (AuthN):
Verifying who someone is (e.g., with a username and password).

Authorization (AuthZ):
Determining what they are allowed to access after they are authenticated.

A situation where authorization happens before authentication inverts this fundamental logic and creates a critical vulnerability.

Race Condition (B) is a software flaw where the output of a process is unexpectedly dependent on the sequence or timing of other events. A specific type of race condition, Time of Check to Time of Use (TOCTOU), can exploit the tiny delay between when a system checks a user's permissions (authorization) and when that action is actually executed. An attacker could potentially manipulate this delay to gain unauthorized access, effectively being authorized based on a state that changes before the action is complete. This creates a scenario where the logic flow is broken, and authorization is not properly tied to a confirmed identity.

Why the other options are incorrect:

A. Privilege Escalation:
Privilege escalation is the result of an attack where a user gains higher-level permissions than they are supposed to have. It is not a situation that describes the inversion of the authentication and authorization process order.

C. Tailgating:
Tailgating is a physical security breach where an unauthorized person follows an authorized person into a restricted area. This involves bypassing physical authorization controls but does not relate to the digital sequence of authentication and authorization.

D. Impersonation:
Impersonation is the act of pretending to be another user or entity. This is a technique used to bypass authentication. It does not describe a scenario where the system's own logic authorizes a user before knowing who they are.

Reference
CompTIA Security+ SY0-701 Objective 2.4: Explain common types of attacks.

Race conditions are a specific software vulnerability type covered under this objective. A TOCTOU attack is a classic example of how this vulnerability can be exploited to subvert normal security processes like authentication and authorization.

Explanation
The question asks about identifying whether data has been modified in transit. This is a question about verifying integrity.

Hashing (A) is a cryptographic one-way function that generates a unique, fixed-size string of characters (a hash or digest) from any input data. The core principle is that even the smallest change in the input data will produce a drastically different hash value. To check for modification, the sender calculates a hash of the original data and sends it alongside the data (often secured with encryption). The recipient calculates a new hash of the received data and compares it to the original hash. If they match, the data is intact. If they don't match, the data has been altered in transit. This is the primary mechanism for verifying integrity.

Why the other options are incorrect:

B. Tokenization:
Tokenization is the process of replacing sensitive data with a non-sensitive equivalent, called a token, which has no intrinsic meaning or value. It is primarily used to protect data at rest (e.g., in a database) and reduce the scope of compliance. It does not provide a mechanism for detecting changes to data.

C. Masking:
Data masking involves obscuring specific data within a dataset (e.g., showing only the last four digits of a Social Security Number). Its goal is to protect sensitive information for use in non-production environments (e.g., testing). Like tokenization, it is a data obfuscation technique and does not help verify data integrity.

D. Encryption:
Encryption is the process of converting data into a secure, unreadable format (ciphertext) to ensure confidentiality. While it protects data from being read in transit, it does not inherently guarantee that the data hasn't been modified. Encrypted data can still be altered, resulting in garbled plaintext upon decryption. Encryption is often paired with hashing (as in TLS/SSL protocols) to provide both confidentiality and integrity.

Reference
CompTIA Security+ SY0-701 Objective 2.8: Summarize cryptography concepts.

This objective covers cryptographic uses, including hashing for integrity checking (e.g., verifying file downloads, ensuring message integrity). Protocols like HMAC are specifically designed for this purpose.

Explanation
The key constraint in the question is "limited computing resources." This refers to devices with low processing power, memory, or battery life, such as IoT sensors, mobile devices, or smart cards.

Elliptic Curve Cryptography (ECC) (D) is a type of public-key cryptography that provides a level of security equivalent to traditional systems (like RSA) but with significantly smaller key sizes. For example, a 256-bit ECC key offers security comparable to a 3072-bit RSA key. This smaller key size requires less computational power, less memory, and less bandwidth, making it the preferred choice for environments with limited resources.

Why the other options are incorrect:

A. Hashing algorithm:
Hashing algorithms (like SHA-256) are used for integrity verification, not for securing communications. They are one-way functions and cannot be used for encryption or key exchange, which are required for secure communication.

B. Public key infrastructure (PKI):
PKI is a framework that manages digital keys and certificates. It is often built on traditional public-key cryptography (like RSA), which is computationally expensive and not ideal for limited-resource environments. While ECC is part of a PKI, the term "PKI" itself is too broad and is not specifically optimized for limited resources.

C. Symmetric encryption:
Symmetric encryption (like AES) is very efficient and fast, making it excellent for encrypting large volumes of data. However, it requires a secure method to exchange the secret key between parties. This key exchange problem is typically solved using slower public-key cryptography. Therefore, while symmetric encryption is used in secure communications, the initial setup (key exchange) is the resource-intensive part, for which ECC is the preferred solution.

Reference
CompTIA Security+ SY0-701 Objective 2.8: Summarize cryptography concepts.

This objective includes knowledge of cryptographic use cases and limitations. A specific requirement is to understand the use of ECC as a more efficient alternative to RSA for key exchange in environments with constraints like low power, storage, or processing capacity (e.g., IoT devices, mobile communication).

Explanation
The incident response process is a structured methodology for handling a security breach. The question asks when an analyst reviews roles and responsibilities.

Preparation (A) is the phase where an organization gets ready to handle potential security incidents. A critical component of this phase is developing the Incident Response Plan (IRP). This plan explicitly defines roles and responsibilities for everyone on the incident response team (e.g., who leads the response, who handles communication, who does the technical analysis, who contacts law enforcement). Reviewing this plan and ensuring everyone understands their role is a core preparatory activity.

Why the other options are incorrect:

B. Recovery:
The recovery phase is focused on actions taken to restore systems and operations to normal after the incident has been contained and eradicated. This involves restoring data from backups, rebuilding systems, and re-enabling network access. While roles are executed here, they are not reviewed in this phase.

C. Lessons Learned:
Also known as the "Post-Incident Activity" phase, this occurs after the incident is fully resolved. The team meets to discuss what happened, what was done well, and what could be improved. While the effectiveness of roles might be evaluated in this phase, the initial review and assignment of those roles happens in the Preparation phase.

D. Analysis:
The analysis phase (often called "Detection and Analysis") is when the security team is actively investigating the incident to determine its scope, impact, and root cause. During this phase, team members are performing their pre-defined roles, not reviewing what those roles are.

Reference
CompTIA Security+ SY0-701 Objective 4.4: Explain the importance of incident response planning.

This objective covers the incident response process, with Preparation being the first and foundational phase. A key part of preparation is "Establishing roles and responsibilities" for the incident response team to ensure a coordinated and efficient response.

Explanation
Legacy systems are outdated computing hardware or software that is still in use. The single greatest security concern with such systems is that they have reached their End-of-Life (EOL) or End-of-Service-Life (EOSL) from the vendor.

Lack of vendor support (B) means the vendor no longer provides:

Security patches:
When new vulnerabilities are discovered, the vendor will not release updates to fix them. This leaves the system permanently vulnerable to known exploits.

Technical support:
If the system fails or is compromised, there is no official help available from the vendor to resolve the issue.

Software updates:
General bug fixes and compatibility updates are no longer provided, which can lead to instability and security flaws. This creates an unacceptable and unmanageable level of risk for a system in production, as it becomes impossible to defend against emerging threats.

Why the other options are incorrect:

A. Instability:
While legacy systems can be unstable, this is primarily an operational concern (e.g., it could lead to downtime). The core security concern is the inability to patch vulnerabilities, which is a direct result of a lack of vendor support.

C. Loss of availability:
This is a potential consequence of using a legacy system (due to instability or a security breach), but it is not the root cause of the security concern. The root cause is the lack of support that makes the system vulnerable to attacks that cause downtime.

D. Use of insecure protocols:
Many legacy systems do rely on outdated, insecure protocols (e.g., Telnet, FTP, SSLv2). However, this is a symptom of the larger problem. The reason these protocols cannot be upgraded or replaced is often because the vendor no longer supports the system to provide modern, secure alternatives. Lack of support is the overarching issue that encompasses this and other vulnerabilities.

Reference
CompTIA Security+ SY0-701 Objective 3.5: Explain the security implications of embedded and specialized systems.

Legacy systems share many security concerns with embedded systems, primarily the challenge of managing systems that are no longer supported by their vendor and cannot be easily patched or updated. This makes them a significant liability in a production environment.