Free SY0-701 Practice Test Questions 2026

Explanation:
A host-based firewall is a software application that runs on an individual device (e.g., a workstation or server) and controls incoming and outgoing network traffic based on a defined set of security rules. Its primary purpose is to block unwanted or insecure communications.

How it provides the best protection:
It acts as a gatekeeper for all network activity on the device itself. It can be configured to explicitly allow only necessary communications (by port, protocol, and application) and deny all others, providing a strong defense against unauthorized access and malicious traffic, both from the network and from malware trying to "call home."

The other options are important security controls but serve different primary purposes:

A. System hardening:
This is the process of securing a system by reducing its attack surface. This includes removing unnecessary software, disabling unused services, and changing default configurations. While hardening complements a firewall by reducing potential entry points, it does not actively filter network communications in real-time. A hardened system could still communicate insecurely if its configured services are allowed to talk to the network unchecked.

C. Intrusion detection system (IDS):
An IDS is a monitoring system that detects and alerts on suspicious activity. A network-based IDS (NIDS) monitors network traffic, while a host-based IDS (HIDS) monitors activity on a single host. The key word is detection; an IDS primarily generates alerts but does not actively block communications by itself. It is a passive, monitoring control.

D. Anti-malware software:
This software is designed to prevent, detect, and remove malware (viruses, worms, Trojans, etc.). It primarily scans files and memory for malicious code. While some modern anti-malware suites include basic firewall capabilities, its core function is not to filter all network traffic. It might block communication from a process it identifies as malware, but a firewall provides broader, rule-based control over all communications regardless of the application's malicious status.

Reference:
This question falls under Exam Objective 3.3: Given a scenario, implement secure network designs. Part of this objective involves understanding endpoint protection solutions, where a host-based firewall is a fundamental component for controlling network traffic to and from the device. CompTIA emphasizes defense-in-depth, and the host-based firewall is a critical last line of defense at the endpoint level.

Explanation:
A command-and-control (C2 or C&C) server is a computer controlled by an attacker that is used to send commands to systems infected with malware and to receive stolen data. Identifying the impacted host(s) involves finding which internal device is communicating with this malicious external server.

Here’s why DHCP and Firewall logs are the best choices:

C. DHCP (Dynamic Host Configuration Protocol) Logs:

Purpose:
DHCP servers assign IP addresses to devices on a network dynamically.

Why it's critical:
To find an impacted host, you need to map the malicious IP address found in other logs (like firewall logs) to a specific machine on your network. DHCP logs record which MAC address (the unique hardware identifier of a network card) was assigned which IP address at a specific time. This allows investigators to pinpoint the exact physical or virtual device that was using the suspicious IP address when the communication occurred.

E. Firewall Logs:

Purpose:
Firewalls control and log traffic between network segments, typically between a trusted internal network and untrusted external networks like the internet.

Why it's critical:
Firewall logs will contain records of outbound connection attempts from internal hosts to external IP addresses. By reviewing these logs for connections to the known malicious IP address of the C2 server, you can identify the internal IP address of the compromised host that was trying to "phone home."

Analysis of Incorrect Options:

A. Application Logs:
These logs record events related to specific software applications (e.g., web server, email client). While they might show suspicious activity after a host is compromised, they are unlikely to be the primary source for identifying the initial outbound C2 communication to an external IP.

B. Authentication Logs:
These logs record login attempts, successes, and failures (e.g., Windows Security logs, SSH logs). They are crucial for investigating brute-force attacks or account compromises but are not directly relevant for identifying a host communicating with an external C2 server unless the C2 activity involved specific authentication events.

D. Network Logs (e.g., NetFlow, Packet Capture):
While this is a very strong candidate for deep analysis of the traffic itself, the generic term "Network logs" is often too broad. Firewall logs are a more specific and directly applicable type of network log that is explicitly listed as an option. In many contexts, "Network" might be considered correct, but given the specific options, Firewall is the precise and best choice.

F. Database Logs:
These logs record transactions, queries, and access to a database. They are vital for investigating data breaches after the fact to see what data was accessed or exfiltrated, but they are not the right tool for identifying which host on the network is infected and performing the C2 communication.

Reference:
This question falls under Exam Objective 4.8: Explain key aspects of digital forensics. A critical part of incident response and forensics is evidence acquisition and analysis. Logs from various sources are the primary evidence, and understanding which log type provides what specific piece of information (e.g., DHCP for IP-to-MAC mapping, Firewall for connection records) is a fundamental skill for security analysts.

Explanation:
MFP (Multi-Function Printer/Device) is a common office device that combines printing, scanning, copying, and faxing capabilities. The concern is about the confidentiality of documents that are printed and left unattended in the output tray, which is a significant data leakage risk.

Why it's correct:
This solution, often called secure print release or "pull printing," requires users to authenticate at the device (e.g., with a badge, PIN, or biometric factor) to release their print job. This ensures that the document is only printed when the user is physically present at the MFP to collect it, preventing sensitive documents from being left unattended for unauthorized individuals to see or take.

The other options are less effective or address different problems:

A. Educate users about the importance of paper shredder devices.
While user education is important and shredders are necessary for destroying physical documents, this is a procedural control that relies on human compliance. It does not prevent documents from being left unattended; it only mitigates the disposal risk after the fact. The question asks for a mitigation for documents left unattended, not improperly disposed of.

C. Install a software client on every computer authorized to use the MFPs.
This does not solve the core problem. The software client might be for managing print drivers or queues, but it does nothing to prevent a printed document from sitting in an output tray. The vulnerability is physical access to the printed page, not the computer sending the job.

D. Update the management software to utilize encryption.
Encryption is crucial for protecting data in transit (e.g., from the computer to the MFP) and at rest (on the MFP's hard drive). This would protect against someone electronically stealing the document file from the MFP. However, it does not mitigate the risk of a physical, printed copy being left in the output tray. The concern is about the confidentiality of the physical documents, not the digital data.

Reference:
This question falls under Exam Objective 2.2: Explain various types of vulnerabilities. It specifically addresses physical security vulnerabilities related to data leakage. Mitigating risks from shared devices like MFPs is a common physical security control. CompTIA emphasizes the need for layered security (physical, technical, administrative), and secure print release is a key technical control for this physical threat.

Explanation:
Applying patches, especially high-priority ones, to production systems carries inherent risk. The change control process is a formalized procedure designed to manage these risks effectively.

Why it's the first step:
Before any technical action is taken, the proposed change must be documented, evaluated for potential impact, tested (if possible), and approved by the appropriate stakeholders (e.g., a Change Advisory Board). This ensures that:

The patch has been vetted and is appropriate for the system.

All relevant parties (business owners, IT teams, security) are aware of the change and its potential downtime.

A backout plan is in place in case the patch causes issues.

The change is recorded for auditing and compliance purposes.

Skipping this step to apply a patch immediately, even a high-priority one, can lead to unplanned downtime, system instability, or security issues if the patch is incompatible.

The other options are technical actions that may be part of the patching process but should not be done first without proper authorization:

A. Air gap the system:
Air gapping means physically disconnecting a system from all networks. This is an extreme measure for highly sensitive systems and is not a standard first step for patching a production system. It would make the system unavailable, which may not be acceptable for a production environment, and should only be done if the change control process dictates it.

B. Move the system to a different network segment:
This might be a step taken later to isolate the system for testing the patch in a staging environment that mimics production. However, moving a production system without authorization could cause service disruptions. This action would require a change request to be approved first.

D. Apply the patch to the system:
This is the actual implementation of the change. It should never be the first step. Applying a patch without going through change control is a violation of standard IT governance practices and can lead to severe consequences.

Reference:
This question falls under Exam Objective 5.2: Explain the importance of policies to organizational security. A core policy is change management, which requires that all changes follow a documented process to maintain stability, security, and accountability. CompTIA emphasizes that even urgent changes must go through an accelerated but documented process to avoid unintended side effects.

Explanation:
A serverless framework (e.g., AWS Lambda, Azure Functions, Google Cloud Functions) is a cloud-based execution model where the cloud provider dynamically manages the allocation and provisioning of servers. The user only writes and uploads the application code, and the provider runs it in response to events (e.g., an HTTP request) without requiring the user to manage any underlying infrastructure (servers, VMs, etc.).

Why it meets the requirements:

Cloud-based:
It is inherently a cloud service.

Low-cost:
The pricing model is typically based on the actual compute time consumed (often in milliseconds) and the number of executions, rather than paying for pre-allocated, always-on server capacity. This makes it extremely cost-effective for applications with variable or sporadic traffic, as there is no cost when the code is not running.

The other options are related to cloud or network technologies but do not directly provide a low-cost, application-hosting solution:

B. Type 1 hypervisor:
This is bare-metal virtualization software (e.g., VMware ESXi, Microsoft Hyper-V) that allows multiple virtual machines (VMs) to run on a single physical host. While it is used to build cloud infrastructure, it is not itself a cloud-based hosting solution. It requires the organization to purchase, manage, and maintain the physical hardware and hypervisor software, which is not "low-cost" in terms of operational overhead and capital expenditure.

C. SD-WAN (Software-Defined Wide Area Network):
This is a technology for managing and optimizing wide area network connections (e.g., connecting branch offices to a central network or the cloud). It is a networking solution, not an application-hosting platform.

D. SDN (Software-Defined Networking):
This is an architecture that separates the network control plane from the forwarding plane, allowing centralized management and programmability of network resources (e.g., routers, switches). Like SD-WAN, it is a networking technology and not a platform for hosting applications.

Reference:
This question falls under Exam Objective 1.4: Explain the techniques used in securing cloud and virtualization environments. Understanding different cloud service models—including Serverless (Function as a Service - FaaS)—and their cost implications is a key part of the SY0-701 curriculum. Serverless is highlighted for its scalability and cost-efficiency for specific use cases.

Explanation:
A honeytoken is a digital piece of data that has no legitimate production use and is designed to detect unauthorized access or misuse. Its value lies in being accessed; any interaction with it is considered a malicious event.

Why it's correct:
In this scenario, the fake account credentials (username and password) stored in a spreadsheet are the honeytoken. The credentials themselves are the "bait." Placing them in a "non-readily accessible directory" and setting an alert specifically for when the spreadsheet is opened are classic honeytoken deployment techniques. The moment an attacker or malicious insider finds and opens that spreadsheet, the alert triggers, signaling a potential breach.

The other options are related deception techniques but describe different concepts:

A. Honeypot:
This is a decoy system (e.g., a server, network, or application) designed to attract attackers. It mimics a real production system to study attack methods and divert threats away from genuine assets. A honeypot is an entire system, not just a piece of data like a set of credentials.

B. Honey account:
This is not a standard term in cybersecurity deception technology. While it descriptively refers to a fake account used as bait, the broader and technically accurate category for this is a honeytoken (as credentials are a type of token).

D. Honeynet:
This is a network of multiple honeypots. It's a larger-scale deception environment designed to simulate a whole network segment for attackers to interact with, providing a richer source of intelligence on attack patterns. Again, this is a system or network, not a single piece of data.

Reference:
This question falls under Exam Objective 4.2: Explain the purpose of mitigation techniques used to secure the enterprise. Deception technologies like honeytokens, honeypots, and honeynets are proactive defense mechanisms used to detect and mislead attackers. Understanding the distinction between these terms is essential for the SY0-701 exam. Honeytokens are particularly effective for detecting insider threats and credential-based attacks.

Explanation:
A Virtual Private Network (VPN) is a technology that creates a secure, encrypted tunnel over a public network (like the internet) to connect a remote user or site to a private company network.

Why it's correct:
The key phrases are "remote access" and "without interception concerns." VPNs are specifically designed to provide secure remote access by encrypting all data transmitted between the remote employee's device and the corporate network. This encryption prevents eavesdropping and interception by unauthorized parties, ensuring the confidentiality and integrity of the communication.

The other options are related to network security but do not primarily provide secure remote access for off-site employees:

A. Proxy server:
A proxy server acts as an intermediary for requests from clients seeking resources from other servers. It can provide anonymity, content filtering, and caching, but it does not inherently create an encrypted tunnel for all traffic from a remote user. It is not a solution for providing comprehensive, secure remote network access.

B. NGFW (Next-Generation Firewall):
An NGFW is an advanced firewall that provides traditional firewall capabilities plus additional features like integrated intrusion prevention, application awareness, and deep packet inspection. While it is a critical security device at the network perimeter that can terminate VPN connections, it is not the solution itself. The solution enabling the secure access is the VPN; the NGFW is the device that often facilitates it.

D. Security zone:
A security zone is a logical segment of a network (e.g., DMZ, internal zone) where devices with similar security requirements are grouped together and protected by firewall rules. This is a design concept for organizing and protecting network resources, not a technology that provides remote access for employees.

Reference:
This question falls under Exam Objective 3.1: Compare and contrast security implications of different architecture models. Secure remote access via VPN is a fundamental concept. CompTIA emphasizes the use of VPNs to provide confidentiality and integrity for data in transit over untrusted networks, which is a core requirement for off-site employees.

Explanation:
The first step in establishing or revitalizing a security program, especially after incidents like account compromises, is to define the rules and expectations formally. This is done through policies and procedures.

Why it's the first step:
Before launching awareness campaigns, deploying tools, or conducting tests like phishing simulations, there must be a foundational document that outlines what is expected of employees. Updated policies and handbooks provide this foundation.

They formally define:

Acceptable use of company resources.

Password requirements and management rules.

Procedures for reporting security incidents.

Consequences for policy violations.

Without this clear, documented baseline, any subsequent security awareness activities (like training or newsletters) lack authority and consistency. Employees cannot be held accountable for following rules that are not officially communicated.

The other options are valuable components of a security awareness program but should come after the policies are updated:

A. Evaluate tools that identify risky behavior and distribute reports on the findings.
This is an excellent technical control (e.g., User Entity Behavior Analytics - UEBA) for detecting misuse, but it is reactive and operates based on the rules defined in the policies. Implementing tools without first defining the policy they enforce is putting the cart before the horse.

B. Send quarterly newsletters that explain the importance of password management.
This is a good awareness activity, but it is an ongoing effort, not a foundational first step. Newsletters should reinforce the rules already established in the company's security policy.

C. Develop phishing campaigns and notify the management team of any successes.
Phishing simulations are a great way to test and train employees. However, they should be conducted within the framework of a defined security awareness program. Running a phishing campaign without first updating the policy that explains why it's being done and how to respond can lead to confusion and mistrust among employees.

Reference:
This question falls under Exam Objective 5.1: Explain the importance of policies, plans, and procedures related to organizational security. The first step in any security initiative is almost always to create or update the governing policy. This provides the framework for all subsequent technical controls, training, and enforcement actions. CompTIA emphasizes a policy-first approach to building a security culture.

Explanation:
Full Disk Encryption (FDE) is a security measure that encrypts all the data on a device's storage drive. The encryption is transparent to the user after they unlock the device with their credentials (e.g., PIN, password, biometrics).

Why it's correct:
If a mobile device with FDE enabled is lost or stolen, the data on the drive remains encrypted and inaccessible without the proper authentication key. This prevents an attacker from reading the contents, even if they remove the drive and attempt to access it from another system.

The other options are security technologies but are not primarily used for encrypting a mobile device's entire drive:

A. TPM (Trusted Platform Module):
This is a hardware chip on a computer's motherboard that stores encryption keys, passwords, and certificates securely. It is often used to enhance FDE solutions (like BitLocker on Windows) by storing the encryption keys in hardware, making them harder to steal. However, a TPM itself does not perform the encryption; it secures the keys that FDE uses. Many mobile devices do not have a discrete TPM.

B. ECC (Elliptic Curve Cryptography):
This is a type of public-key cryptography based on the algebraic structure of elliptic curves. It is used for key exchange (e.g., in SSL/TLS) and digital signatures. It is an encryption algorithm, not a solution for encrypting a device's drive.

D. HSM (Hardware Security Module):
This is a physical computing device that safeguards and manages digital keys. It is used for strong authentication and providing cryptoprocessing. HSMs are typically external devices or network appliances used by servers (e.g., for SSL termination, code signing) and are not built into mobile devices for whole-disk encryption.

Reference:
This question falls under Exam Objective 2.4: Explain security concerns associated with various types of vulnerabilities. Mobile device encryption, specifically FDE, is a critical control for protecting data at rest against loss or theft. CompTIA emphasizes the importance of encryption as a fundamental data protection measure.

Explanation:
In a formal change management process, management review is a critical step to ensure that proposed changes are evaluated for various impacts, including security, before they are approved and implemented.

Why it's the most likely step:
The change management process typically includes a Change Advisory Board (CAB) or similar governing body composed of stakeholders from management, IT, security, and business units. This board reviews the proposed change to assess its necessity, potential risks (including security vulnerabilities), impact on operations, and alignment with organizational policies. Management review provides the necessary oversight to prevent changes that could introduce security issues or disrupt business operations.

The other options are related to the change management lifecycle but are not the primary step for ensuring security issues are addressed prior to implementation:

B. Load testing:
This is a type of performance testing conducted to understand how a system behaves under expected and peak loads. While it is an important step for validating the stability of a change, it is typically performed after the change has been approved but before full deployment (often in a staging environment). It is not the primary step for evaluating security implications.

C. Maintenance notifications:
These are communications sent to users and stakeholders to inform them of planned downtime or disruptions due to the change. This step occurs after the change has been approved and scheduled, not before, as part of the implementation plan.

D. Procedure updates:
If a change is significant, it may require updates to documentation and procedures. However, this is typically done after the change has been implemented and validated, to ensure documentation reflects the new state accurately. It is not a pre-implementation step for security review.

Reference:
This question falls under Exam Objective 5.2: Explain the importance of policies to organizational security. Change management processes are a key policy area, and CompTIA emphasizes the role of management review and approval (e.g., through a CAB) in mitigating risks associated with changes. This ensures that security considerations are integrated into the change lifecycle from the beginning.

Explanation:
The core issue is that lost phones are being used for social engineering attacks. This means unauthorized individuals are gaining physical access to the devices and likely using the data and apps on them to trick other employees. The goal is to prevent this access and misuse.

Here’s why Screen locks and Remote wipe are the best choices to address this specific issue:

A. Screen locks:
This is a preventive control. Enforcing a strong screen lock (via PIN, password, pattern, or biometrics) is the first line of defense. It prevents the finder or thief from easily accessing the phone's contents, apps, email, and contact list, which are the tools they would use to perform social engineering attacks. If they can't get into the phone, they can't use it maliciously.

B. Remote wipe:
This is a reactive control.If a phone is reported lost or stolen, the IT/Security team can issue a remote wipe command via the MDM. This command will completely erase the device's data, returning it to factory settings. This ensures that even if the screen lock is bypassed (which is very difficult on modern phones with strong encryption), the sensitive company data and personal information used for social engineering are permanently destroyed.

Analysis of Other Options:

C. Full device encryption:
While encryption is absolutely critical for protecting data at rest, it is often enabled automatically on modern mobile devices when a screen lock is set. Its protection is transparent and works in tandem with the screen lock. However, if an attacker has physical access to a powered-on phone that is not locked, they may bypass encryption. The screen lock is the gatekeeper. While important, the question asks for the best features to address the immediate issue of phones being "used maliciously," which is directly stopped by the screen lock and remote wipe.

D. Push notifications:
This feature allows the MDM to send messages to the device. It is useful for communication but does nothing to prevent unauthorized access or misuse of a lost phone.

E. Application management:
This allows the company to control which apps are installed and how they work. While important for overall security (e.g., preventing malicious apps), it does not directly address the threat of physical access to a lost device.

F. Geolocation:

This feature can help find a lost phone on a map. While useful for recovery, it does not prevent the malicious use of the phone. By the time you are using geolocation, the phone is already lost and potentially being misused.

Reference:
This question falls under Exam Objective 3.5: Explain the importance of physical security controls. Mobile Device Management (MDM) is a key technical control for enforcing physical security policies on mobile assets. The CompTIA objectives specifically include concepts like remote wipe and screen locks as critical features for mitigating the risks associated with lost or stolen devices.

Explanation:
Cross-site scripting (XSS) is a type of security vulnerability commonly found in web applications. It allows attackers to inject malicious scripts into webpages viewed by other users (clients). These scripts execute in the victim's browser, enabling the attacker to hijack user sessions, deface websites, or redirect the user to malicious sites.

Key Characteristics:
XSS attacks specifically target the client's web browser by exploiting vulnerabilities in web-based applications that fail to properly validate or sanitize user input. The injected script is delivered to and executed by the client, not the server.

The other options describe different types of vulnerabilities or attacks:

A. SQL injection:
This vulnerability allows attackers to interfere with the queries an application makes to its database. It typically targets the database layer (server-side), not the client's browser. Attackers can view, modify, or delete database data through SQL injection.

C. Zero-day exploit:
This refers to an attack that exploits a previously unknown vulnerability (a "zero-day") in software or hardware. It is a broad term that describes the timing of the exploit (before a patch is available) rather than a specific technique like injecting scripts into browsers.

D. On-path attack (formerly known as man-in-the-middle attack):
This occurs when an attacker secretly intercepts and potentially alters the communication between two parties who believe they are directly communicating with each other. It targets network communication rather than web application code execution in a browser.

Reference:
This question falls under Exam Objective 2.3: Explain various types of vulnerabilities. Cross-site scripting (XSS) is a common web application vulnerability that CompTIA specifically highlights. Understanding how XSS works (client-side execution) and how it differs from other injection attacks like SQL injection (server-side) is fundamental for the SY0-701 exam.