Free SY0-701 Practice Test Questions 2026

Explanation:
A compensating control is an alternative security measure put in place to satisfy a requirement that is too difficult or impractical to implement using primary controls. In this scenario, the business requirement is to allow user access to a high-risk website, which is inherently dangerous. Since the primary control (blocking access entirely) is not an option, a compensating control is needed to mitigate the associated risks.

Why it's correct:
Enabling threat prevention features on the firewall (such as IPS/IDS, antivirus scanning, malware detection, URL filtering, and content inspection) acts as a compensating control. It allows the traffic to the high-risk website but actively scans, monitors, and blocks any malicious content or threats that might come from that site, thereby reducing the risk to the organization.

The other options do not effectively compensate for the risk:

B. Configuring a SIEM tool to capture all web traffic:
This is a detective control, not a compensating control. It helps with logging, monitoring, and alerting on suspicious activity after it happens, but it does nothing to prevent the initial infection or attack from the high-risk site. It does not mitigate the risk; it only helps identify it post-compromise.

C. Setting firewall rules to allow traffic from any port to that destination:
This increases the risk rather than compensating for it. Opening any port (instead of just necessary ones like 80/443) exposes the network to additional attack vectors and violates the principle of least privilege. It is the opposite of a security control.

D. Blocking that website on the endpoint protection software:
This is a preventive control, not a compensating control. It outright denies access to the website, which contradicts the business requirement of providing user access. A compensating control works within the constraint of allowing access while reducing risk.

Reference:
This question falls under Exam Objective 5.3: Explain the importance of applicable regulations, standards, or frameworks that impact organizational security posture. Compensating controls are a key concept in risk management and compliance frameworks (e.g., NIST, ISO). CompTIA expects candidates to understand how to implement alternative controls when primary controls are not feasible, ensuring security needs are met without impeding business requirements.

Explanation:
The issue is that a legitimate retail website is being incorrectly categorized as "gambling" by the organization's content filter (often part of a secure web gateway or firewall). Content filters block access to websites based on their assigned categories (e.g., gambling, social media, shopping).

Why it's correct:
To resolve this, an administrator must update the categorization of the URL within the content filter's database or policy. This typically involves:

Manually overriding the category for that specific URL from "gambling" to "shopping" or "allowed."

Submitting the URL to the filter vendor for re-categorization (if using a cloud-based service).

This change will allow users to access the site while maintaining blocking for truly malicious or inappropriate categories.

The other options would not resolve the specific issue of incorrect categorization:

A. Creating a firewall rule to allow HTTPS traffic:
This is unnecessary because HTTPS traffic (port 443) is likely already allowed for general web browsing. The blockage is due to the content filter's policy, not a firewall rule blocking the port. The firewall is not the device making the categorization decision.

B. Configuring the IPS to allow shopping:
An Intrusion Prevention System (IPS) is designed to detect and prevent network attacks (e.g., exploits, malware). It does not categorize or block websites based on content type like gambling or shopping. This is not the correct tool for this issue.

C. Tuning the DLP rule that detects credit card data:
Data Loss Prevention (DLP) systems monitor and block the transmission of sensitive data (e.g., credit card numbers). Tuning a DLP rule might help if the site was blocked for accidentally triggering a data exfiltration alert, but the problem is explicitly that the site is flagged as "gambling," not that it is handling credit card data improperly.

Reference:
This question falls under Exam Objective 3.3: Given a scenario, implement secure network designs. Content filtering is a key component of network security architecture. CompTIA expects candidates to understand how web filters work, including how to manage and troubleshoot categorization issues to ensure business needs are met without compromising security.

Explanation:
When upgrading the firmware on a critical network device like a router, the primary concern is minimizing disruption to business operations. A maintenance window is a pre-approved, scheduled period during which system maintenance, upgrades, or changes can be performed with minimal impact on users.

Why it's correct:
Router firmware upgrades often require a reboot of the device, which will cause a network outage for all users relying on that router. Performing this upgrade during a maintenance window (e.g., late at night, on a weekend) ensures that the fewest number of users are affected. Following this practice is a standard part of change management and operational procedures.

The other options are not directly applicable to this specific task:

A. Software development life cycle (SDLC):
This is a framework for developing software applications, encompassing phases like planning, coding, testing, and deployment. It is not relevant to the operational task of applying a firmware patch to existing hardware.

B. Risk tolerance:
This is the level of risk an organization is willing to accept. While assessing risk is part of planning the upgrade (e.g., what could go wrong?), the specific procedural step the administrator would follow is the maintenance window to mitigate the risk of disruption.

C. Certificate signing request (CSR):
This is a message sent from an applicant to a certificate authority to apply for a digital identity certificate. It is used in PKI for securing communications (e.g., HTTPS) and has no relation to the process of upgrading router firmware.

Reference:
This question falls under Exam Objective 5.2: Explain the importance of policies to organizational security. Scheduled maintenance windows are a key component of change management policies. CompTIA emphasizes the need to perform disruptive changes during approved times to maintain system availability and minimize business impact.

Explanation:
A jump server (also known as a bastion host) is a dedicated server that provides an additional layer of security by acting as a single, controlled access point to internal resources. All administrative or remote access to sensitive systems (e.g., servers, network devices) must first pass through the jump server.

Why it's the best solution:

It prevents unauthorized direct access to internal resources by:
Concentrating all remote access traffic to one hardened and monitored system.

Reducing the attack surface (fewer systems exposed to the internet).

Allowing for strict access controls, logging, and auditing on the jump server itself.

Enforcing multi-factor authentication (MFA) and other security measures at a single chokepoint.

The other options do not primarily serve this purpose:

A. RDP server:
Remote Desktop Protocol (RDP) is a technology for accessing Windows systems remotely. While it can be secured, an RDP server itself is a target for attacks (e.g., brute-force, exploits). Exposing RDP directly to the internet without a jump server or other protection is a significant security risk.

C. Proxy server:
A proxy server acts as an intermediary for client requests, often for web traffic. It can provide caching, content filtering, and anonymity but is not typically used for securing administrative access to internal resources. Its primary role is to manage outbound traffic, not inbound access.

D. Hypervisor:
A hypervisor is software that creates and runs virtual machines. It is a virtualization platform, not a security gateway for accessing internal resources. While hypervisors have security features, they do not inherently prevent unauthorized access to internal systems.

Reference:
This question falls under Exam Objective 3.3: Given a scenario, implement secure network designs. Jump servers are a critical component of a zero-trust or defense-in-depth architecture, providing controlled access to management interfaces. CompTIA emphasizes the use of bastion hosts/jump servers to secure administrative workflows and protect sensitive infrastructure.

Explanation:
Effective security governance is fundamentally about establishing clear accountability and responsibility for security within an organization. This ensures that everyone understands their role in protecting assets and that there is oversight and ownership of security processes.

Why it's the most important:
Assigning roles such as owners (who set policies and accept risk), controllers (who implement controls), and custodians (who handle day-to-day security tasks) creates a structured framework for decision-making and execution. This clarity: Prevents gaps in security coverage.

Ensures compliance with policies and regulations.

Facilitates effective risk management.

Provides a chain of accountability for security incidents.

Without clearly defined roles and responsibilities, security efforts become fragmented, and critical tasks may be overlooked.

The other options are important but secondary to establishing accountability:

A. Discovering and documenting external considerations:
This refers to understanding legal, regulatory, and environmental factors (e.g., GDPR, industry standards). While crucial for compliance, it is part of the context in which governance operates, not the core of governance itself.

B. Developing procedures for employee onboarding and offboarding:
This is an operational security control within human resources. It is a procedural detail that falls under the broader governance framework but does not define governance.

D. Defining and monitoring change management procedures:
This is a critical process for maintaining system integrity and security. However, it is a specific operational procedure that is governed by the overarching framework of roles and responsibilities. Governance defines who oversees change management, not just how it is done.

Reference:
This question falls under Exam Objective 5.1: Explain the importance of policies, plans, and procedures related to organizational security. Security governance is a key theme, and CompTIA emphasizes the importance of clear roles and responsibilities (e.g., data owners, system owners) as the foundation for effective security management. This aligns with frameworks like NIST and ISO 27001, which stress accountability as a cornerstone of governance.

Explanation:
The incident occurred because the resigned employee was the sole person with knowledge and responsibility for managing the batch jobs, creating a single point of failure. When they left, the organization lacked the expertise to troubleshoot and resolve issues effectively.

Why job rotation is the best solution:
Job rotation involves periodically moving employees between different roles or responsibilities. This practice:

Cross-trains employees, ensuring multiple people are familiar with critical tasks (like managing batch jobs).

Reduces dependency on any single individual.

Mitigates the risk of knowledge loss when an employee leaves.

Enhances organizational resilience by building a team with diverse skills and shared responsibilities.

In this case, if job rotation had been implemented, other employees would have been trained to handle the batch jobs, preventing the disruption.

The other options are less effective or irrelevant:

B. Retention:
While retaining employees can reduce turnover, it does not address the core issue of knowledge siloing. Even with high retention, if only one person possesses critical knowledge, the risk remains. Retention is a human resources strategy, not a direct mitigation for operational knowledge gaps.

C. Outsourcing:
Outsourcing the batch jobs to a third party might transfer the responsibility, but it does not solve the internal knowledge gap. Additionally, outsourcing introduces new risks (e.g., vendor management, loss of control) and may not be cost-effective for this scenario.

D. Separation of duties (SoD):
SoD is designed to prevent fraud and errors by dividing critical tasks among multiple people (e.g., one person requests a change, another approves it). It is a control for reducing insider threats and conflicts of interest, not for ensuring knowledge redundancy or continuity. SoD would not have prevented the knowledge loss when the employee resigned.

Reference:
This question falls under Exam Objective 5.4: Explain the importance of personnel management. Job rotation is a key personnel management strategy that CompTIA highlights for reducing single points of failure and enhancing security through cross-training. It directly addresses the risk of knowledge silos, which is critical for business continuity and incident response.

Explanation:
The log entries show multiple failed login attempts (Event ID 4625) for the same user account (Administrator) from the same source IP address (10.10.10.10) within a very short timeframe. This pattern is characteristic of a brute-force attack, where an attacker systematically attempts numerous password combinations to gain unauthorized access to an account.

Key evidence:
The repeated failures with different logon types (e.g., Logon Type: 3 indicates network logon attempts) and the rapid succession of attempts suggest an automated tool is being used to guess passwords. The other options are less likely:

B. Privilege escalation:
This occurs after an attacker has already gained access to a system and attempts to elevate their permissions (e.g., from a user account to an administrator account). The log shows failed logins, not successful logins followed by permission changes.

C. Failed password audit:
A password audit typically involves reviewing password policies, strength, and compliance. It is a proactive administrative activity, not an attack pattern reflected in security logs.

D. Forgotten password by the user:
While a user might forget a password and attempt a few failed logins, the sheer volume and rapid pace of attempts (especially targeting a high-privilege account like Administrator) are inconsistent with typical user behavior. This pattern is automated and malicious.

Reference:
This question falls under Exam Objective 4.3: Given a scenario, analyze output from security technologies. Analyzing security logs (like Windows Event Logs) is a critical skill for identifying attacks. CompTIA emphasizes recognizing patterns indicative of brute-force attacks, which often target privileged accounts and use automated tools. Event ID 4625 (failed logon) is a key indicator for such attacks.

Explanation:
The scenario describes a text message that appears to be from a legitimate source (the payroll department) asking for sensitive information (credential verification). This is a classic social engineering attack.

B. Phishing:
This is a broad term for any attempt to trick individuals into providing sensitive information by pretending to be a trustworthy entity. The message is designed to "fish" for credentials.

E. Smishing:
This is a specific type of phishing attack that uses SMS (text messages) as the delivery method. The term is a portmanteau of "SMS" and "phishing." Since the attack arrives via text message, smishing is explicitly occurring.
The other options do not fit the scenario:

A. Typosquatting:
This involves registering domain names that are common misspellings of legitimate websites (e.g., g00gle.com instead of google.com). It is not a social engineering technique via text message.

C. Impersonation:
While the attacker is impersonating the payroll department, this is a component of the phishing attack itself.

Phishing/smishing are the specific techniques that use impersonation as a tactic.

D. Vishing:
This is phishing conducted via voice calls (e.g., phone scams). The attack here is via text message, not voice.

F. Misinformation:
This refers to spreading false or misleading information, but it is not a specific social engineering technique aimed at credential theft. The goal here is credential verification, not just spreading false information.

Reference:
This question falls under Exam Objective 1.1: Compare and contrast common attack vectors and threat actors. Understanding the various forms of phishing—including smishing and vishing—is essential for the SY0-701 exam. CompTIA expects candidates to differentiate between these delivery methods and recognize real-world examples.

Explanation:
A Statement of Work (SOW) is a formal document that outlines the specific tasks, deliverables, timelines, and estimated hours or effort required to complete a project. In the context of a penetration test engagement with a vendor, the SOW would detail:

The scope of the test (e.g., systems to be tested, types of testing allowed).

The estimated number of hours or days required.

Deliverables (e.g., report, executive summary).

Milestones and deadlines.

Costs associated with the effort.

The other options are types of agreements but do not typically include project estimates:

B. BPA (Business Partners Agreement):
This is a broad agreement that defines the terms of a business relationship between two parties, such as responsibilities and financial terms. It does not include detailed project estimates like hours for a specific engagement.

C. SLA (Service Level Agreement):
This defines the expected level of service, including metrics like uptime, response time, and resolution time. It is focused on ongoing service performance, not project-based estimates for a penetration test.

D. NDA (Non-Disclosure Agreement):
This is a legal contract that protects confidential information. It ensures that the vendor does not disclose sensitive information discovered during the penetration test but does not include project details like hours or deliverables.

Reference:
This question falls under Exam Objective 5.5: Explain the importance of agreements to organizational security. Understanding the purpose and components of various business agreements, especially the SOW, is crucial for managing vendor relationships and ensuring clear expectations for project-based work like penetration tests. CompTIA emphasizes the role of the SOW in defining scope, timelines, and costs.

Explanation:
A generator is a power source that can provide electricity for an extended period, typically by burning fuel (e.g., diesel, natural gas). It is designed to sustain critical operations during prolonged power outages, including multi-day events.

Why it's correct:
While an uninterruptible power supply (UPS) provides short-term battery backup (minutes to hours) to handle brief outages or allow for graceful shutdowns, a generator can take over and supply power for days or even weeks, as long as fuel is available. This makes it the ideal solution for ensuring continuous operation through a multi-day power outage. The other options are not primarily focused on power redundancy:

B. Uninterruptible power supply (UPS):
A UPS provides short-term battery power to bridge the gap between a power failure and the startup of a generator or to allow for a safe system shutdown. It is not designed to sustain a data center for multiple days.

C. Replication:
This refers to copying data to another location (e.g., for disaster recovery). While it ensures data availability, it does not address the power needs of the primary data center during an outage.

D. Parallel processing:
This is a computing technique where multiple processors simultaneously execute tasks to improve performance. It is unrelated to power availability or redundancy.

Reference:
This question falls under Exam Objective 2.2: Summarize the importance of physical security controls. Power redundancy, including generators and UPS systems, is a critical aspect of physical security and business continuity. CompTIA emphasizes the need for both short-term (UPS) and long-term (generator) power solutions to maintain operational resilience.

Explanation:
The question asks for the architecture model that offers the highest level of security for an international expansion, with a focus on keeping data secure at the new location.

Why on-premises is correct:
In an on-premises model, the organization has full control over the physical infrastructure, security policies, access controls, and data governance. This allows for tailored security measures, strict compliance with regulations, and no dependency on third-party providers. For highly sensitive data, maintaining direct physical and administrative control (on-premises) typically offers the highest security, as it minimizes external risks and exposure.

The other options introduce potential security trade-offs:

A. Cloud-based:
Cloud providers offer robust security features, but the shared responsibility model means the organization must trust the provider's infrastructure and practices. Data stored internationally may be subject to foreign laws (e.g., data sovereignty issues), and multi-tenant environments could pose risks (though major providers mitigate these effectively). While cloud security can be strong, it does not offer the same level of direct control as on-premises.

B. Peer-to-peer:
This decentralized model lacks centralized security management, making it difficult to enforce uniform policies, monitor threats, and protect data consistently. It is generally less secure for organizational data due to its inherent lack of control and scalability.

D. Hybrid:
This combines on-premises and cloud environments. While flexible, it introduces complexity in managing security across different platforms, potentially creating gaps in visibility and control. The attack surface increases, and ensuring consistent security policies becomes challenging.

Reference:
This question falls under Exam Objective 3.1: Compare and contrast security implications of different architecture models. CompTIA emphasizes that while cloud models can be secure, on-premises architectures provide the greatest level of direct control over data and infrastructure, which is often preferred for the highest security requirements, especially in regulated industries or for sensitive data.

Explanation:
A honeypot is a decoy system or network segment designed to attract and detect attackers. It mimics real assets (e.g., servers, applications) with intentional vulnerabilities to lure malicious actors. When attackers interact with the honeypot, their activities are monitored, and alerts are generated.

Why it fits:
The scenario describes hosting infrastructure with known vulnerabilities that appears to be company assets. This is a classic honeypot strategy. It allows the company to:

Detect reconnaissance and attack attempts early.

Study attacker techniques and tools.

Gather threat intelligence without exposing real assets.

The other options are unrelated to this deceptive approach:

A. Watering hole:
This attack targets users by compromising websites they frequently visit. The company is the victim, not the initiator.

B. Bug bounty:
A program where organizations reward ethical hackers for discovering and reporting vulnerabilities. It is a legitimate security initiative, not a deceptive trap.

C. DNS sinkhole:
A technique to redirect malicious domain requests to a controlled server, often used to disrupt botnets or malware communication. It does not involve hosting vulnerable decoy assets.

Reference:
This question falls under Exam Objective 4.2: Explain the purpose of mitigation techniques used to secure the enterprise. Honeypots are a proactive deception technology for threat detection and intelligence gathering. CompTIA emphasizes their role in identifying attackers during the reconnaissance phase.