Free SY0-701 Practice Test Questions 2026

Explanation:
A VPN (Virtual Private Network) creates an encrypted tunnel between two endpoints (e.g., headquarters and a branch office) over a public network (like the internet). This encryption ensures that any data sent between these locations is protected from interception or eavesdropping.

Why it's correct:
The primary purpose of a site-to-site VPN is to safeguard data in transit—data actively moving between networks. It ensures confidentiality and integrity while the data is traversing untrusted networks.

The other options are not directly protected by a VPN:

A. Data in use:
This refers to data being actively processed by a computer (e.g., in RAM or CPU). VPNs do not encrypt data during processing; hardware-based solutions (like TPMs) or software controls are used for this.

C. Geographic restrictions:
VPNs can bypass geographic restrictions (e.g., for streaming services) by masking the user’s IP address, but they do not inherently "protect" these restrictions. In fact, organizations use VPNs to connect locations, not to enforce geo-blocking.

D. Data sovereignty:
This refers to laws requiring data to be stored and processed within specific geographic boundaries. A VPN encrypts data in transit but does not control where data is stored (data at rest). Data sovereignty is ensured through policy and infrastructure design, not encryption alone.

Reference:
This question falls under Exam Objective 3.1: Compare and contrast security implications of different architecture models. VPNs are a fundamental technology for securing data in transit between networks, a key concept in the CompTIA Security+ syllabus. Understanding what VPNs protect (and what they don’t) is essential for network security design.

Explanation:
Code signing is the process of digitally signing executables and scripts to confirm the identity of the software author and guarantee that the code has not been altered or corrupted since it was signed. This provides authenticity and integrity for the software.

Why it's the most appropriate:
By signing the code, the company can ensure that users (or other systems) can verify that the software genuinely originated from the company and has not been tampered with by malicious actors. This is directly aligned with the goal of ensuring authenticity.

The other options are important for security but do not primarily address code authenticity:

A. Testing input validation on the user input fields:
This is a security measure to prevent injection attacks (e.g., SQL injection, XSS). It ensures the software handles input safely but does not verify the authenticity of the code itself.

C. Performing static code analysis:
This is a method of debugging by examining source code before a program is run. It helps identify vulnerabilities and coding errors but does not provide a mechanism for verifying the origin or integrity of the compiled code.

D. Ensuring secure cookies are used:
This protects the confidentiality and integrity of cookies in web applications (e.g., by transmitting them only over HTTPS). It is unrelated to proving the authenticity of the software code.

Reference:
This question falls under Exam Objective 3.9: Explain public key infrastructure (PKI) concepts. Code signing relies on PKI (digital certificates) to authenticate software. CompTIA emphasizes the importance of code signing for ensuring trust in software distribution, preventing tampering, and verifying publisher identity.

Explanation:
Detective controls are designed to identify and respond to security incidents as they occur or after they have happened. In the context of a payroll system, insider threats involve authorized users who may attempt to manipulate data for fraudulent purposes (e.g., altering payment amounts, adding fake employees).

Why detective controls are best:

These controls include:
Audit logs tracking changes to payroll records.

Reconciliation processes comparing expected vs. actual payments.

Anomaly detection systems flagging unusual transactions.

Regular reviews of payroll reports by multiple parties.

These measures help uncover unauthorized or suspicious activities by insiders, enabling timely intervention.

The other options are less effective for addressing insider manipulation:

A. Compensating controls:
These are alternative measures used when primary controls are not feasible. While they can mitigate risk, they are not specifically tailored to detect insider threats in real time.

B. Deterrent controls:
These discourage malicious actions (e.g., warnings, policies). However, insiders may already understand the risks and proceed, making detection critical.

D. Corrective controls:
These remediate issues after detection (e.g., restoring backups, terminating access). They are reactive and rely on detective controls to trigger them.

Reference:
This question falls under Exam Objective 5.3: Explain the importance of policies, plans, and procedures related to organizational security. Detective controls, such as auditing and monitoring, are essential for identifying insider threats, a key focus in security governance. CompTIA emphasizes layered controls, with detective measures playing a crucial role in environments where trust is limited.

Explanation:
A hot site is a fully operational disaster recovery facility that is equipped with all necessary hardware, software, and data to resume business operations immediately or within a very short time frame (e.g., hours). It is configured to mirror the primary site and is kept in a constant state of readiness.

Why it meets the requirement:
The CISO's goal is to resume operations "as quickly as possible." A hot site provides the fastest recovery time (lowest RTO - Recovery Time Objective) because it requires minimal setup—personnel can simply transition to the site and continue working.

The other options involve longer recovery times or lack immediate readiness:

B. Cold site:
This is a basic facility with infrastructure (e.g., power, cooling) but no pre-installed hardware or data. It requires significant time to set up systems and restore data, leading to delays (days or weeks).

C. Geographic dispersion:
This involves distributing critical assets across multiple locations to reduce risk (e.g., data replication). While it enhances resilience, it does not itself constitute a recovery site where operations can quickly resume.

D. Warm site:
This is a partially equipped facility (e.g., some hardware and software) but requires additional configuration and data restoration. Recovery takes longer than a hot site (e.g., a day or more).

Reference:
This question falls under Exam Objective 4.5: Explain the key aspects of business continuity and disaster recovery. CompTIA emphasizes the differences between recovery sites (hot, warm, cold) and their impact on RTO. A hot site is the optimal choice for minimizing downtime when rapid recovery is critical.

Explanation:
A SIEM (Security Information and Event Management) system is designed to collect, aggregate, and analyze log data from various sources across an organization's infrastructure. This includes:

System logs (e.g., from servers and workstations)

Application logs (e.g., from databases and business software)

Network logs (e.g., from firewalls, routers, and switches)

The SIEM centralizes this data, correlates events, and generates alerts for suspicious activities, providing a comprehensive view of the security posture.

The other options are security tools but do not primarily focus on centralized log collection and analysis:

B. DLP (Data Loss Prevention):
This tool monitors and controls data transfer to prevent unauthorized exfiltration (e.g., blocking USB transfers or emailing sensitive files). It does not aggregate logs from diverse sources.

C. IDS (Intrusion Detection System):
This monitors network or host activities for signs of malicious behavior and generates alerts. While it produces logs, it does not centralize logs from other systems; instead, it is often a source of logs for a SIEM.

D. SNMP (Simple Network Management Protocol):
This is a protocol used for managing and monitoring network devices (e.g., routers, switches). It collects performance data (e.g., bandwidth usage, errors) but is not designed for security alerting or aggregating diverse logs like application and system events.

Reference:
This question falls under Exam Objective 4.3: Given a scenario, analyze output from security technologies. SIEM systems are a cornerstone of security monitoring, and CompTIA emphasizes their role in log aggregation, correlation, and alerting. Understanding SIEM capabilities is critical for effective threat detection and incident response.

Explanation:
An independent audit is conducted by a third-party auditor to evaluate and provide assurance that an organization's controls (e.g., security, financial, operational) are properly designed and operating effectively. The audit results in a formal report that offers objective verification, which is often required for regulatory compliance, stakeholder confidence, and certifications (e.g., ISO 27001, SOC 2).

Why it best achieves the objective:
The question emphasizes "assurance," which implies a high level of credibility and objectivity. Independent audits are specifically designed for this purpose, as they provide unbiased validation of control effectiveness.

The other options are valuable security assessments but do not primarily focus on comprehensive assurance of control design and operation:

A. Red teaming:
This is a simulated attack exercise where a team mimics real-world adversaries to test an organization's detection and response capabilities. While it assesses security posture, it is not a formal assurance process for control design and effectiveness across all domains.

B. Penetration testing:
This involves ethically hacking systems to identify vulnerabilities and exploit them. It focuses on technical weaknesses rather than providing broad assurance about control design and operational effectiveness.

D. Vulnerability assessment:
This is a systematic review of security weaknesses in systems and networks. It identifies flaws but does not verify whether controls are operating effectively or provide formal assurance.

Reference:
This question falls under Exam Objective 5.3: Explain the importance of applicable regulations, standards, or frameworks that impact organizational security posture. Independent audits are a key mechanism for demonstrating compliance and control effectiveness to regulators, customers, and partners. CompTIA emphasizes the role of audits in providing trusted assurance, unlike other assessments which are more technical or tactical.

Explanation:
An application allow list (formerly known as whitelisting) is a security mechanism that permits only pre-approved programs to execute on a system. All other software, including unknown or unauthorized programs, is blocked by default.

Why it's the best way:
This approach ensures that only trusted applications can run, effectively preventing malware, ransomware, and other unauthorized software from executing. It is a proactive control that aligns with the principle of least privilege.

The other options are valuable security controls but do not primarily focus on blocking unknown programs from executing:

A. Access control list (ACL):
ACLs regulate access to resources (e.g., files, network resources) based on user permissions but do not control which programs can execute on a system.

C. Host-based firewall:
This controls network traffic to and from a device based on rules (e.g., allowing/blocking ports and IP addresses). It does not prevent unknown programs from executing; it only restricts their network communication.

D. DLP (Data Loss Prevention) solution:
This monitors and blocks unauthorized transfer of sensitive data (e.g., preventing leaks via email or USB). It does not prevent program execution.

Reference:
This question falls under Exam Objective 3.2: Given a scenario, implement host or application security solutions.

Application allow listing is a critical endpoint protection technique highlighted by CompTIA for mitigating malware and unauthorized software execution. It is especially effective in environments requiring strict control over program execution.

Explanation:
SRTP (Secure Real-time Transport Protocol) is specifically designed to provide encryption, authentication, and integrity for real-time media streams, such as video and audio. It is an extension of the RTP (Real-time Transport Protocol) commonly used for streaming applications.

Why it's the best choice:
For IP cameras streaming live video, SRTP ensures:

Confidentiality:
Encrypts the video content to prevent eavesdropping.

Authentication:
Verifies the source of the stream to prevent impersonation.

Integrity:
Protects against tampering during transmission.

The other protocols are not suited for real-time video streaming:

A. SSH (Secure Shell):
This is used for secure remote command-line access and file transfers. While it encrypts traffic, it is not optimized for low-latency, real-time video streaming.

C. S/MIME (Secure/Multipurpose Internet Mail Extensions):
This is for securing email communications (encryption and signing). It is not designed for streaming media.

D. PPTP (Point-to-Point Tunneling Protocol):
This is an outdated and insecure VPN protocol. It has known vulnerabilities and is not recommended for use, especially for sensitive streams like video surveillance.

Reference:
This question falls under Exam Objective 3.1: Compare and contrast security implications of different architecture models. Understanding the appropriate protocols for specific use cases (e.g., SRTP for real-time media) is essential. CompTIA emphasizes the use of secure protocols like SRTP to protect IoT devices, such as IP cameras, from interception and tampering.

Explanation:
RBAC (Role-Based Access Control) is a security model that assigns permissions to users based on their roles within an organization. This simplifies access management by grouping users into roles (e.g., "HR Manager," "Developer") and granting each role the necessary permissions to perform their responsibilities.

Why it fits the scenario:
Prevents access based on responsibilities: Users only have access to data and resources required for their specific roles.

Simplified format:
Administrators can manage access at the role level rather than individually for each user, reducing complexity and errors. The other options are less suitable:

B. ACL (Access Control List):
This is a list of permissions attached to a resource (e.g., a file or folder) specifying which users or system processes can access it. While it controls access, it is not simplified or role-based; it requires managing permissions per user/resource, which can become cumbersome.

C. SAML (Security Assertion Markup Language):
This is an XML-based standard for exchanging authentication and authorization data between parties (e.g., for single sign-on). It is used for authentication, not for defining access structures based on responsibilities.

D. GPO (Group Policy Object):
This is a feature of Windows OS to manage user and computer settings in an Active Directory environment. While it can control access to some resources, it is not designed for granular data access based on roles and is less flexible than RBAC.

Reference:
This question falls under Exam Objective 3.7: Given a scenario, implement identity and account management controls. RBAC is a core access control model emphasized by CompTIA for simplifying permission management while enforcing the principle of least privilege. It is widely used in cloud environments (e.g., Azure RBAC for resource groups) and on-premises systems.

Explanation:
Hardening is the process of securing a system by reducing its attack surface. This involves applying security patches (if available), removing unnecessary services, configuring strict access controls, and implementing security best practices. For a legacy server running a critical business application, hardening is often the most practical and immediate way to mitigate risks without disrupting business operations.

Why it's the best way:
Legacy systems may no longer support modern security features or receive updates, but hardening can still significantly improve their security posture. It allows the organization to continue using the critical application while minimizing vulnerabilities.

The other options are less suitable:

A. Segmentation:
This involves dividing the network into segments to control traffic flow and limit the spread of threats. While useful for containing risks, it does not directly address the vulnerabilities on the legacy server itself.

B. Isolation:
This means completely disconnecting the system from the network. While it eliminates remote attack vectors, it may not be feasible for a critical business application that requires network access for users or other systems.

D. Decommissioning:
This involves retiring the legacy server and application. However, if the application is critical and cannot be easily replaced, decommissioning is not a viable option without significant business disruption.

Reference:
This question falls under Exam Objective 2.4: Explain security concerns associated with various types of vulnerabilities. Legacy systems are a common security challenge, and CompTIA emphasizes hardening as a key strategy to protect them when modernization or replacement is not possible. Hardening aligns with best practices for securing outdated but essential infrastructure.

Explanation:
802.1X is a port-based Network Access Control (NAC) protocol that provides authentication for devices trying to connect to a wired or wireless network. It integrates with existing authentication servers (like RADIUS) and can use certificates for secure authentication.

Why it meets all the requirements:
An existing internal certificate must be used: 802.1X supports certificate-based authentication (e.g., EAP-TLS), allowing the use of an internal PKI certificate.

Wired and wireless networks must be supported: 802.1X is designed for both wired and wireless IEEE 802 networks.

Any unapproved device should be isolated in a quarantine subnet: 802.1X can assign devices to specific VLANs based on authentication status. Unapproved devices can be placed in a restricted quarantine subnet.

Approved devices should be updated before accessing resources: 802.1X can work with NAC solutions to enforce posture checks (e.g., ensuring devices are patched) before granting full network access.

The other options are components of 802.1X or related technologies but do not fully meet the requirements alone:

B. EAP (Extensible Authentication Protocol):
This is an authentication framework used within 802.1X to define how authentication occurs (e.g., EAP-TLS for certificates). However, EAP itself is not a standalone solution for network access control; it is part of 802.1X.

C. RADIUS (Remote Authentication Dial-In User Service):
This is a protocol that provides centralized authentication, authorization, and accounting. It is often used as the backend server for 802.1X but does not itself enforce port-based access control or VLAN assignment.

D. WPA2 (Wi-Fi Protected Access 2):
This is a security standard for wireless networks. While it supports 802.1X for enterprise authentication (WPA2-Enterprise), it only applies to wireless networks and does not meet the requirement for wired support.

Reference:
This question falls under Exam Objective 3.4: Given a scenario, implement authentication and authorization solutions. 802.1X is a critical technology for securing network access, and CompTIA emphasizes its role in enforcing authentication, authorization, and posture checks for both wired and wireless devices. The requirements align perfectly with 802.1X capabilities, especially when combined with RADIUS and certificate-based authentication.

Explanation:
An application allow list (formerly known as whitelisting) restricts the execution of programs to only those that are pre-approved by the organization. This prevents unauthorized or malicious software, including malware, from being installed or run on a system.

Why it's the best protection:
Even if an employee attempts to install or run malware (e.g., by clicking on a malicious email attachment or downloading unsafe software), the allow list will block the execution unless the program is explicitly permitted. This directly addresses the risk of inadvertent malware installation.

The other options provide security benefits but are less effective at preventing malware installation:

A. Host-based firewall:
This controls network traffic to and from the device but does not prevent malware from being installed or executed locally. It might block malware from communicating externally after installation but is not a primary defense against installation.