• 125 questions

Security+ Practice Test

Questions for exam SY0-701, with the public text behind every answer, most often a NIST publication.

A user changes figures in a ledger without authorization. Which security objective has been lost?

Pick an answer, then press Check answer. Then you see Correct or Not quite, with the reason. Keys: A to D pick, Enter checks.

Print covers the next 90 questions. Share this set copies a link to the same questions in the same order.

Exam mode: 90 questions, 90 minutes.

More options

Unofficial practice questions, not affiliated with CompTIA. Bank checked October 6, 2026.

Next step Next level: CASP+ (SecurityX) questionsAnother IT certification? Pick it

All 125 questions

General security concepts 16

  • A browser needs to learn whether a certificate has been revoked. Which item is a list of revoked certificates that the certification authority creates and digitally signs? NIST glossary, "certificate revocation list" (FIPS 201-3)
  • A door lock, a firewall rule and a signed security policy are all controls. Which class of control is implemented and executed mainly by the system itself, through hardware, software or firmware? NIST glossary, "technical controls" (FIPS 200)
  • A motherboard chip generates keys, performs cryptographic operations and protects small secrets such as disk encryption keys. What is it? NIST glossary, "trusted platform module" (SP 800-147)
  • A user changes figures in a ledger without authorization. Which security objective has been lost? NIST glossary, "integrity" (FIPS 200)
  • A user has signed in successfully. Which step of AAA now decides whether that user may open a particular file share? NIST glossary, "authorization" (CNSSI 4009-2022)
  • A verifier stores each password after hashing it together with a random value that is unique to the account. What is that value called, and how long must it be under NIST SP 800-63B? NIST SP 800-63B-4, section 3.1.1.2
Show all 125 questions (119 more)

General security concepts, continued

  • An old lab instrument cannot run the endpoint agent that the baseline requires, so it is placed on an isolated network segment with extra monitoring instead. What kind of control is that? NIST glossary, "compensating controls" (SP 800-37 Rev. 2)
  • In a digital signature scheme, which key creates the signature and which key verifies it? FIPS 186-5, announcement, item 3 (Explanation)
  • In the NIST zero trust architecture, which logical component is responsible for the ultimate decision to grant a subject access to a resource? NIST SP 800-207, section 3
  • Security staff add fake database servers whose only purpose is to draw attacks so the attacks can be detected, deflected and analyzed. What does NIST SP 800-53 call such components? NIST SP 800-53 Rev. 5, control SC-26
  • Under NIST SP 800-53 control CM-4, what must happen before a change to a system is implemented? NIST SP 800-53 Rev. 5, control CM-4
  • What does an applicant send to a certification authority to apply for a certificate, containing the public key and signed by the applicant? NIST glossary, "certificate signing request"
  • Which key lengths does the Advanced Encryption Standard support? FIPS 197, section 1
  • Which property of a cryptographic hash function means it is computationally infeasible to find two different inputs with the same output? NIST glossary, "collision resistance" (SP 800-106)
  • Which service lets a third party verify that a signed message really came from the holder of a specific private key, so the signer cannot credibly deny it? NIST glossary, "non-repudiation" (FIPS 186-5)
  • Which statement is one of the tenets of zero trust in NIST SP 800-207? NIST SP 800-207, section 2.1

Threats, vulnerabilities and mitigations 27

  • A birthday attack on a hash function takes advantage of which fact? RFC 4949, definition of "birthday attack"
  • A caller claiming to be from the bank's fraud team pressures a clerk to read out a one-time code. Which term does CISA use for social engineering by voice? CISA, Avoiding Social Engineering and Phishing Attacks, "What is a vishing attack?"
  • A departing developer leaves code that will delete the sales database if his account is ever disabled. What is this code called? NIST glossary, "logic bomb" (CNSSI 4009-2022)
  • A free utility works as advertised but also carries a hidden malicious function. Which kind of malware is it? NIST glossary, "Trojan horse" (SP 800-12 Rev. 1)
  • A program accepts more input than the memory area set aside for it can hold, and the excess overwrites other information. Which condition is this? NIST glossary, "buffer overflow"
  • A program records which keys are pressed on a keyboard in order to obtain passwords or encryption keys. What is it called? NIST glossary, "key logger" (SP 800-82r3)
  • A user who is signed in to a bank visits an attacker's page, which silently makes the browser submit a transfer at the bank. Which attack is this? NIST glossary, "cross-site request forgery" (SP 800-63-4)
  • A web site lets an attacker inject malicious script into pages that other visitors' browsers then run with the site's permissions. Which vulnerability is this? NIST glossary, "cross-site scripting"
  • After gaining administrator access, an attacker installs tools that conceal the attacker's activity and keep that access through covert means. What are these tools called? NIST glossary, "rootkit" (CNSSI 4009-2022)
  • An adversary tampers with a software vendor's update so that the vendor's customers install the malicious code themselves. Which kind of attack is this? NIST glossary, "supply chain attack" (CNSSI 4009-2022)
  • An adversary with sophisticated expertise and significant resources uses several attack vectors to establish and extend a long-term presence inside a target's systems. What is this adversary called? NIST glossary, "advanced persistent threat"
  • An analyst opens a suspicious attachment in a restricted, controlled environment that cannot reach other system resources. What is that environment called? NIST glossary, "sandbox" (CNSSI 4009-2022)
  • An attacker records a valid login exchange and sends it again later to pose as the user. Which attack is this, and what does a nonce do about it? NIST glossary, "nonce" (CNSSI 4009-2022)
  • An attacker recovers a smart card's key by measuring how much power the card draws during each operation. Which class of attack is this? NIST glossary, "side-channel attack"
  • An attacker sends a server many requests to connect but never completes the three-way handshake, leaving its ports occupied. Which attack is this? CISA, Understanding Denial-of-Service Attacks
  • An attacker tries one common password against thousands of accounts, then a second password, and so on, to stay under the lockout threshold. Which attack is this? CISA, Alert TA18-086A, Brute Force Attacks Conducted by Cyber Actors
  • Attackers infect a trade association's web site because employees of the real target visit it often. Which attack is this? NIST glossary, "watering hole attack" (CNSSI 4009-2022)
  • Attackers use technical means to redirect users who typed the correct bank address to a fake site that collects their details. What is this attack called? NIST glossary, "pharming" (SP 800-44 Version 2)
  • In a virtualized server, an attacker breaks out of a guest operating system and reaches the hypervisor. What is this called? NIST SP 800-125, section 3.1
  • What does jailbreaking or rooting a phone do, according to NIST SP 800-124? NIST SP 800-124 Rev. 2, section 3.1.7
  • What makes an attack a zero-day attack? NIST glossary, "zero-day attack" (CNSSI 4009-2022)
  • Which attack tries every word in a large list as the password for an account? RFC 4949, definition of "dictionary attack"
  • Which kind of malicious code is a self-contained program that propagates by itself across networks, without attaching to another program? NIST glossary, "worm" (CNSSI 4009-2022)
  • Which malware encrypts the files on a device so that they are unusable, after which the actors demand payment for decryption? CISA, Ransomware 101
  • Which principle says a system should restrict each user's access privileges to the minimum necessary to accomplish assigned tasks? NIST glossary, "least privilege" (CNSSI 4009-2022)
  • Which process aims to eliminate a means of attack by patching vulnerabilities and turning off nonessential services? NIST glossary, "hardening" (SP 800-152)
  • Which social engineering technique uses a fraudulent email or web site in which the sender masquerades as a legitimate business to obtain sensitive data? NIST glossary, "phishing" (SP 800-12 Rev. 1)

Security architecture 23

  • A cloud infrastructure is provisioned for the exclusive use of a single organization and its business units. Which deployment model is it? NIST SP 800-145, section 2
  • A company rents virtual servers from a cloud provider. Under the NIST definition of Infrastructure as a Service, which part does the customer control? NIST SP 800-145, section 2
  • A data loss prevention system watches data in three states. Which state does it protect by inspecting endpoint actions such as copying to a USB drive? NIST glossary, "data loss prevention" (CNSSI 4009-2022)
  • A file server takes a full backup on Sunday. Which backup type, run each weeknight, captures only the files created or changed since the last backup of any type? NIST SP 800-34 Rev. 1, section 5.1.2
  • A research data set replaces each patient's name with a code so the records can still be linked without showing who the patient is. Which technique is this? NIST glossary, "pseudonymization" (SP 800-188)
  • An intrusion prevention sensor must be able to block attacks, not only report them. How does NIST SP 800-94 say it should be deployed? NIST SP 800-94, section 4.2.2
  • In which exercise do staff validate their readiness by performing their duties in a simulated operational environment, rather than only talking a scenario through? NIST SP 800-84, Executive Summary
  • Per NIST SP 800-82, which design keeps network traffic from passing directly between a corporate network and an operational technology (OT) network? NIST SP 800-82 Rev. 3, Executive Summary
  • Two systems have no physical connection, and data moves between them only by hand, under human control. What is this separation called? NIST glossary, "air gap" (CNSSI 4009-2022)
  • Under FIPS 199, a loss of confidentiality that could be expected to have a serious adverse effect on the organization has which potential impact level? FIPS 199, section 3
  • What is the attack surface of a system? NIST glossary, "attack surface" (SP 800-53 Rev. 5)
  • What is the Extensible Authentication Protocol (EAP)? RFC 3748, Abstract
  • Which alternate site is an environmentally conditioned work space that is only partially equipped with systems and telecommunications equipment? NIST glossary, "warm site" (SP 800-34 Rev. 1)
  • Which backup type stores every file created or modified since the last full backup, so a restore needs only the full backup and the latest one of this type? NIST SP 800-34 Rev. 1, section 5.1.2
  • Which business impact metric is the amount of time a mission or business process can be disrupted without causing significant harm to the organization's mission? NIST glossary, "maximum tolerable downtime" (SP 800-34 Rev. 1)
  • Which cloud service model gives the customer the provider's own applications to use, with at most limited user-specific settings to configure? NIST SP 800-145, section 2
  • Which component manages the guest operating systems on a host and controls the flow of instructions between them and the physical hardware? NIST glossary, "hypervisor" (SP 800-125)
  • Which firewall technology tracks the state of each connection and blocks packets that deviate from the expected state? NIST glossary, "stateful inspection" (SP 800-41 Rev. 1)
  • Which plan documents how an organization's mission and business processes will be sustained during and after a significant disruption? NIST glossary, "business continuity plan" (SP 800-34 Rev. 1)
  • Which strategy integrates people, technology and operations to establish variable barriers across multiple layers of the organization? NIST glossary, "defense-in-depth" (CNSSI 4009)
  • Which system can detect intrusive activity and also attempt to stop it, ideally before it reaches its targets? NIST glossary, "intrusion prevention system" (SP 800-82r3)
  • Which systems gather and process data and apply operational controls over long distances, as in power transmission and pipelines? NIST glossary, "supervisory control and data acquisition"
  • Which TLS versions does NIST SP 800-52 Rev. 2 require government servers to support? NIST SP 800-52 Rev. 2, Abstract

Security operations 34

  • A domain owner publishes a DNS record that lists the hosts allowed to send mail using its domain name. Which email control is this? RFC 7208, Abstract
  • A domain owner wants receivers to quarantine or reject mail that fails SPF and DKIM checks for its domain and to send back reports. Which mechanism publishes that policy? RFC 7489, Abstract
  • A file's owner decides who else may read it and sets those permissions personally. Which access control model is this? NIST glossary, "discretionary access control" (SP 800-192)
  • A fingerprint reader wrongly accepts an impostor. Which biometric error rate counts that kind of mistake? NIST glossary, "false accept rate" (CNSSI 4009-2022)
  • A photo printing site asks to read your pictures stored at another service without ever seeing your password for that service. Which framework is designed for this? RFC 6749, Abstract
  • A policy grants access only when the user's department, the document's sensitivity label and the time of day all match its conditions. Which access control approach is this? NIST glossary, "attribute-based access control"
  • A retired hard disk must be sanitized so that data recovery is infeasible even with state-of-the-art laboratory techniques, but the drive need not be physically ruined. Which sanitization method is that? NIST glossary, "purge" (SP 800-53 Rev. 5)
  • A vulnerability has a CVSS v3.1 base score of 9.1. Which qualitative severity rating does the specification give it? FIRST, CVSS v3.1 Specification Document, section 5
  • A vulnerability scanner reports a missing patch on a server that is in fact fully patched. What is this result called? NIST glossary, "false positive" (SP 800-115)
  • A web form passes whatever a visitor types straight to the database. Which practice, checking the validity of information inputs before they are used, is a main defense against injection? NIST SP 800-53 Rev. 5, control SI-10
  • A wireless network must check each user's own credentials against a central server instead of using one shared passphrase. Which service usually plays the Authentication Server behind an IEEE 802.1X authenticator? RFC 3580, Abstract and section 1.1
  • According to NIST SP 800-63B-4, when must a verifier force a user to change a password? NIST SP 800-63B-4, section 3.1.1.2
  • An authenticator app shows a six-digit code that changes on a timer. In the TOTP algorithm behind it, what is the default time step? RFC 6238, section 4.1
  • An encrypted drive is sanitized by sanitizing the keys that protect its data, so the stored ciphertext can no longer be decrypted. What is this technique called? NIST glossary, "cryptographic erase" (SP 800-88r2)
  • An examiner connects a suspect's disk through a device that allows reads but prevents any writes to it. What is the device? NIST glossary, "write-blocker" (SP 800-72)
  • An intrusion detection system compares observed events with profiles of normal behavior and flags significant deviations. Which detection method is this? NIST SP 800-94, section 2.3.2
  • An investigator must gather evidence from a running server. Following the order of volatility in RFC 3227, what is collected first? RFC 3227, section 2.1
  • In which access control model does a central authority make the access decisions, so that users cannot change the access rights on the objects they own? NIST glossary, "mandatory access control" (SP 800-192)
  • NIST SP 800-61 Rev. 3 recalls the earlier incident response life cycle of four phases. Which phase followed "detection and analysis"? NIST SP 800-61r3, section 2.1, Table 1
  • NIST SP 800-115 describes penetration testing in four phases. Which phase comes right after planning? NIST SP 800-115, section 5.2.1
  • One account and its authenticators give a user access to many applications without signing in again to each. What is this called? NIST glossary, "single sign-on" (SP 800-63-4)
  • Staff may install only apps that the organization has approved, and everything else is blocked. Which mobile application control does NIST SP 800-124 call preferable? NIST SP 800-124 Rev. 2, section 4.2.2
  • Under NIST SP 800-63B-4, what is the minimum length of a password used as the only authentication factor? NIST SP 800-63B-4, section 3.1.1.2
  • What is the Common Vulnerabilities and Exposures (CVE) list? NIST glossary, "common vulnerabilities and exposures" (CNSSI 4009-2022)
  • Which activity searches systems for indicators of compromise in order to detect, track and disrupt threats that have evaded existing controls? NIST SP 800-53 Rev. 5, control RA-10
  • Which catalog does CISA maintain as the authoritative source of vulnerabilities that have been exploited in the wild, for use in prioritizing remediation? CISA, Known Exploited Vulnerabilities Catalog
  • Which document contains instructions for configuring an IT product to an operational environment and for verifying that it has been configured properly? NIST glossary, "checklist" (SP 800-70)
  • Which document is agreed before a security test starts and gives the test team authority to carry out defined activities without asking for further permission? NIST glossary, "rules of engagement" (SP 800-115)
  • Which email control lets a sending domain attach a digital signature to a message so that receivers can verify the domain took responsibility for it? RFC 6376, Abstract
  • Which record tracks evidence through collection, safeguarding and analysis by documenting each person who handled it, when it was transferred and why? NIST glossary, "chain of custody" (SP 800-72)
  • Which standard uses XML-based request and response messages to exchange assertions about a signed-in user between an identity provider and a service? NIST glossary, "security assertion markup language" (CNSSI 4009-2022)
  • Which suite of specifications standardizes the format and naming used to communicate software flaw and security configuration information to machines and humans? NIST glossary, "security content automation protocol"
  • Which testing technique submits invalid, unexpected combinations of input to a running application to see how it reacts? NIST glossary, "fuzz testing" (SP 800-95)
  • Which tool generates, stores and compares message digests for files in order to detect changes made to them? NIST glossary, "file integrity checking" (SP 800-115)

Program management and oversight 25

  • A board states the types and amount of risk, on a broad level, that the company is willing to accept in pursuit of value. What has the board defined? NIST glossary, "risk appetite" (NISTIR 8286)
  • A company buys cyber insurance so that an insurer bears part of the cost of a breach. Which risk response is this? NIST SP 800-39, section 3.3
  • A group is authorized to emulate an adversary's attack capabilities against the company's security posture. What is this group called? NIST glossary, "red team" (CNSSI 4009-2022)
  • A payroll company handles employee records strictly on behalf of its client and under the client's instructions. What is the payroll company under the GDPR? Regulation (EU) 2016/679 (GDPR), Article 4(8)
  • After controls are in place, some risk still remains. What is that portion called? NIST glossary, "residual risk" (CNSSI 4009-2022)
  • An analyst rates each risk as low, medium or high instead of assigning dollar figures. Which kind of risk assessment is this? NIST glossary, "qualitative assessment" (SP 800-30 Rev. 1)
  • An awareness program sends staff harmless emails made to look like phishing, with no warning beforehand. What does NIST SP 800-53 call this kind of training activity? NIST SP 800-53 Rev. 5, control AT-2(1)
  • Before a vendor is shown design documents, both sides sign a paper listing the information they agree not to release to anyone else. What is it? NIST glossary, "non-disclosure agreement" (SP 800-47 Rev. 1)
  • Before users get access, they sign a statement of their responsibilities and expected behavior when using the system, much like an acceptable use policy. What does NIST SP 800-53 call these rules? NIST SP 800-53 Rev. 5, control PL-4
  • How does NIST define risk? NIST glossary, "risk" (CNSSI 4009-2022)
  • Two agencies will connect their systems. Which document do the owning organizations establish to define the responsibilities of all parties? NIST SP 800-47 Rev. 1, MOU/A Development Guide
  • Two organizations plan to connect their systems. Which document specifies the information security requirements for that connection? NIST glossary, "interconnection security agreement" (SP 800-47 Rev. 1)
  • Under NIST SP 800-53 control AT-3, who receives role-based security and privacy training? NIST SP 800-53 Rev. 5, control AT-3
  • Under the GDPR, which party determines the purposes and means of the processing of personal data? Regulation (EU) 2016/679 (GDPR), Article 4(7)
  • What does NIST call the aggregate of directives, regulations and rules that prescribe how an organization manages, protects and distributes information? NIST glossary, "information security policy" (CNSSI 4009-2022)
  • What is a key risk indicator? NIST glossary, "key risk indicator" (SP 800-55)
  • What is inherent risk? NIST glossary, "inherent risk" (NISTIR 8286)
  • Which agreement defines the specific responsibilities of a service provider and sets the customer's expectations for the service? NIST glossary, "service-level agreement" (CNSSI 4009-2022)
  • Which analysis examines how information is handled, to ensure the handling conforms to privacy requirements and to determine the privacy risks of a system? NIST glossary, "privacy impact assessment"
  • Which document is a central record of current risks and related information for a given scope or organization? NIST glossary, "risk register" (NISTIR 8170)
  • Which GDPR article gives a person the right to have personal data erased, the "right to be forgotten"? Regulation (EU) 2016/679 (GDPR), Article 17
  • Which method of risk analysis assigns numerical values to both impact and likelihood, based on statistical probabilities and a monetary valuation of loss or gain? NIST glossary, "quantitative risk analysis" (NISTIR 8286)
  • Which metric tracks the average time it takes to recover from a product or system failure? NIST glossary, "mean time to recovery" (SP 800-55)
  • Which official has statutory or operational authority for specified information and is responsible for establishing the controls for its generation, processing, dissemination and disposal? NIST glossary, "information owner" (FIPS 200)
  • Which process analyzes operational functions and the effect that a disruption might have on them? NIST glossary, "business impact analysis" (SP 800-34 Rev. 1)

How this list was compiled: Own questions, written to the five domains and weights of CompTIA's Security+ exam SY0-701 (version 7) as CompTIA publishes them at https://www.comptia.org/en-us/certifications/security/v7/ (read 2026-10-06). Facts were read on 2026-10-06 in public texts: the NIST glossary at csrc.nist.gov, NIST FIPS and Special Publications, CISA pages (social engineering, denial-of-service attacks, ransomware, alert TA18-086A and the Known Exploited Vulnerabilities catalog), IETF RFCs on rfc-editor.org, the CVSS v3.1 specification on first.org and Regulation (EU) 2016/679 on EUR-Lex. Each question names the text and section it was written from and links to it. Licence: Own work. Every question, wrong choice and explanation was written for this site from the public texts named in each question. Nothing is copied or reworded from a CompTIA exam, a released or sample question, or another practice product.

How it works

This unofficial Security+ practice test has 125 of our own questions on the five domains of CompTIA's SY0-701 objectives. It is not affiliated with CompTIA and takes nothing from the real exam.

Read the full guide

What the Security Plus exam asks

CompTIA's page for exam SY0-701 (version 7), read on October 6, 2026, gives at most 90 questions in 90 minutes, multiple-choice and performance-based. The domains are general security concepts 12%, threats, vulnerabilities and mitigations 22%, security architecture 18%, security operations 28% and security program management and oversight 20%.

Which version to study

CompTIA lists SY0-701 for retirement in English on June 11, 2027. Performance-based tasks are not in this bank.

  • NIST SP 800-63B-4 asks 15 characters for a password used alone and tells verifiers not to force periodic changes.
  • CVSS v3.1 rates 9.0 to 10.0 Critical and 7.0 to 8.9 High.
  • An incremental backup saves changes since the last backup of any type; a differential saves changes since the last full one (NIST SP 800-34).

Questions and answers

Is there a Security+ SY0-501 practice test?

CompTIA's page offers neither SY0-501 nor SY0-401. The Security+ exam it offers today is SY0-701, launched November 7, 2023, so this bank follows those objectives and keeps no separate test for an older code.

What is the passing score for Security+?

750 on a scale of 100 to 900, by CompTIA's SY0-701 page. That is a scaled score, not a percent, so exam mode here reports your percent right by domain and gives no verdict.

When does Security+ SY0-801 come out?

CompTIA expects version 8 on or around November 17, 2026, with wider coverage of AI-related risks and security operations. Version 7 stays available, and CompTIA calls it a strong option for anyone ready to certify now.

More tests

Show 7 more

Browse Safety and Trades