SY0-701
Free CompTIA Security+ (SY0-701) Practice Test
12 exam-style questions with full explanations — no sign-up. Score yourself, then close your gaps with the full course.
Exam fee ~$4045 exam domainsLevel Intermediate2 timed practice tests in the course
✅ Free practice — no sign-up📝 Real exam-style questions💡 Detailed explanations💸 30-day money-back via Udemy
A data center posts signs at its perimeter stating 'Warning: This facility is under 24/7 video surveillance and armed response.' The signs themselves do not physically block entry or capture footage. What TYPE of security control does this represent?
A deterrent control discourages an attacker from attempting an action by making the risk of getting caught appear high, without physically stopping or detecting the act itself. Warning signage is the textbook example.
A security analyst discovers that a recently terminated employee used still-active VPN credentials to download proprietary source code from the company's Git repository three days after their last day of employment. Which threat actor category BEST describes this activity?
Insider threat refers to individuals with authorized (or recently authorized) access who misuse that access, including former employees exploiting credentials that were not promptly revoked.
A company migrates a fleet of web servers to an IaaS offering, running them as virtual machines on the provider's infrastructure. Under the cloud shared responsibility model, who is responsible for patching the guest operating system on these VMs?
In the IaaS model the provider secures and maintains the physical infrastructure, virtualization/hypervisor layer, and physical network. Everything above that line — guest OS, middleware, applications, and data — is the customer's responsibility, including OS patching.
A security analyst wants to prevent employees from copying sensitive customer records to USB flash drives while still allowing normal use of USB keyboards, mice, and other peripherals. Which solution BEST meets this requirement?
Host-based DLP with content inspection can selectively block file transfers to USB mass storage devices based on data classification while leaving other USB device classes (HID keyboards/mice) unaffected.
A risk analyst calculates the following for a data center flood scenario: Asset Value = $500,000, Exposure Factor = 20%, and Annualized Rate of Occurrence = 0.5. What is the Annualized Loss Expectancy (ALE)?
SLE = Asset Value x Exposure Factor = $500,000 x 0.20 = $100,000. ALE = SLE x ARO = $100,000 x 0.5 = $50,000.
An organization deploys a Zero Trust architecture per NIST SP 800-207. A user requests access to a sensitive file server. Which component evaluates the request against configured trust algorithms and policy, then issues the allow/deny decision?
The policy engine is the decision-making component of the zero trust control plane — it evaluates the access request against policy and trust algorithms and outputs a decision.
Employees at a manufacturing company routinely visit an industry trade association website to check equipment safety recalls. Attackers compromise this website and inject malicious JavaScript that only executes for visitors from the manufacturing company's IP range. Which type of attack does this describe?
A watering hole attack compromises a legitimate website frequently visited by a specific target group and delivers malicious content selectively to those targets.
An inline IDS appliance inspects all traffic to and from a hospital's patient-monitoring network segment before it reaches the core switch. The security team must decide how the device should behave if it loses power or crashes. Patient safety requires monitoring traffic to keep flowing even if inspection capability is lost. Which failure mode should be configured on this device?
Fail-open allows traffic to continue flowing uninspected if the device fails, prioritizing availability. In life-safety environments like patient monitoring, an outage of network connectivity can be more dangerous than a temporary loss of inspection, so fail-open is the appropriate choice here.
A company is migrating its enterprise wireless network to WPA3-Enterprise and wants centralized, per-user authentication using digital certificates instead of a shared passphrase. Which combination of technologies should be implemented?
802.1X provides the port-based authentication framework, EAP-TLS supplies mutual certificate-based authentication for each user/device, and RADIUS acts as the AAA server validating credentials centrally — this is the standard architecture for WPA3-Enterprise.
A company hires a contractor for a specific project and needs a document defining the exact deliverables, timeline, milestones, and payment schedule for that engagement. Which agreement type should be used?
A Statement of Work (SOW) specifies the exact scope, deliverables, timeline, and payment terms for a particular project or engagement.
A development team must store user passwords in a database in a way that resists both brute-force cracking and precomputed rainbow table attacks. Which approach BEST meets this requirement?
Salting ensures identical passwords produce different hashes (defeating rainbow tables), and key stretching (deliberately slow, iterative hashing like bcrypt/Argon2/PBKDF2) makes brute-force attacks computationally expensive per guess.
A developer writes code that checks whether a file exists and then, in a separate step, opens that file for writing. An attacker replaces the file with a symbolic link to a sensitive system file in the brief window between the check and the open operation. Which vulnerability type does this scenario describe?
This is a classic time-of-check-to-time-of-use (TOCTOU) race condition, where the state of a resource changes between validation and use, allowing an attacker to manipulate the outcome.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
$109.99 $34.99 with code FREETEST33 — valid through September 2.
Get my $34.99 deal →SY0-701 exam — quick answers
How much does the SY0-701 exam cost?
The exam fee is approximately $404 and varies by region — confirm current pricing with the certification vendor before you book.
What topics are on the exam?
It covers 5 domains: General Security Concepts (12%), Threats, Vulnerabilities, and Mitigations (22%), Security Architecture (18%), Security Operations (28%), Security Program Management and Oversight (20%). The full course has a dedicated chapter, lab and practice-test coverage for each.
Is this practice test really free?
Yes — all questions on this page are free with explanations and no sign-up. The paid Udemy course adds two full-length timed exams, video lessons and hands-on labs.
How do I get the discount?
Use code FREETEST33 at checkout for $34.99 (list $109.99) through September 2 — the enroll button applies it automatically.
Will this prepare me for the real exam?
The questions mirror the real exam's style and are mapped to the official domains. This is exam-focused preparation — combine the free test with the full course's timed simulations to gauge your readiness.