Free Security+ Practice Test: 575 SY0-701 Questions (2026)

Question 1. A company implements a policy requiring employees to use smart cards combined with a PIN to access the server room. Which security concept does this BEST demonstrate?

• Least privilege
• Multifactor authentication
• Role-based access control
• Single sign-on

Answer: B. Multifactor authentication combines something you have (smart card) with something you know (PIN). These are two distinct authentication factor categories.

Question 2. An organization wants to ensure that sensitive documents cannot be copied to USB drives. Which security control type is being implemented?

• Detective
• Corrective
• Preventive
• Compensating

Answer: C. Blocking USB drive usage is a preventive control — it stops the unauthorized action before it occurs. Detective controls identify events after the fact; corrective controls fix them.

Question 3. Which of the following BEST describes the concept of non-repudiation?

• Ensuring data has not been modified in transit
• Guaranteeing a sender cannot deny having sent a message
• Verifying a user's identity before granting access
• Encrypting data so only the intended recipient can read it

Answer: B. Non-repudiation prevents a party from denying an action they performed, typically achieved through digital signatures. Integrity (A), authentication (C), and confidentiality (D) are related but distinct concepts.

Question 4. A security administrator is implementing a zero trust architecture. Which principle is MOST fundamental to this approach?

• All internal network traffic is trusted by default
• Never trust, always verify — regardless of network location
• Perimeter firewalls are sufficient to protect internal assets
• VPN connections grant full access to all internal resources

Answer: B. Zero trust assumes no implicit trust based on network location. Every access request must be authenticated, authorized, and encrypted — whether it originates inside or outside the corporate network.

Question 5. Which of the following describes the gap analysis process in security?

• Identifying the difference between current security posture and desired security state
• Scanning for open ports on a network
• Testing an application for SQL injection vulnerabilities
• Monitoring network traffic for anomalies

Answer: A. A gap analysis compares an organization's current security controls against a target framework or standard (e.g., NIST, ISO 27001) to identify where improvements are needed.

Question 6. An employee receives an email that appears to be from the CEO requesting an urgent wire transfer. The email address uses a domain that is one letter different from the company's actual domain. What type of attack is this?

• Vishing
• Whaling
• Smishing
• Pharming

Answer: B. Whaling is a spear-phishing attack specifically targeting high-level executives or impersonating them. The lookalike domain is a common whaling technique called typosquatting.

Question 7. A security analyst discovers that attackers are exploiting a vulnerability in a web application that the vendor has not yet released a patch for. What type of vulnerability is this?

• Legacy vulnerability
• Zero-day vulnerability
• Default configuration vulnerability
• Backdoor vulnerability

Answer: B. A zero-day vulnerability is one that is actively exploited before the vendor is aware of it or has released a fix. The term "zero-day" refers to the vendor having zero days to address the issue.

Question 8. Which type of malware specifically encrypts files and demands payment for the decryption key?

• Trojan
• Rootkit
• Ransomware
• Keylogger

Answer: C. Ransomware encrypts the victim's data and demands a ransom payment (usually in cryptocurrency) in exchange for the decryption key. Trojans disguise themselves as legitimate software, rootkits hide their presence, and keyloggers record keystrokes.

Question 9. An attacker sets up a rogue wireless access point with the same SSID as the corporate Wi-Fi network. Employees unknowingly connect to it. What is this attack called?

• Bluesnarfing
• Evil twin
• Replay attack
• ARP poisoning

Answer: B. An evil twin attack uses a rogue access point that mimics a legitimate network's SSID. Victims connect to the attacker's AP, allowing the attacker to intercept traffic in a man-in-the-middle position.

Question 10. During a penetration test, the tester discovers that a web application is vulnerable to an attack where user input is reflected back in the browser without sanitization. Which vulnerability is this?

• SQL injection
• Cross-site scripting (XSS)
• Cross-site request forgery (CSRF)
• Directory traversal

Answer: B. Cross-site scripting (XSS) occurs when an application includes unvalidated user input in its output. Reflected XSS specifically bounces user input back in the server response without proper sanitization.

Question 11. A company wants to isolate its public-facing web servers from its internal network while still allowing controlled communication between them. Which network architecture should be implemented?

• Virtual private network (VPN)
• Demilitarized zone (DMZ)
• Network address translation (NAT)
• Software-defined networking (SDN)

Answer: B. A DMZ is a perimeter network segment that sits between the public internet and the internal network. It allows hosting public-facing services while protecting internal resources through firewall rules on both sides.

Question 12. Which cloud service model provides the customer with the MOST control over the underlying infrastructure?

• Software as a Service (SaaS)
• Platform as a Service (PaaS)
• Infrastructure as a Service (IaaS)
• Function as a Service (FaaS)

Answer: C. IaaS gives customers control over virtual machines, storage, and networking. The cloud provider manages the physical hardware. PaaS adds OS/runtime management by the provider, and SaaS manages everything except data and user access.

Question 13. A security architect recommends deploying a web application firewall (WAF) in front of the organization's e-commerce platform. What is the PRIMARY purpose of this control?

• To encrypt data in transit between the server and client
• To filter and monitor HTTP traffic for application-layer attacks
• To load balance traffic across multiple web servers
• To prevent DDoS attacks at the network layer

Answer: B. A WAF inspects HTTP/HTTPS traffic and blocks requests that match attack signatures like SQL injection, XSS, and other OWASP Top 10 threats. While it may offer some DDoS mitigation, its primary role is application-layer protection.

Question 14. An organization is deploying infrastructure using code templates that can be version-controlled and reproduced identically across environments. Which concept does this BEST describe?

• Containerization
• Infrastructure as Code (IaC)
• Microservices architecture
• Serverless computing

Answer: B. Infrastructure as Code (IaC) uses machine-readable definition files (e.g., Terraform, CloudFormation) to provision and manage infrastructure. This enables version control, reproducibility, and consistent deployments.

Question 15. Which of the following is an advantage of using hardware security modules (HSMs) for key management?

• HSMs are less expensive than software-based key storage
• HSMs provide tamper-resistant storage for cryptographic keys
• HSMs eliminate the need for key rotation policies
• HSMs automatically encrypt all data at rest on the network

Answer: B. HSMs are dedicated hardware devices designed to generate, store, and manage cryptographic keys in a tamper-resistant environment. They protect keys from extraction even if the host system is compromised.

Question 16. A SIEM system generates an alert for unusual outbound data transfers occurring at 3 AM from a database server. What should be the analyst's FIRST action?

• Immediately shut down the database server
• Validate the alert and determine if it is a true positive
• Contact law enforcement
• Begin forensic imaging of the server

Answer: B. The first step in incident response triage is to validate the alert. Many SIEM alerts are false positives. Before taking disruptive action like shutting down a server, the analyst should confirm the alert represents a real threat.

Question 17. Which log source would be MOST useful for investigating a suspected brute-force attack against a Windows domain controller?

• Web server access logs
• Windows Security event logs
• DNS query logs
• DHCP lease logs

Answer: B. Windows Security event logs (specifically Event IDs 4625 for failed logons and 4624 for successful logons) provide the authentication data needed to identify brute-force patterns against Active Directory.

Question 18. During a vulnerability scan, multiple systems are flagged for missing critical patches. The security team cannot immediately patch all systems due to production uptime requirements. Which approach is MOST appropriate?

• Ignore the vulnerabilities until the next maintenance window
• Prioritize patching based on risk assessment and apply compensating controls to high-risk systems
• Immediately patch all systems regardless of production impact
• Disable the vulnerability scanner to reduce alert fatigue

Answer: B. Risk-based prioritization balances security with business continuity. High-risk vulnerabilities on internet-facing systems get patched first, while compensating controls (IPS rules, network segmentation) mitigate risk until remaining systems can be patched.

Question 19. A company requires that all hard drives from decommissioned laptops be completely unrecoverable. Which data destruction method is MOST appropriate?

• Quick format
• Degaussing
• Physical shredding
• File deletion

Answer: C. Physical shredding is the most thorough data destruction method and renders data completely unrecoverable. Degaussing works for magnetic media but not SSDs. Quick format and file deletion leave data recoverable with forensic tools.

Question 20. A security analyst is reviewing firewall logs and notices repeated connection attempts from the same external IP to sequential port numbers on a server. What is this activity MOST likely?

• Denial-of-service attack
• Port scanning
• Man-in-the-middle attack
• DNS tunneling

Answer: B. Sequential connection attempts across port numbers is the signature pattern of a port scan. Attackers use port scanning to enumerate open services on a target system during the reconnaissance phase.

Question 21. An organization must comply with a regulation that requires personally identifiable information (PII) to be encrypted both in transit and at rest. Which compliance framework is MOST likely driving this requirement?

• PCI DSS
• GDPR
• SOX
• HIPAA

Answer: B. The GDPR (General Data Protection Regulation) specifically mandates the protection of PII for EU citizens and recommends encryption as a technical safeguard. While PCI DSS requires encryption of cardholder data and HIPAA covers health records, GDPR has the broadest PII protection scope.

Question 22. A risk assessment identifies a potential threat with a likelihood rating of "Medium" and an impact rating of "High." Using a qualitative risk matrix, how should this risk be categorized?

• Low risk
• Medium risk
• High risk
• Critical risk

Answer: C. In a standard qualitative risk matrix, Medium likelihood combined with High impact typically results in a High risk rating. This combination warrants active risk treatment (mitigation, transfer, or avoidance).

Question 23. Which of the following BEST describes the purpose of a Business Impact Analysis (BIA)?

• To identify all vulnerabilities in an organization's systems
• To determine the effect of disruption on critical business functions and establish recovery priorities
• To test the organization's incident response plan
• To audit compliance with regulatory requirements

Answer: B. A BIA identifies critical business processes, quantifies the impact of their disruption (in terms of revenue, operations, and reputation), and establishes recovery time objectives (RTOs) and recovery point objectives (RPOs).

Question 24. An organization decides to purchase cyber insurance to address the financial impact of a potential data breach. Which risk management strategy is this?

• Risk avoidance
• Risk mitigation
• Risk transfer
• Risk acceptance

Answer: C. Purchasing insurance is the classic example of risk transfer — the financial burden of the risk is shifted to a third party (the insurer). The organization still owns the risk but transfers the financial consequences.

Question 25. During a third-party vendor assessment, a security team discovers the vendor does not have a SOC 2 Type II report. What does this finding indicate?

• The vendor has not been audited for security, availability, and confidentiality controls over a period of time
• The vendor's software has not been penetration tested
• The vendor does not encrypt data in transit
• The vendor is not compliant with GDPR

Answer: A. A SOC 2 Type II report provides an independent auditor's assessment of a service organization's controls over a sustained period (typically 6-12 months). Its absence means there is no third-party assurance that the vendor's security controls are operating effectively over time.