SY0-701 CompTIA Security+ Exam 2026 Free Practice Exam Questions (2026 Updated)

A host-based firewall controls incoming and outgoing network traffic on a device by enforcing security rules, effectively blocking unwanted or insecure communications. It is specifically designed to protect the device from unauthorized access and malicious traffic.

System hardening (A) reduces vulnerabilities by disabling unnecessary services and patching but does not control communications dynamically. Intrusion detection systems (C) detect suspicious traffic but typically do not block it (unless paired with prevention). Anti-malware (D) protects against malicious software but not directly network communication filtering.

Host-based firewalls are a fundamental component of endpoint security highlighted in the Security Operations domain of SY0-701【6:Chapter 11†CompTIA Security+ Study Guide】.

The IT manager is creating a Business Continuity Plan (BCP). A BCP describes how an organization will continue to operate during and after a disaster or global incident. It ensures that critical business functions remain operational despite adverse conditions, with a focus on minimizing downtime and maintaining essential services.

Physical security relates to protecting physical assets.

Change management ensures changes in IT systems are introduced smoothly, without disrupting operations.

Disaster recovery is a subset of business continuity but focuses specifically on recovering from IT-related incidents​​.

The log entries show repeated attempts to access directories using patterns such as ../, which is a common directory traversal attack technique. Directory traversal (or path traversal) aims to access files and directories outside the web server ' s root directory by manipulating file paths. The ../ sequence is used to move up one directory level, which attackers exploit to try and retrieve sensitive files.

Environmental variables store configuration settings, paths, and other system-related information that applications and processes use. If an attacker gains access to these variables, they could manipulate them to alter application behavior, gain unauthorized access, or escalate privileges.For example, an attacker could modify the PATH variable to execute malicious programs instead of legitimate ones. This can significantlyincrease the scope and impact of an exploited vulnerability, making it a major security concern.

An Intrusion Prevention System (IPS) is designed to automatically block or mitigate malicious network traffic in real time. Unlike an IDS, which only detects threats, an IPS performs inline traffic inspection and takes active action—such as dropping malicious packets, blocking connections, or updating firewall rules. This matches the requirement for an automated system that responds immediately to inbound threats.

Security+ SY0-701 highlights IPS as a preventive control that detects signature-based, anomaly-based, and behavioral threats, including exploits, malware, and command-and-control activity. IPS systems are essential in defending against fast-moving attacks where human response time is too slow.

UEM (A) manages endpoints but does not block inbound network threats.

WAF (C) protects web applications, not the entire network.

VPN (D) provides secure tunnels but does not prevent malicious inbound traffic.

Thus, B: IPS is the best solution for automatic threat blocking.

Masking is a method to secure credit card data that involves replacing some or all of the digits with symbols, such as asterisks, dashes, or Xs, while leaving some of the original digits visible. Masking is best to use when a requirement is to see only the last four numbers on a credit card, as it can prevent unauthorized access to the full card number, while still allowing identification and verification of the cardholder. Masking does not alter the original data, unlike encryption, hashing, or tokenization, which use algorithms to transform the data into different formats.

The requirements point to a cloud-delivered, remote-user-first architecture that provides secure connectivity and security controls as an integrated service. Secure Access Service Edge (SASE) matches this because it combines remote connectivity capabilities (often replacing or modernizing traditional VPN approaches) with cloud-based security services, including firewalling, in a way that supports distributed users and resilient global access. The Study Guide explicitly states: “Secure Access Service Edge (SASE… ) combines virtual private networks, SD-WAN, and cloud-based security tools like firewalls, cloud access security brokers (CASBs), and zero-trust networks to provide secure access for devices regardless of their location.” This directly aligns with a fully remote workforce (“regardless of their location”), VPN capability, and an integrated firewall (“cloud-based security tools like firewalls”).

Why the other options don’t fit as well: IPS is a specific protective control, not an end-to-end remote access architecture; SIEM is for log aggregation/correlation and monitoring, not VPN + firewall delivery; and CASB is a component used to enforce cloud policy, but the guide distinguishes it as a policy enforcement point rather than a full connectivity + firewall architecture: “A CASB is a policy enforcement point…” . Therefore, SASE is the best match.

Data in transit is data that is moving from one location to another, such as over a network or through the air. Data in transit is vulnerable to interception, modification, or theft by malicious actors. A VPN (virtual private network) is a technology that protects data in transit by creating a secure tunnel between two endpoints and encrypting the data that passes through it2.

This is a compensating control because the organization cannot apply the preferred control, which would be patching or replacing the end-of-service server. Instead, it uses network segmentation to reduce exposure and limit the risk. A compensating control is an alternative safeguard used when the primary security requirement cannot be implemented due to technical, operational, or business constraints. Moving the server to a segmented network does not fix the vulnerability itself, so it is not corrective. It may reduce attack paths, but the key issue is that it substitutes for the missing patching capability. A deterrent control discourages unwanted behavior, such as warning signs or legal notices. A preventive control directly blocks incidents, but here the more precise classification is compensating.

================

802.1X is a network access control protocol that provides an authentication mechanism to devices trying to connect to a LAN or WLAN. It supports the use of certificates for authentication, can quarantine unapproved devices, and ensures that only approved and updated devices can access network resources. This protocol best meets the requirements of securing both wired and wireless networks with internal certificates.

References = CompTIA Security+ SY0-701 study materials, particularly in the domain of network security and authentication protocols​​.

When the government bans a vendor, the legal concern is sanctions—laws that restrict purchasing, using, or importing products from certain companies or countries. The general counsel’s job is to ensure the organization is not violating federal restrictions, export controls, trade compliance laws, or sanctions lists such as OFAC or government procurement bans.

Security+ SY0-701 notes that legal and regulatory compliance is a critical part of risk management, especially when handling prohibited vendors or technologies. Continued use of banned devices could expose the organization to legal penalties, fines, or federal investigation.

Data sovereignty (B) refers to data storage location laws, not hardware bans. Cost of replacement (C) is an operational concern, not a legal one. Loss of license (D) typically applies to software, not network hardware.

Therefore, the general counsel’s primary concern is A: Sanctions.

The best answer is D. ARO.

ARO (Annualized Rate of Occurrence) measures how often a specific incident or event is expected to happen in a single year. This is the risk analysis attribute that directly represents yearly frequency.

Why the other options are incorrect:

A. RTORecovery Time Objective is the target time to restore operations after a disruption. It does not measure incident frequency.

B. ALEAnnualized Loss Expectancy estimates the expected yearly financial loss from a risk. It is calculated using other values and reflects cost, not frequency alone.

C. SLESingle Loss Expectancy is the monetary loss expected from one occurrence of an incident. It does not represent how often the event happens.

From the SY0-701 perspective, risk calculations often use:

ALE = SLE × ARO

Since the question asks how frequently an incident is expected to happen each year, the correct answer is ARO.

Side loading refers to the process of installing applications on a device from outside the official app store, which can introduce security vulnerabilities by bypassing standard app validation processes.References: Security+ SY0-701 Course Content​, Security+ SY0-601 Book​.

This example of a script injection attack would be best mitigated by input sanitization. Input sanitization involves cleaning or filtering user inputs to ensure that they do not contain harmful data, such as malicious scripts. This prevents attackers from executing script-based attacks (e.g., Cross-Site Scripting or XSS).

Nmap command is unrelated to input sanitization, as it is a network scanning tool.

Email phishing attempts require different mitigations, such as user training.

Browser warnings about insecure connections involve encryption protocols, not input validation​

The best answer is A. Helping identify unauthorized or unmanaged devices connected to the network.

An effective IT asset tracking system maintains visibility into the hardware, software, and devices that are authorized to exist in the environment. One major security benefit is that it helps identify systems that are:

unauthorized

unmanaged

missing required security controls

unknown to administrators

This improves inventory control and helps security teams detect rogue or noncompliant devices.

Why the other options are incorrect:

B. Preventing prohibited data exfiltration from endpoints on the networkPreventing exfiltration is more directly the role of DLP and related controls, not asset tracking alone.

C. Assisting with automated root cause analysis for all security incidents on the networkAsset tracking can support investigations, but it does not automatically perform root cause analysis for all incidents.

D. Ensuring proper data backup and recovery procedures are in placeBackup and recovery are separate operational processes, not a direct benefit of asset tracking itself.

From the SY0-701 perspective, maintaining an accurate asset inventory is foundational for identifying unauthorized or unmanaged devices, so A is the correct answer.

Theprimary goal of corrective controls in financial systems is to ensure that errors do not propagate across interconnected systems. Financial transactions are ofteninterdependent, meaning one incorrect or unauthorized change can affect multiple systems. Regulations often mandate these controls tomaintain accuracy and prevent cascading failures.

A (insider threats altering banking details)is a concern, but thisscenario focuses on corrective controls, not insider threats specifically.

C (business insurance)is unrelated to why corrective controls are implemented.

D (preventing unauthorized changes)falls underpreventive, notcorrectivecontrols.

Firmware is a type of software that is embedded in a hardware device, such as a router, a printer, or a BIOS chip. Firmware controls the basic functions and operations of the device, and it can be updated or modified by the manufacturer or the user. Firmware version is a hardware-specific vulnerability, as it can expose the device to security risks if it is outdated, corrupted, or tampered with. An attacker can exploit firmware vulnerabilities to gain unauthorized access, modify device settings, install malware, or cause damage to the device or the network. Therefore, it is important to keep firmware updated and verify its integrity and authenticity. References = CompTIA Security+ Study Guide with over 500 Practice Test Questions: Exam SY0-701, 9th Edition, Chapter 2, page 67. CompTIA Security+ SY0-701 Exam Objectives, Domain 2.1, page 10.

The correct answer is C. ARO.

ARO stands for Annualized Rate of Occurrence. It estimates how often a specific event is expected to occur in one year. When deciding whether to keep or remove insurance coverage for a specific type of incident, such as ransomware, an organization may evaluate how likely that event is to occur annually.

This aligns with CompTIA Security+ SY0-701 risk management concepts, especially quantitative risk analysis and risk treatment decisions.

Why the other options are incorrect:

A. MTTR

Mean Time to Repair measures the average time required to restore a system or service after failure. It does not estimate how often ransomware will occur.

B. RTO

Recovery Time Objective defines the maximum acceptable time to restore a system or business process after an outage. It is important for business continuity but does not measure event frequency.

D. MTBF

Mean Time Between Failures measures the expected time between failures for a system or component. It is not typically used to evaluate ransomware insurance coverage.

Therefore, the most likely analysis element is ARO.

To analyze malware behavior in detail, the best approach is toexecute the malware in a sandbox (D)andcapture its network activity. This providesreal-time analysisof how the malware behaves, spreads, and communicates.

This method is highlighted inDomain 2.1under " Analyzing indicators of compromise " and usingsandboxing and packet captureto study malware.

An insider threat is a type of attack that originates from someone who has legitimate access to an organization’s network, systems, or data. In this case, the domain user who encrypted the files on the database server is an example of an insider threat, as they abused their access privileges to cause harm to the organization. Insider threats can be motivated by various factors, such as financial gain, revenge, espionage, or sabotage.

An Incident Response Plan (IRP) is the most relevant document because the scenario is about detective and corrective activities after or during security events. Phishing, social engineering, and business email compromise are incident categories that require predefined escalation paths, containment actions, communication steps, evidence handling, and recovery procedures. SDLC focuses on secure software development, not operational response. BCP focuses on maintaining business operations during disruption, and AUP defines acceptable user behavior. The IRP tells security teams how to detect, analyze, contain, eradicate, and recover from incidents. For Security+, this aligns directly with incident response preparation and operational procedures for common attack types.

The best answer is C. Data retention.

To avoid unnecessary liability after the end of a legal contract obligation with a third party, an organization should follow a proper data retention policy. Data retention policies define how long data must be kept and when it should be deleted or securely destroyed once it is no longer needed for legal, contractual, regulatory, or business purposes.

Keeping third-party data longer than necessary can increase:

legal exposure

privacy risk

breach impact

storage and governance burden

Why the other options are incorrect:

A. Data encryptionEncryption protects data confidentiality, but it does not address whether the data should still be retained at all.

B. Data classificationClassification helps determine sensitivity and handling requirements, but it does not define when data should be disposed of.

D. Data inventoryAn inventory helps identify what data exists, but it does not by itself reduce liability after contractual obligations end.

From the SY0-701 perspective, reducing liability after contractual or legal obligations end requires proper retention schedules and secure disposal, so C is the correct answer.

Anair-gapped (C)system is completely isolated from unsecured networks (like the internet) and other systems, preventing any form of remote access. This is often used in highly sensitive environments such as military, nuclear, or critical infrastructure systems.

This is mentioned underDomain 3.4: Given a scenario, apply cybersecurity resilience conceptsin theCompTIA Security+ SY0-701 Exam Objectives, specifically under“Isolation (e.g., air-gapped)”.

Detailed Explanation:The correct sequence is to first establish secure baselines by determining the required configurations, deploy those configurations across systems, and finally maintain the configurations through regular updates and auditing. Reference: CompTIA Security+ SY0-701 Study Guide, Domain 4: Security Operations, Section: " Secure Baseline Development " ​​.

Job rotation is a security control that involves regularly moving employees to different roles within an organization. This practice helps prevent incidents where a single employee has too much control or knowledge about a specific job function, reducing the risk of disruption when an employee leaves. It also helps in identifying any hidden issues or undocumented processes that could cause problems after an employee ' s departure.

Detailed Explanation:Host isolation ensures that a device is separated from the network, preventing it from accessing or being accessed by other network resources. This is typically achieved by quarantining the device. Reference: CompTIA Security+ SY0-701 Study Guide, Domain 4: Security Operations, Section: " Isolation and Containment " ​​.

Web serverBotnet Enable DDoS protectionUser RAT Implement a host-based IPSDatabase server Worm Change the default application passwordExecutive KeyloggerDisable vulnerable servicesApplication Backdoor Implement 2FA using push notification

A screenshot of a computer program Description automatically generated with low confidence

The best answer is A. Ensure the firewall data plane moves to fail-closed mode.

The key detail in this question is that the company prioritizes data confidentiality over transaction availability. In Security+ terms, when confidentiality is more important than keeping traffic flowing during a failure or security event, the preferred behavior is fail closed.

A fail-closed firewall blocks traffic if the device experiences a fault, failure, or security issue. This protects sensitive business data from being exposed or passed through an untrusted state. Even though this may interrupt business transactions, it aligns with the organization’s priority of protecting confidential information.

Why the other options are incorrect:

B. Implement a deny-all rule as the last firewall ACL rule.This is a standard firewall best practice, but it does not specifically address what should happen in case a security event occurs.

C. Prioritize business-critical application traffic through the firewall.This focuses on availability and performance, not confidentiality.

D. Configure rate limiting between the firewall interfaces.Rate limiting may help with traffic control or DoS reduction, but it does not best address the requirement to prioritize confidentiality during a security event.

From the SY0-701 perspective, when asked to choose between keeping systems available and preventing unauthorized access or data exposure, fail closed is the best security-focused answer.

 A nation-state is a threat actor that is sponsored by a government or a political entity to conduct cyberattacks against other countries or organizations. Nation-states have large financial resources, advanced technical skills, and strategic objectives that may target critical systems such as military, energy, or infrastructure. Nation-states are often motivated by espionage, sabotage, or warfare12. References = 1: CompTIA Security+ SY0-701 Certification Study Guide, page 542: Threat Actors – CompTIA Security+ SY0-701 – 2.1, video by Professor Messer.

A tabletop exercise is a discussion-based simulation in which stakeholders review and talk through their roles, responsibilities, and actions in response to a hypothetical incident. This allows participants to evaluate and improve response plans without actual disruption.

A load balancer best supports the availability requirement because it distributes client traffic across available backend resources and can route traffic away from failed or overloaded systems. When properly implemented with multiple servers or redundant service instances, load balancing improves uptime, resilience, and service continuity. A proxy server forwards requests and may provide filtering or caching, but it does not inherently guarantee application availability. A jump server provides controlled administrative access to internal systems, not client-facing service continuity. Geographic restrictions limit access based on location and may actually reduce availability for some users. Security+ places load balancing under resilient architecture because it helps maintain access when individual systems fail or become saturated.

A Certificate Signing Request (CSR) is a request sent to a certificate authority (CA) to issue an SSL certificate. The CSR contains information like the public key, which will be part of the certificate.References: Security+ SY0-701 Course Content​, Security+ SY0-601 Book​.

This describes a time-of-use issue, commonly associated with time-of-check to time-of-use race conditions. The key clue is that the user authenticates, but the unauthorized write operation occurs seconds later when the website is under heavy load. In a race condition, the application checks a security condition at one point in time but uses the result later, after the state may have changed. Heavy load can widen this timing gap and make exploitation more likely. CSRF tricks an authenticated user’s browser into submitting an unwanted request. SQLi injects malicious SQL into database queries. XSS injects scripts into web pages viewed by users. Because the issue is caused by timing between authentication and write execution, TOU is the best answer.

================

Intellectual property is a type of data that consists of ideas, inventions, designs, or other creative works that have commercial value and are protected by law. Employees in the research and development business unit are most likely to use intellectual property data in their day-to-day work activities, as they are involved in creating new products or services for the company. Intellectual property data needs to be protected from unauthorized use, disclosure, or theft, as it can give the company a competitive advantage in the market. Therefore, these employees receive extensive training to ensure they understand how to best protect this type of data. References = CompTIA Security+ SY0-701 Certification Study Guide, page 90; Professor Messer’s CompTIA SY0-701 Security+ Training Course, video 1.2 - Security Concepts, 7:57 - 9:03.

The most direct and immediate consequence of non-compliance with local data privacy regulations is fines. CompTIA Security+ SY0-701 emphasizes that privacy and data protection laws (such as GDPR, HIPAA, or regional privacy statutes) include explicit financial penalties for organizations that fail to meet compliance requirements. These fines are measurable, enforceable, and frequently cited by regulators as primary enforcement mechanisms.

While reputational damage (B) and contractual implications (D) are serious secondary effects, they are indirect and harder to quantify. Sanctions (C) typically apply in geopolitical or trade contexts rather than routine privacy enforcement. Boards of directors are often most responsive to clearly defined financial exposure; fines provide a concrete, defensible rationale for allocating additional budget to compliance, tooling, staffing, and process improvements.

Security+ SY0-701 highlights risk communication to executives using quantifiable impacts. Presenting the likelihood and magnitude of regulatory fines directly supports a cost-benefit analysis and demonstrates fiduciary responsibility. Therefore, A: Fines is the most appropriate consequence to present.