More Practice / CompTIA Security+ (SY0-701)
CompTIA Security+ Practice Test
This module mirrors the exact layout of the SY0-701 exam blueprint. We have balanced our coverage across the five official domains: Security Operations leads with 28% of the material, alongside Threats, Vulnerabilities, and Mitigations at 22%. Program Management and Compliance occupies 20%, Security Architecture takes up 18%, and General Security Concepts covers the remaining 12%. You will encounter a realistic mix of security log analysis, policy evaluation, and mitigation selection.
About this CompTIA Security+ (SY0-701) Security+ practice test
Entering the cybersecurity arena requires solid proof that you understand threats, controls, and compliance frameworks. The CompTIA Security+ (SY0-701) is the globally recognized baseline that opens doors across both commercial businesses and defense industries. The exam is structured to ensure you can analyze an active network attack, choose the correct defensive control, and understand how modern cryptographic primitives secure data. We've built this practice material to feel practical and engaging, using plain-English breakdowns to dissect why a particular security control outclasses its alternatives.
CompTIA Security+ Practice Test sample questions
These starter questions help you launch a security+ mock test quickly. Swap them with your own worksheet, notebook, or textbook questions any time.
1. What type of attack intercepts communications between two parties without their knowledge?
- A) Phishing
- B) Man-in-the-Middle (MitM)
- C) SQL injection
- D) Brute force
2. Which cryptographic algorithm is asymmetric?
- A) AES
- B) 3DES
- C) RSA
- D) SHA-256
3. What is the purpose of multi-factor authentication (MFA)?
- A) To encrypt data
- B) To require two or more verification factors, making unauthorised access harder
- C) To monitor network traffic
- D) To patch vulnerabilities
4. What does a firewall primarily do?
- A) Encrypts data in transit
- B) Filters network traffic based on rules
- C) Detects malware
- D) Manages user identities
5. What is a zero-day vulnerability?
- A) A vulnerability that has been patched
- B) A flaw unknown to the vendor that has no available fix
- C) A vulnerability that only affects zero users
- D) A vulnerability in day-zero deployments
6. What does PKI stand for?
- A) Private Key Infrastructure
- B) Public Key Infrastructure
- C) Protected Key Interchange
- D) Primary Key Installation
7. Which type of malware encrypts the victim's files and demands payment?
- A) Spyware
- B) Adware
- C) Ransomware
- D) Worm
8. What is the principle of least privilege?
- A) Admins should have all permissions
- B) Users should be given only the minimum permissions needed to perform their job
- C) Permissions should be reviewed annually
- D) All users should have equal access
9. What is a honeypot in cybersecurity?
- A) A type of firewall
- B) A decoy system designed to attract and detect attackers
- C) A password manager
- D) An encryption key
10. Which protocol provides encrypted web communication?
- A) HTTP
- B) FTP
- C) HTTPS (TLS)
- D) SMTP
11. What does SIEM stand for?
- A) Security Information and Event Management
- B) Secure Identity and Encryption Module
- C) System Integrity and Error Monitoring
- D) Software Integration and Event Management
12. What is social engineering?
- A) A network attack using packets
- B) Manipulating people into revealing confidential information
- C) Exploiting software vulnerabilities
- D) Brute-forcing passwords
13. Which of the following is a symmetric encryption algorithm?
- A) RSA
- B) ECC
- C) AES
- D) Diffie-Hellman
14. What is the purpose of a digital certificate?
- A) To encrypt files on disk
- B) To bind a public key to an identity, verified by a Certificate Authority
- C) To store passwords securely
- D) To block network intrusions
15. What is a DDoS attack?
- A) Data deletion on storage
- B) Overwhelming a target with traffic from multiple sources to make it unavailable
- C) Stealing encrypted data
- D) Intercepting DNS queries
16. What does the CIA triad stand for in security?
- A) Central Intelligence Agency
- B) Confidentiality, Integrity, Availability
- C) Compliance, Identity, Authentication
- D) Certificate, Integrity, Authorisation
17. What is SQL injection?
- A) Inserting malicious SQL code into a query to manipulate a database
- B) Installing a database
- C) Sending spam emails
- D) Exploiting physical hardware
18. What is a VPN?
- A) A type of firewall
- B) A Virtual Private Network that encrypts traffic over a public network
- C) A cloud service
- D) An intrusion detection system
19. What does HTTPS use to secure communications?
- A) IPSec
- B) SSH
- C) TLS/SSL
- D) WPA3
20. What is an IDS vs an IPS?
- A) Both block traffic
- B) IDS detects threats and alerts; IPS detects and actively blocks threats
- C) IDS blocks traffic; IPS only alerts
- D) They are identical
21. What is phishing?
- A) A network scan
- B) A social engineering attack using deceptive emails or websites to steal credentials
- C) A type of malware
- D) A buffer overflow
22. What is the purpose of hashing in security?
- A) To encrypt data so it can be decrypted later
- B) To produce a fixed-length one-way digest used to verify data integrity
- C) To compress files
- D) To authenticate users
23. What is a brute force attack?
- A) Guessing passwords using a wordlist
- B) Systematically trying every possible combination of characters to crack a password
- C) Exploiting a known vulnerability
- D) Intercepting network packets
24. What does AAA stand for in security?
- A) Authentication, Authorisation, Accounting
- B) Access, Audit, Administration
- C) Application, Assessment, Assurance
- D) Availability, Accuracy, Accountability
25. What is the purpose of network segmentation?
- A) To increase bandwidth
- B) To divide a network into smaller zones to limit the spread of breaches
- C) To speed up DNS resolution
- D) To reduce hardware costs
26. What is a certificate authority (CA)?
- A) A type of firewall
- B) A trusted entity that issues and signs digital certificates
- C) A malware scanner
- D) A backup service
27. What does WPA3 protect in wireless networks?
- A) Wired connections
- B) Wi-Fi connections with stronger encryption and authentication than WPA2
- C) VPN tunnels
- D) DNS queries
28. What is the difference between a vulnerability and an exploit?
- A) They are the same thing
- B) A vulnerability is a weakness; an exploit is code or technique that takes advantage of that weakness
- C) An exploit is a weakness; a vulnerability takes advantage of it
- D) Vulnerabilities only exist in software; exploits only exist in hardware
29. What is a security baseline?
- A) The minimum acceptable security configuration for a system or device
- B) The maximum level of encryption
- C) A type of penetration test
- D) The starting salary for a security analyst
30. What is the purpose of a penetration test?
- A) To install security updates
- B) To simulate an attack to identify vulnerabilities before malicious actors do
- C) To monitor network logs
- D) To train new employees
Syllabus & Core Topics
Rather than memorizing endless firewall brands or protocol numbers, focus on core architectural pillars like defense-in-depth, zero trust, and least privilege. When you understand the underlying philosophy of these concepts, identifying the correct security posture in any scenario becomes second nature.
Why this practice page is useful
Distinguishing adware from active ransomware, or picking apart a social engineering trap, comes down to clear vocabulary — these questions present each threat type distinctly so the differences actually stick.
Symmetric and asymmetric algorithms blur together easily in memory; contrasting standard primitives like AES and RSA side by side makes the distinction concrete.
Terms like AAA, security baselines, and least-privilege access can sound alike on paper — these scenario answers spell out the boundaries that separate them.
Answer key & quick explanations
Short answers for the sample questions above. Use this to self-check before generating a fresh AI-built mock test.
1. What type of attack intercepts communications between two parties without their knowledge?
B) Man-in-the-Middle (MitM)A Man-in-the-Middle attack positions the attacker between two communicating parties so they can intercept, and sometimes alter, traffic without either party realizing it's happening. Phishing relies on deception rather than interception, SQL injection targets a database through malicious input, and brute force targets credentials through repeated guessing — none of them describe intercepting an existing communication channel.
2. Which cryptographic algorithm is asymmetric?
C) RSARSA is an asymmetric algorithm, using a mathematically related public/private key pair rather than one shared secret. AES and 3DES are both symmetric algorithms that use the same key to encrypt and decrypt, and SHA-256 is a hashing algorithm, not an encryption algorithm at all.
3. What is the purpose of multi-factor authentication (MFA)?
B) To require two or more verification factors, making unauthorised access harderMFA requires a user to prove their identity using two or more different factors — such as a password plus a one-time code from a phone — so that a compromised password alone isn't enough to gain access. It doesn't encrypt data, monitor traffic, or patch vulnerabilities; it's specifically an authentication control.
4. What does a firewall primarily do?
B) Filters network traffic based on rulesA firewall inspects and filters network traffic against a defined rule set, allowing or blocking connections based on criteria like source, destination, port, and protocol. Encrypting data in transit is handled by protocols like TLS, detecting malware is an antivirus/EDR function, and managing identities is an IAM function — all separate from what a firewall does.
5. What is a zero-day vulnerability?
B) A flaw unknown to the vendor that has no available fixA zero-day vulnerability is a flaw the vendor doesn't yet know about, meaning no official patch exists, which makes it especially dangerous if attackers discover it first. It has nothing to do with the number of affected users or a 'day-zero' deployment date, and by definition it hasn't been patched yet.
6. What does PKI stand for?
B) Public Key InfrastructurePKI (Public Key Infrastructure) is the system of certificate authorities, digital certificates, and public/private key pairs used to secure communications and verify identities. The other expansions aren't real security terms.
7. Which type of malware encrypts the victim's files and demands payment?
C) RansomwareRansomware encrypts a victim's files and demands payment (a ransom) for the decryption key, which is its defining characteristic. Spyware secretly collects information, adware displays unwanted advertising, and a worm self-replicates across a network — none of them hold data hostage for payment.
8. What is the principle of least privilege?
B) Users should be given only the minimum permissions needed to perform their jobLeast privilege means giving every user only the access rights strictly necessary for their job, which limits the potential damage if that account is ever compromised or misused. It's the opposite of giving admins or all users broad default access, and while periodic review supports the principle, the principle itself is about minimal necessary access.
9. What is a honeypot in cybersecurity?
B) A decoy system designed to attract and detect attackersA honeypot is a decoy system deliberately set up to look like a legitimate target, luring attackers in so their techniques can be observed and detected without risking real assets. It isn't a firewall type, password manager, or encryption key.
10. Which protocol provides encrypted web communication?
C) HTTPS (TLS)HTTPS secures web traffic by wrapping HTTP in TLS (formerly SSL) encryption, protecting data in transit between browser and server. Plain HTTP has no encryption, FTP transfers files without encryption by default, and SMTP is an email protocol, not a web browsing protocol.
11. What does SIEM stand for?
A) Security Information and Event ManagementSIEM stands for Security Information and Event Management — platforms that aggregate and correlate logs and security events from across an organization to detect threats and support investigations. The other expansions aren't real security terms.
12. What is social engineering?
B) Manipulating people into revealing confidential informationSocial engineering exploits human psychology — trust, urgency, authority — to manipulate people into revealing confidential information or taking an action they shouldn't, rather than exploiting a technical flaw. That's what distinguishes it from packet-based attacks, software exploitation, or password guessing.
13. Which of the following is a symmetric encryption algorithm?
C) AESAES (Advanced Encryption Standard) is a symmetric algorithm, using the same key for both encryption and decryption. RSA and ECC are both asymmetric algorithms, and Diffie-Hellman is a key-exchange method, not an encryption algorithm itself.
14. What is the purpose of a digital certificate?
B) To bind a public key to an identity, verified by a Certificate AuthorityA digital certificate binds a public key to a verified identity (like a person, server, or organization), with that binding vouched for by a trusted Certificate Authority. It doesn't encrypt files on disk, store passwords, or block network intrusions — those are separate security functions.
15. What is a DDoS attack?
B) Overwhelming a target with traffic from multiple sources to make it unavailableA DDoS attack floods a target with traffic from many distributed sources simultaneously, overwhelming its capacity to respond to legitimate requests and making it unavailable. It doesn't involve deleting data, stealing encrypted data, or intercepting DNS queries — those describe different types of attacks entirely.
16. What does the CIA triad stand for in security?
B) Confidentiality, Integrity, AvailabilityThe CIA triad — Confidentiality, Integrity, and Availability — represents the three core goals that most security controls are designed to protect. It has no relation to the intelligence agency, and the other options aren't the standard security triad.
17. What is SQL injection?
A) Inserting malicious SQL code into a query to manipulate a databaseSQL injection inserts malicious SQL syntax into an input field so it gets executed as part of the application's database query, letting an attacker read, modify, or delete data it shouldn't have access to. It has nothing to do with installing a database, sending spam, or exploiting physical hardware.
18. What is a VPN?
B) A Virtual Private Network that encrypts traffic over a public networkA VPN creates an encrypted tunnel over a public or untrusted network, so traffic between the endpoints stays private even though it's crossing shared infrastructure like the internet. It isn't a type of firewall, a cloud service by itself, or an intrusion detection system.
19. What does HTTPS use to secure communications?
C) TLS/SSLHTTPS relies on TLS (the modern successor to SSL) to encrypt and authenticate the connection between browser and server. IPSec secures traffic at the network layer rather than specifically for web browsing, SSH is used for secure remote command-line access, and WPA3 secures Wi-Fi connections, not web traffic.
20. What is an IDS vs an IPS?
B) IDS detects threats and alerts; IPS detects and actively blocks threatsAn IDS (Intrusion Detection System) passively monitors traffic and generates alerts when it spots something suspicious, while an IPS (Intrusion Prevention System) sits inline and can actively block that traffic in real time. Neither statement claiming both behave the same way, or that the roles are reversed, is accurate.
21. What is phishing?
B) A social engineering attack using deceptive emails or websites to steal credentialsPhishing is a social engineering attack that uses deceptive emails, messages, or fake websites designed to trick victims into revealing credentials or other sensitive information. It isn't a network scan, a standalone malware type, or a buffer overflow — those are different attack categories.
22. What is the purpose of hashing in security?
B) To produce a fixed-length one-way digest used to verify data integrityHashing produces a fixed-length, one-way digest of data that can be used to verify the data hasn't changed, but a hash cannot be reversed back into the original data the way encryption can. It isn't used to compress files or authenticate users directly, though hashes are often used as one building block within authentication schemes.
23. What is a brute force attack?
B) Systematically trying every possible combination of characters to crack a passwordA brute force attack systematically tries every possible combination of characters until it finds the correct password, which is what distinguishes it from a dictionary attack that only tries a curated wordlist. It doesn't rely on exploiting a known software flaw or intercepting packets — those are separate attack techniques.
24. What does AAA stand for in security?
A) Authentication, Authorisation, AccountingAAA stands for Authentication, Authorization, and Accounting — verifying identity, determining what an authenticated identity is allowed to do, and logging what it actually did. The other expansions aren't the standard AAA framework used in network and security contexts.
25. What is the purpose of network segmentation?
B) To divide a network into smaller zones to limit the spread of breachesNetwork segmentation divides a network into smaller, isolated zones so that if one segment is breached, the attacker's ability to move into other segments is limited. It isn't primarily about increasing bandwidth, speeding up DNS, or reducing hardware costs — those may be side effects at most, not the security purpose.
26. What is a certificate authority (CA)?
B) A trusted entity that issues and signs digital certificatesA Certificate Authority is a trusted third party that issues and digitally signs certificates, vouching that a public key really belongs to the identity it claims to represent. It isn't a firewall type, malware scanner, or backup service.
27. What does WPA3 protect in wireless networks?
B) Wi-Fi connections with stronger encryption and authentication than WPA2WPA3 protects Wi-Fi (wireless) connections, using Simultaneous Authentication of Equals (SAE) for stronger protection against offline password-guessing attacks compared to WPA2. It has nothing to do with wired connections, VPN tunnels, or DNS queries specifically.
28. What is the difference between a vulnerability and an exploit?
B) A vulnerability is a weakness; an exploit is code or technique that takes advantage of that weaknessA vulnerability is a weakness in a system, while an exploit is the actual code or technique used to take advantage of that weakness — the two terms describe cause and mechanism, not the same thing. Vulnerabilities and exploits both exist across software and hardware, not exclusively one or the other.
29. What is a security baseline?
A) The minimum acceptable security configuration for a system or deviceA security baseline defines the minimum acceptable security configuration a system or device must meet before it's considered adequately protected, and is used as a reference point for hardening and compliance checks. It has nothing to do with encryption strength limits, penetration testing, or analyst salaries.
30. What is the purpose of a penetration test?
B) To simulate an attack to identify vulnerabilities before malicious actors doA penetration test simulates a real attack against a system or network, within an authorized scope, to find exploitable vulnerabilities before an actual attacker does. It isn't about installing patches, passively monitoring logs, or training staff — those are separate security activities.
Curriculum Mapping & Learning Guide
Use this breakdown to identify which skills each question tests and guide post-test review.
General Security Concepts
Classifying baseline security controls, using core symmetric/asymmetric cryptographic blocks, managing PKI chains, and configuring MFA.
Threats, Vulnerabilities & Mitigations
Identifying active malware payloads, analyzing social engineering tactics, identifying software injection vectors, and leveraging threat intelligence feeds.
Security Architecture & Operations
Hardening physical and cloud environments, routing logs to SIEM collectors, managing identity lifecycle policies, and resolving incident alerts.
Security Program Management
Evaluating organizational compliance status, assessing strategic risk tables, and ensuring proper data privacy standards.
CompTIA Security+ (SY0-701) Security+ units covered
- Chapter 1: Security Concepts: Administrative security controls, cryptography primitives, and managing certificate authorities.
- Chapter 2: Threat Identification: Social engineering tactics, active malware behavior, and auditing for API injection vulnerabilities.
- Chapter 3: Enterprise Hardening: Securing hybrid cloud deployments, network segmentation, and gateway filtering.
- Chapter 4: Security Operations: Reading SIEM event logs, configuring IDS rules, and managing forensic chain of custody.
- Chapter 5: Compliance & Risk: Governance policy design, business risk tracking, and privacy guideline audits.
How to use this comptia security+ practice test page
1. Click the Start CompTIA Security+ Practice Test button to launch the setup.
2. Use the slider to choose your number of questions (from 5 to 30, default is 10).
3. Take your test, submit your answers, and let our AI analyze your performance.
4. Select Practice Weak Areas or Generate More Like This to have the AI create custom, targeted questions just for you.
Explore more for CompTIA Security+ (SY0-701)
Move between subjects in the same exam to build a balanced CompTIA Security+ (SY0-701) revision routine.