10 free CompTIA Security+ SY0-701 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 611 questions. Work through them, then open each answer to check your reasoning.
Get all 611 questions (US$39) · Download these 10 as a PDF
Question 1
Which of the following threat actors is the most likely to be hired by a foreign government to attack critical systems located in other countries?
Show answer and explanation
Correct answer: C. Organized crime
Organized crime groups have the resources, capability, and profit motive to be hired by foreign governments for sophisticated cyberattacks on critical infrastructure. They operate as professional entities with established business relationships and can be contracted for high-value operations. Hacktivists are ideologically motivated rather than mercenary, whistleblowers leak information rather than attack systems, and unskilled attackers lack the sophistication required for critical infrastructure targeting.
Why the other options are wrong
- A. Hacktivists are ideologically motivated, not hired for profit by governments.
- B. Whistleblowers disclose information rather than conduct attacks.
- D. Unskilled attackers lack the sophistication to target critical systems effectively.
Question 2
Which of the following is used to add extra complexity before using a one-way data transformation algorithm?
Show answer and explanation
Correct answer: D. Salting
Salting adds random data to input before applying a one-way hash function, increasing complexity and preventing rainbow table attacks. It is specifically designed to add extra complexity before hashing. Key stretching is a related but distinct technique that applies hashing multiple times, data masking obscures sensitive data visibility, and steganography hides information within other media.
Why the other options are wrong
- A. Key stretching applies the algorithm repeatedly, not adding complexity before transformation.
- B. Data masking obscures data visibility rather than adding cryptographic complexity.
- C. Steganography hides information within media, unrelated to hash algorithms.
Question 3
An employee clicked a link in an email from a payment website that asked the employee to update contact information. The employee entered the log-in information but received a “page not found” error message.
Which of the following types of social engineering attacks occurred?
Show answer and explanation
Correct answer: D. Phishing
This scenario describes a classic phishing attack where an employee received a deceptive email from what appeared to be a payment website, clicked a link, and entered credentials on a fraudulent page. The 'page not found' error is typical when the phishing site has captured the credentials. Brand impersonation is the technique used but phishing is the attack type; pretexting involves creating false scenarios verbally; typosquatting involves domain name mimicry.
Why the other options are wrong
- A. Brand impersonation is the technique used within the phishing attack, not the attack type itself.
- B. Pretexting typically involves direct communication and building false relationships, not fake websites.
- C. Typosquatting involves slightly misspelled domain names, not exact impersonation in emails.
Question 4
An enterprise is trying to limit outbound DNS traffic originating from its internal network. Outbound DNS requests will only be allowed from one device with the IP address 10.50.10.25.
Which of the following firewall ACLs will accomplish this goal?
Show answer and explanation
Correct answer: D. Access list outbound permit 10.50.10.25/32 0.0.0.0/0 port 53 Access list outbound deny 0.0.0.0/0 0.0.0.0/0 port 53
port 53 Access list outbound deny 0.0.0.0/0 0.0.0.0/0 port 53 ACLs are processed top-to-bottom with first match wins. Option D permits DNS traffic only from 10.50.10.25 to any destination on port 53, then denies all other outbound DNS traffic. This correctly restricts DNS to the single authorized device. Options A and C deny the authorized device or permit then deny the same traffic illogically. Option B reverses source/destination incorrectly.
Why the other options are wrong
- A. This denies the authorized device (10.50.10.25) after permitting all others, opposite of the requirement.
- B. This reverses source and destination in the first line, allowing all devices to send to 10.50.10.25.
- C. This permits all outbound DNS first, making the second deny statement unreachable.
Question 5
A data administrator is configuring authentication for a SaaS application and would like to reduce the number of credentials employees need to maintain. The company prefers to use domain credentials to access new SaaS applications.
Which of the following methods would allow this functionality?
Show answer and explanation
Correct answer: A. SSO
Single Sign-On (SSO) allows employees to use a single set of credentials (domain credentials) to authenticate to multiple applications, eliminating the need to maintain separate credentials for each SaaS application. LEAP and PEAP are wireless authentication protocols, not identity management solutions; MFA adds authentication factors but doesn't reduce credential management.
Why the other options are wrong
- B. LEAP is a wireless authentication protocol, not applicable to SaaS credential management.
- C. MFA adds authentication factors but doesn't reduce the number of credential sets required.
- D. PEAP is a wireless authentication protocol, not a SaaS credential management solution.
Question 6
Which of the following scenarios describes a possible business email compromise attack?
Show answer and explanation
Correct answer: A. An employee receives a gift card request in an email that has an executive’s name in the display field of the email.
that has an executive's name in the display field of the email. Business email compromise impersonates a trusted executive or partner, usually by forging the display name or using a look-alike address, so the victim acts on a fraudulent financial request. Option A fits exactly: an email bearing an executive's name pressures an employee to buy gift cards. The other choices describe ransomware or ordinary credential phishing.
Why the other options are wrong
- B. An attachment that locks files and demands payment is ransomware, not impersonation-based fraud.
- C. Requesting account credentials is credential phishing rather than a spoofed executive payment request.
- D. A link to a fake email portal is standard credential phishing, not executive impersonation.
Question 7
A company prevented direct access from the database administrators’ workstations to the network segment that contains database servers.
Which of the following should a database administrator use to access the database servers?
Show answer and explanation
Correct answer: A. Jump server
A jump server (bastion host) is a hardened, monitored intermediary system that allows administrators to access restricted network segments without direct connectivity. It enforces access control and logging for administrative activities. RADIUS is an authentication protocol, HSM is for key management, and load balancers distribute traffic, none addressing the access restriction requirement.
Why the other options are wrong
- B. RADIUS is an authentication protocol, not a mechanism for accessing restricted network segments.
- C. HSM (Hardware Security Module) manages cryptographic keys, not administrative access routing.
- D. Load balancers distribute network traffic, not provide restricted access for administrators.
Question 8
An organization’s internet-facing website was compromised when an attacker exploited a buffer overflow.
Which of the following should the organization deploy to best protect against similar attacks in the future?
Show answer and explanation
Question 9
An administrator notices that several users are logging in from suspicious IP addresses. After speaking with the users, the administrator determines that the employees were not logging in from those IP addresses and resets the affected users’ passwords.
Which of the following should the administrator implement to prevent this type of attack from succeeding in the future?
Show answer and explanation
Correct answer: A. Multifactor authentication
Multifactor authentication (MFA) would prevent unauthorized access even if credentials are compromised, since attackers would need a second authentication factor (such as a code from the user's phone) that only the legitimate user possesses. This directly addresses the scenario where passwords were stolen and used from suspicious locations.
Why the other options are wrong
- B. Permissions assignment controls what authenticated users can do, not who can authenticate.
- C. Access management is too broad and doesn't specifically prevent credential-based attacks.
- D. Password complexity alone doesn't prevent compromised passwords from being used by attackers.
Question 10
An employee receives a text message that appears to have been sent by the payroll department and is asking for credential verification.
Which of the following social engineering techniques are being attempted? (Choose two.)
Show answer and explanation
Correct answer: C, E
C. Impersonation E. Smishing Impersonation (C) is occurring because someone is pretending to be the payroll department, and smishing (E) is the specific technique of conducting phishing attacks via SMS text messages. These two elements combine to describe this attack scenario.
Why the other options are wrong
- A. Typosquatting involves creating fake websites with similar URLs, not text message impersonation.
- B. Phishing is the broader category, but smishing is the specific technique used for text- based phishing.
- D. Vishing is voice-based phishing, not text message-based.
- F. Misinformation spreads false information, but this attack is specifically attempting credential theft through impersonation.
That was 10 of 611.
The full CompTIA Security+ SY0-701 pack has all 611 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.