A new SOC Tier 1 analyst needs to name the four control categories that identify who or what enforces a safeguard. Which list names all four?

Technical, Managerial, Operational, and Physical control categories together.

Preventive, Deterrent, Detective, and Corrective categories from the grid model.

Administrative, Logical, Compensating, and Directive control categories together.

Confidentiality, Integrity, Availability, and Authentication grouped categories.

A SOC Tier 1 analyst receives a ticket reporting that the company's public homepage has been altered overnight. The defaced page now displays unauthorized political messaging instead of the normal marketing content. Which leg of the CIA triad is most directly affected by this incident?

Integrity, because the homepage content was changed in an unauthorized way by the attacker.

Confidentiality, because outside visitors are reading content that was not meant to be public yet.

Availability, because the page is rendering very slowly and timing out for some external visitors.

Non-repudiation, because the attacker can later deny that they were responsible for the change.

A receptionist follows a phishing link to a lookalike corporate cloud sign-in page and enters her work credentials. Two hours later, a SOC alert shows a successful sign-in with the same credentials from another country, and she confirms that she did not make it. Which Security+ threat-actor category BEST describes the receptionist's role in this incident?

An insider threat acting unintentionally after falling for phishing and unknowingly exposing her own work credentials.

A malicious insider deliberately handing her own work credentials to an external organized crime crew partner.

A shadow IT user whose deployment of an unsanctioned cloud SaaS tool caused the data leak event.

An unskilled external attacker who reused the stolen credentials to access the organization's cloud account.

A SOC analyst is triaging a ticket. A warehouse supervisor received an SMS claiming that a parcel delivery was held at a sorting facility and asking her to tap a link to pay a small redelivery fee. She tapped the link from her personal smartphone before reporting it. Which threat vector is this attack using?

Smishing, because the phishing attempt was delivered through an SMS text message on the mobile device.

Email phishing, because the attacker is impersonating a delivery brand and trying to harvest credentials.

Watering hole, because the attacker compromised a website that the warehouse supervisor visits often.

Vishing, because the attack relies on urgency and social-engineering pressure on a personal mobile device.

A security architect at Coastline Medical Center is designing disaster recovery for the electronic medical record (EMR) system. Clinical leadership has set a 30-minute recovery time objective (RTO) because the system supports active patient care. Which recovery site option best supports that RTO target?

A hot site running in parallel with current data, configurations, and ready capacity.

A warm site, because warm sites already have hardware racked and identity preconfigured for restore.

A cold site, because cold sites have the lowest ongoing cost and only require power, cooling, and a network drop.

An onsite spare server rack ready to be powered on when the primary system fails over.

A security engineer is reviewing a Terraform repository before approving the change to production network rules. Which review practice BEST reduces the risk of a misapplied infrastructure-as-code change opening the perimeter?

Require independent review and inspect a Terraform plan generated with the intended production state and approved inputs before apply.

Allow individual engineers to push applied changes during business hours and roll back any errors discovered within four hours.

Disable Terraform state file encryption to make troubleshooting faster during incident response when state drift causes apply failures.

Skip the plan step entirely on routine changes to reduce friction and let engineers iterate on production rules during peak hours.

A network engineer at Westgate University suspects a workstation is exfiltrating large amounts of data to an external host. The SOC needs to know who talked to whom, on which ports, for how long, and how many bytes, without storing every full packet captured. Which monitoring data source provides exactly that information at scale?

NetFlow or compatible flow telemetry, because it summarizes conversations with addresses, ports, counters, and timing without retaining full packet payloads.

Full packet capture, because writing every byte of every packet to disk is the only way for a SOC to be sure the analyst can later reconstruct the contents of a suspicious session for forensics work.

SNMP traps, because each network device will send unsolicited messages to the SOC when key thresholds are crossed and that telemetry stream is enough to fully reconstruct exfiltration conversations for the analyst.

EDR telemetry, because every modern endpoint detection product can record every byte of every outbound network call from the host and is a stronger primary forensic source than the network device tier of the stack.

An incident-response lead wants to analyze how a suspicious email was routed and what SPF, DKIM, and DMARC results the receiving system recorded. Which data source is most direct?

The full email message metadata, including the Received chain, the Return-Path, and the Authentication-Results header showing SPF, DKIM, and DMARC verdicts.

The EDR alert that fired when the user opened the attachment, because the EDR alert records the verified sender identity that was negotiated during message delivery.

The firewall log entry for the SMTP session that delivered the message, because it records the verified sender domain authentication for the inbound mail session.

The IPS signature alert that fired on the malicious attachment, because the IPS reconstructs the original sender identity from the malware's command and control fingerprint pattern.

A marketing coordinator at Greenfield Apparel sends a confidential customer list to a personal webmail account so she can finish work from home. She does not know this violates the data-handling policy, and a DLP control blocks the message. Under the scenario's stated facts, which type of anomalous behavior BEST describes her action?

Unintentional behavior, because she is performing legitimate work and does not know the transfer violates policy.

Risky behavior, because she knows the rule and deliberately accepts the risk to finish faster.

Unexpected behavior, because the message was sent by an attacker using the coordinator's compromised account.

Insider threat behavior, because she intends to steal the list for personal gain.

A leadership team commits to four-hour maximum service restoration and one-hour maximum data loss for the customer order system. Which two BIA metrics are the leadership team setting?

Recovery Time Objective at four hours and Recovery Point Objective at one hour for the system.

Mean Time To Repair at four hours and Mean Time Between Failures at one hour for the order system.

Annualized Loss Expectancy at four hours and Annualized Rate of Occurrence at one hour annually.

Exposure Factor at four hours and Single Loss Expectancy at one hour for one ransomware event.

Home
CompTIA Security+
Security+ practice test

Free practice test

Free CompTIA Security+ (SY0-701) practice test

RTJ is an IT certification platform that starts with CompTIA A+, Network+ and Security+.

This free CompTIA Security+ (SY0-701) practice test, also called a Security plus practice test, has 10 questions that cover all 5 Security+ domains. Pick an answer to see whether it is right and why. No account, no timer.

Try the sample questions

Nothing here is saved or sent. Choose an answer to see whether it is right and why.

0 of 10 answered

Question 1 of 10 · General Security Concepts
A new SOC Tier 1 analyst needs to name the four control categories that identify who or what enforces a safeguard. Which list names all four?
A. Technical, Managerial, Operational, and Physical control categories together.B. Preventive, Deterrent, Detective, and Corrective categories from the grid model.C. Administrative, Logical, Compensating, and Directive control categories together.D. Confidentiality, Integrity, Availability, and Authentication grouped categories.
Answer and explanation
Right answer: A. Technical, Managerial, Operational, and Physical control categories together.
Objective 1.1 lists Technical, Managerial, Operational, and Physical as control categories. Technical controls use technology, Managerial controls establish policy or governance direction, Operational controls are carried out through people and procedures, and Physical controls use physical measures. Preventive, Deterrent, Detective, Corrective, Compensating, and Directive are control types, not categories. A matrix can help study both dimensions, but it is not a mandated audit artifact.
Objective SP-1.1: Security Controls
Question 2 of 10 · General Security Concepts
A SOC Tier 1 analyst receives a ticket reporting that the company's public homepage has been altered overnight. The defaced page now displays unauthorized political messaging instead of the normal marketing content. Which leg of the CIA triad is most directly affected by this incident?
A. Confidentiality, because outside visitors are reading content that was not meant to be public yet.B. Availability, because the page is rendering very slowly and timing out for some external visitors.C. Integrity, because the homepage content was changed in an unauthorized way by the attacker.D. Non-repudiation, because the attacker can later deny that they were responsible for the change.
Answer and explanation
Right answer: C. Integrity, because the homepage content was changed in an unauthorized way by the attacker.
Website defacement is the canonical example of an integrity attack. The CIA triad has three legs. Confidentiality protects against unauthorized reading. Integrity protects against unauthorized changing. Availability protects against the system being unreachable when needed. In a defacement, attackers replace the legitimate content with their own, which is a direct attack on integrity. Visitors can still reach the page (availability is intact) and they can still read what is on it (confidentiality of the marketing content was not the question), but what they read is no longer authentic. SOC analysts triage tickets in part by naming the CIA leg under attack, because that naming drives the next steps. An integrity incident drives questions like, when was the last good version, what hash do we have on file, who had write access, and what does the file-integrity monitoring tool show. A confidentiality incident drives questions about access logs and data exfiltration. An availability incident drives questions about uptime monitors and capacity. Knowing which leg an attack touches gets you to the right runbook faster. The web context is a distraction. The action of unauthorized change is what makes it integrity.
Objective SP-1.2: Security Concepts
Question 3 of 10 · Threats, Vulnerabilities, and Mitigations
A receptionist follows a phishing link to a lookalike corporate cloud sign-in page and enters her work credentials. Two hours later, a SOC alert shows a successful sign-in with the same credentials from another country, and she confirms that she did not make it. Which Security+ threat-actor category BEST describes the receptionist's role in this incident?
A. A malicious insider deliberately handing her own work credentials to an external organized crime crew partner.B. A shadow IT user whose deployment of an unsanctioned cloud SaaS tool caused the data leak event.C. An insider threat acting unintentionally after falling for phishing and unknowingly exposing her own work credentials.D. An unskilled external attacker who reused the stolen credentials to access the organization's cloud account.
Answer and explanation
Right answer: C. An insider threat acting unintentionally after falling for phishing and unknowingly exposing her own work credentials.
Objective 2.1 names insider threat as a threat-actor category, and NIST defines insider threat to include harm caused by an insider using authorized access wittingly or unwittingly. Because the receptionist is an authorized insider and accidentally exposed her work credentials after falling for phishing, C best describes her role. The later sign-in is a separate event, and the scenario does not establish who made it, whether that actor was internal or external, or the actor's skill level.
Objective SP-2.1: Threat Actors
Question 4 of 10 · Threats, Vulnerabilities, and Mitigations
A SOC analyst is triaging a ticket. A warehouse supervisor received an SMS claiming that a parcel delivery was held at a sorting facility and asking her to tap a link to pay a small redelivery fee. She tapped the link from her personal smartphone before reporting it. Which threat vector is this attack using?
A. Email phishing, because the attacker is impersonating a delivery brand and trying to harvest credentials.B. Watering hole, because the attacker compromised a website that the warehouse supervisor visits often.C. Vishing, because the attack relies on urgency and social-engineering pressure on a personal mobile device.D. Smishing, because the phishing attempt was delivered through an SMS text message on the mobile device.
Answer and explanation
Right answer: D. Smishing, because the phishing attempt was delivered through an SMS text message on the mobile device.
Smishing is phishing delivered through SMS. Phishing is the broader social-engineering family, so smishing is the most specific answer here. The SMS delivery channel distinguishes it from vishing, which uses voice, and email phishing. A delivery-service pretext may also involve impersonation, but the stem does not establish a watering hole or typosquatting.
Objective SP-2.2: Threat Vectors and Attack Surfaces
Question 5 of 10 · Security Architecture
A security architect at Coastline Medical Center is designing disaster recovery for the electronic medical record (EMR) system. Clinical leadership has set a 30-minute recovery time objective (RTO) because the system supports active patient care. Which recovery site option best supports that RTO target?
A. A hot site running in parallel with current data, configurations, and ready capacity.B. A warm site, because warm sites already have hardware racked and identity preconfigured for restore.C. A cold site, because cold sites have the lowest ongoing cost and only require power, cooling, and a network drop.D. An onsite spare server rack ready to be powered on when the primary system fails over.
Answer and explanation
Right answer: A. A hot site running in parallel with current data, configurations, and ready capacity.
The keyed design explicitly keeps current data, configuration, and ready capacity running in parallel, so it is the best option for the 30-minute target. Hot, warm, and cold labels describe relative readiness rather than guaranteed recovery times. The organization must test the complete activation path, including identity, data, dependencies, routing, and staffing. The onsite spare also shares the primary site's physical failure domain.
Objective SP-3.4: Resiliency and Recovery
Question 6 of 10 · Security Architecture
A security engineer is reviewing a Terraform repository before approving the change to production network rules. Which review practice BEST reduces the risk of a misapplied infrastructure-as-code change opening the perimeter?
A. Require independent review and inspect a Terraform plan generated with the intended production state and approved inputs before apply.B. Allow individual engineers to push applied changes during business hours and roll back any errors discovered within four hours.C. Disable Terraform state file encryption to make troubleshooting faster during incident response when state drift causes apply failures.D. Skip the plan step entirely on routine changes to reduce friction and let engineers iterate on production rules during peak hours.
Answer and explanation
Right answer: A. Require independent review and inspect a Terraform plan generated with the intended production state and approved inputs before apply.
Independent review plus inspection of a plan generated from the intended state and approved variables can catch unexpected network changes before apply. A plan is evidence, not a guarantee, because state or inputs can change between plan and apply; the pipeline should bind the approved plan to the applied change. Encryption and access control for state, short-lived runner credentials, validation, and a recovery plan remain necessary.
Objective SP-3.1: Architecture Models
Question 7 of 10 · Security Operations
A network engineer at Westgate University suspects a workstation is exfiltrating large amounts of data to an external host. The SOC needs to know who talked to whom, on which ports, for how long, and how many bytes, without storing every full packet captured. Which monitoring data source provides exactly that information at scale?
A. Full packet capture, because writing every byte of every packet to disk is the only way for a SOC to be sure the analyst can later reconstruct the contents of a suspicious session for forensics work.B. SNMP traps, because each network device will send unsolicited messages to the SOC when key thresholds are crossed and that telemetry stream is enough to fully reconstruct exfiltration conversations for the analyst.C. EDR telemetry, because every modern endpoint detection product can record every byte of every outbound network call from the host and is a stronger primary forensic source than the network device tier of the stack.D. NetFlow or compatible flow telemetry, because it summarizes conversations with addresses, ports, counters, and timing without retaining full packet payloads.
Answer and explanation
Right answer: D. NetFlow or compatible flow telemetry, because it summarizes conversations with addresses, ports, counters, and timing without retaining full packet payloads.
NetFlow and IPFIX summarize network conversations without storing every packet payload. Records can include addresses, ports, protocol, counters, interfaces, and timestamps, subject to exporter version and configuration. Flow data can show unusual volume or destinations, but it does not by itself prove exfiltration and cannot reconstruct packet contents.
Objective SP-4.4: Security Monitoring
Question 8 of 10 · Security Operations
An incident-response lead wants to analyze how a suspicious email was routed and what SPF, DKIM, and DMARC results the receiving system recorded. Which data source is most direct?
A. The full email message metadata, including the Received chain, the Return-Path, and the Authentication-Results header showing SPF, DKIM, and DMARC verdicts.B. The EDR alert that fired when the user opened the attachment, because the EDR alert records the verified sender identity that was negotiated during message delivery.C. The firewall log entry for the SMTP session that delivered the message, because it records the verified sender domain authentication for the inbound mail session.D. The IPS signature alert that fired on the malicious attachment, because the IPS reconstructs the original sender identity from the malware's command and control fingerprint pattern.
Answer and explanation
Right answer: A. The full email message metadata, including the Received chain, the Return-Path, and the Authentication-Results header showing SPF, DKIM, and DMARC verdicts.
The received message's full headers contain routing fields and can contain Authentication-Results added by a trusted receiving system. Analysts validate the header source because fields can be forged. SPF, DKIM, and DMARC results evaluate particular authentication and alignment conditions; they do not prove the human author or distinguish a legitimate but compromised mailbox by themselves. Gateway and sender-side logs may be needed for that conclusion.
Objective SP-4.9: Security Data Sources
Question 9 of 10 · Security Program Management and Oversight
A marketing coordinator at Greenfield Apparel sends a confidential customer list to a personal webmail account so she can finish work from home. She does not know this violates the data-handling policy, and a DLP control blocks the message. Under the scenario's stated facts, which type of anomalous behavior BEST describes her action?
A. Risky behavior, because she knows the rule and deliberately accepts the risk to finish faster.B. Unexpected behavior, because the message was sent by an attacker using the coordinator's compromised account.C. Insider threat behavior, because she intends to steal the list for personal gain.D. Unintentional behavior, because she is performing legitimate work and does not know the transfer violates policy.
Answer and explanation
Right answer: D. Unintentional behavior, because she is performing legitimate work and does not know the transfer violates policy.
The stated lack of knowledge makes D the best answer. The coordinator initiated the transfer while doing legitimate work but did not intend to violate a rule she did not know. Objective 5.6 lists risky, unexpected, and unintentional anomalous behavior and separately lists user guidance and training; it does not prescribe one exclusive remediation pair for each label. NIST SP 800-50 Rev. 1 says all-user learning should help reduce errors caused by lack of awareness or training. Targeted training is therefore reasonable, while the DLP block is a separate technical control already working as designed.
Objective SP-5.6: Security Awareness
Question 10 of 10 · Security Program Management and Oversight
A leadership team commits to four-hour maximum service restoration and one-hour maximum data loss for the customer order system. Which two BIA metrics are the leadership team setting?
A. Recovery Time Objective at four hours and Recovery Point Objective at one hour for the system.B. Mean Time To Repair at four hours and Mean Time Between Failures at one hour for the order system.C. Annualized Loss Expectancy at four hours and Annualized Rate of Occurrence at one hour annually.D. Exposure Factor at four hours and Single Loss Expectancy at one hour for one ransomware event.
Answer and explanation
Right answer: A. Recovery Time Objective at four hours and Recovery Point Objective at one hour for the system.
Recovery Time Objective (RTO) is the maximum time a system resource can remain unavailable before the impact becomes unacceptable. Recovery Point Objective (RPO) is the point in time before a disruption to which data must be recovered; a one-hour RPO means the organization can tolerate losing up to one hour of data. The four-hour restoration limit is therefore the RTO, and the one-hour data-loss limit is the RPO. MTTR and MTBF are average repair and reliability measures, not the recovery objectives described here. ALE, ARO, EF, and SLE are quantitative risk-analysis terms, not recovery objectives.
Objective SP-5.2: Risk Management

What does the CompTIA Security+ exam cover?

Security+ (SY0-701) covers 5 domains, and this sample draws questions from each:

Domain SP-1.0: General Security Concepts (2 questions)
Domain SP-2.0: Threats, Vulnerabilities, and Mitigations (2 questions)
Domain SP-3.0: Security Architecture (2 questions)
Domain SP-4.0: Security Operations (2 questions)
Domain SP-5.0: Security Program Management and Oversight (2 questions)

CompTIA decides what is on the exam. Read the official SY0-701 objectives on CompTIA's Security+ page, then use RTJ's objective-by-objective guides and practice to work through them.

How does the full practice exam work?

RTJ's full-length practice exam runs 90 questions in 90 minutes, with performance-based questions mixed in and a per-domain breakdown when you finish. A free account includes one full-length practice exam per certification track, and paid plans remove that cap. The format is RTJ's own interface, not CompTIA's or Pearson VUE's.

Where do these questions come from?

They are RTJ's own questions, written to the published Security+ SY0-701 objectives. RTJ drafts questions with AI assistance, and the AI policy explains how. If you find a mistake, report it on the corrections page. The sample is a fixed pick, so the same 10 questions show every time you visit.

Questions

Is this the real CompTIA Security+ exam?+

No. It is a short practice sample written by RTJ to the published SY0-701 objectives. It is not CompTIA's exam, it does not use CompTIA's questions, and its result says nothing about how you would score on exam day.

Is the practice test really free?+

Yes. The 10 questions on this page need no account and nothing is saved or sent. A free account adds one full-length timed practice exam per certification track.

Does a high score on this sample mean I will pass?+

No. 10 questions cannot measure readiness for a full certification exam. RTJ's own Mastery Index is an internal, uncalibrated study signal built from many questions, and it is not a pass prediction either.

Where are the official CompTIA Security+ objectives?+

CompTIA publishes the SY0-701 exam objectives on its own site, which is the source to follow for what the exam covers. RTJ's study guides and questions are written against those objectives and carry the objective number.

Keep going

CompTIA Security+ on RTJThe objective map, study guides, labs and the practice exam for Security+.
The full-length practice exam90 questions in 90 minutes, with performance-based questions and a per-domain breakdown.
How the Mastery Index worksAn uncalibrated study signal, shown with its evidence quality. Not a pass predictor.
Hands-on labsDo the procedure step by step in a simulated tool. Free labs need no account.

Revy's Tech Journey is an independent study platform and is not endorsed by or affiliated with CompTIA. CompTIA names identify the public exam objectives each RTJ track covers.

Start free, no credit card.

A free account keeps your progress and adds one full-length timed practice exam per certification track.

Create a free account See what is included