10 beginner questions on the Security+ SY0-701 domains: general security concepts (CIA triad, cryptography), threats and mitigations (phishing, social engineering), security architecture (screened subnets, cloud responsibility), security operations (least privilege, MFA) and program management (risk responses, business impact analysis).

Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.

  1. A developer publishes a SHA-256 hash next to a software download so that users can confirm the file was not altered. Which goal of the CIA triad does this support?

    • A. Confidentiality
    • B. Integrity ✔ correct
    • C. Availability
    • D. Authorization

    Answer: B. Integrity means guarding against improper modification. If the downloaded file's hash matches the published hash, the file was not changed. A hash does not hide the data (confidentiality) or keep it reachable (availability).

    Source: csrc.nist.gov/glossary/term/integrity · Domain: General security concepts

  2. Which statement correctly describes asymmetric encryption?

    • A. One shared secret key both encrypts and decrypts the data
    • B. Data is turned into a fixed-length value that cannot be reversed
    • C. Two related keys are used, such as a public key and a private key ✔ correct
    • D. Data is hidden inside an image file so that nobody notices it

    Answer: C. Asymmetric (public key) cryptography uses two separate but related keys: one encrypts or signs, the other decrypts or verifies. One shared key is symmetric encryption, a fixed-length value is a hash, and hiding data is steganography.

    Source: csrc.nist.gov/glossary/term/asymmetric_cryptography · Domain: General security concepts

  3. A user receives an email that looks like it comes from their bank. It urges them to click a link and sign in to "verify" the account before it is locked. Which type of attack is this?

    • A. Phishing ✔ correct
    • B. Vishing
    • C. Smishing
    • D. Tailgating

    Answer: A. Phishing uses fraudulent emails (or websites) that pretend to be a trusted sender to steal credentials. Vishing uses voice calls, smishing uses text messages, and tailgating is following someone through a secured door.

    Source: www.cisa.gov/secure-our-world/recognize-and-report-phishing · Domain: Threats, vulnerabilities, and mitigations

  4. Which two of the following are examples of social engineering? (Select TWO)

    • A. A caller claims to be from the help desk and asks a user for their password ✔ correct
    • B. A web form accepts input that changes the database query it runs
    • C. An email that appears to come from the CEO urgently asks finance to wire money ✔ correct
    • D. A program writes more data into memory than the buffer can hold
    • E. Thousands of infected devices flood a website with traffic

    Answer: A, C. Social engineering manipulates people through human interaction, such as impersonating the help desk or an executive. The others are technical attacks: SQL injection, buffer overflow and a distributed denial of service.

    Source: www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks · Domain: Threats, vulnerabilities, and mitigations

  5. A company hosts a public web server and wants to keep internet traffic away from its internal file servers. Where should the web server be placed?

    • A. On the internal LAN, next to the file servers
    • B. On the same VLAN as the domain controllers
    • C. On the guest Wi-Fi network used by visitors
    • D. In a screened subnet (DMZ) behind a firewall ✔ correct

    Answer: D. A screened subnet (DMZ) is a perimeter segment between the internet and the internal network. Public services sit there, and firewall rules stop a compromised web server from reaching internal systems directly.

    Source: csrc.nist.gov/glossary/term/demilitarized_zone · Domain: Security architecture

  6. A company runs its application on virtual machines in an infrastructure as a service (IaaS) cloud. The company, not the cloud provider, is responsible for patching the operating systems of those virtual machines.

    • A. True ✔ correct
    • B. False

    Answer: A. True. In the shared responsibility model for IaaS, the provider secures the physical hosts and network, while the customer manages the virtual machines, their operating systems and applications.

    Source: learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility · Domain: Security architecture

  7. A new help-desk employee only needs to reset user passwords. The administrator grants that single permission and nothing more. Which principle is the administrator applying?

    • A. Separation of duties
    • B. Least privilege ✔ correct
    • C. Defense in depth
    • D. Implicit trust

    Answer: B. Least privilege restricts access to the minimum needed to do the assigned tasks. Separation of duties splits a sensitive task between people, and defense in depth layers several controls.

    Source: csrc.nist.gov/glossary/term/least_privilege · Domain: Security operations

  8. To sign in, users must enter a password and then approve a prompt in an authenticator app on their phone. What does this setup provide?

    • A. Multifactor authentication with two factor types ✔ correct
    • B. Single sign-on across several applications
    • C. Federation through a partner identity provider
    • D. Password complexity enforced by length rules

    Answer: A. The password is something you know and the phone app is something you have. Using two different factor types is multifactor authentication (MFA). Single sign-on and federation are about reusing one identity across systems.

    Source: csrc.nist.gov/glossary/term/multi_factor_authentication · Domain: Security operations

  9. A company buys a cyber insurance policy so that the insurer pays most of the costs if a data breach happens. Which risk response is this?

    • A. Risk acceptance
    • B. Risk avoidance
    • C. Risk transfer ✔ correct
    • D. Risk mitigation

    Answer: C. Transferring risk shifts its financial impact to another party, such as an insurer. Avoidance stops the risky activity, mitigation reduces likelihood or impact with controls, and acceptance takes the risk as it is.

    Source: csrc.nist.gov/glossary/term/risk_response · Domain: Security program management and oversight

  10. A business impact analysis (BIA) examines business functions and the effects that a disruption of each function would have on the organization.

    • A. True ✔ correct
    • B. False

    Answer: A. True. A BIA analyzes operational functions and the impact a disruption might have on them. Its results help set recovery priorities and recovery time and recovery point objectives for continuity planning.

    Source: csrc.nist.gov/glossary/term/business_impact_analysis · Domain: Security program management and oversight

Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public CompTIA exam objectives (Security+ V7 (SY0-701) exam objectives; V8 (SY0-801) expected on or around 2026-11-17; SY0-701 English exam retires 2027-06-11), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by CompTIA; exam names are trademarks of their owners. Official exam page: www.comptia.org/en-us/certifications/security/v7/.

Last modified: Sunday, 25 October 2026, 9:57 PM