CompTIA Security+ SY0-701 — Readiness Assessment (Mastery)

By Mr Sparkles · Updated Jun 17, 2026

CertificationSecurity+ (SY0-701)
Questions25
Passing Score75%
Format92% Multiple Choice
Sessions Logged1,608
Your progressLog in / Register to track times taken, best score, questions mastered, and coverage on this quiz.
Rating
5.0 (1)

Certification Summary

CompTIA Security+ SY0-701 is the standard hurdle for systems administrators and junior security analysts tasked with maintaining basic infrastructure defenses. People sit this exam because their leads view it as a prerequisite for getting access to production environments, often using it to satisfy a checkbox for compliance audits or government contracts.

The exam leans on scenario based questions that force you to prioritize mitigation steps during a simulated breach. Security Operations at 28 percent, Threats, Vulnerabilities, and Mitigations at 22 percent, and Security Program Management and Oversight at 20 percent carry the weight of the assessment. You will also see questions on Security Architecture and General Security Concepts that require you to identify specific cryptographic implementations and the standard access control models defined in the CompTIA framework.

Topics covered

This quiz

Threats, Vulnerabilities, and Mitigations5 (20%)
Security Operations7 (28%)
Security Architecture6 (24%)
General Security Concepts2 (8%)
Security Program Management and Oversight5 (20%)

Exam blueprint

Official domain weights for this certification.

General Security Concepts12%
Threats, Vulnerabilities, and Mitigations22%
Security Architecture18%
Security Operations28%
Security Program Management and Oversight20%
Threats, Vulnerabilities, and Mitigations5 questions
  • Social Engineering and Identity Abuse1 q
  • Application and Cloud Vulnerabilities1 q
  • Credential Attacks1 q
  • Wireless Attacks and Authentication1 q
  • Application Security1 q
Security Operations7 questions
  • Vulnerability Management1 q
  • Incident Response and Malware1 q
  • Secure Software Development and Secrets Management1 q
  • Logging, Monitoring, and Evidence Preservation1 q
  • Incident Response Lifecycle1 q
  • IAM and Authorization Governance1 q
  • Threat Detection and Incident Analysis1 q
Security Architecture6 questions
  • Cloud Security and Data Protection1 q
  • Zero Trust and Network Segmentation1 q
  • OT and ICS Security1 q
  • Identity Security and MFA1 q
  • Resilience and Business Continuity1 q
  • Container and Virtualization Security1 q
General Security Concepts2 questions
  • Cryptography and PKI1 q
  • Cryptography and Non-Repudiation1 q
Security Program Management and Oversight5 questions
  • Compliance and Data Handling1 q
  • Supply Chain Risk and Change Management1 q
  • Privacy and Data Loss Prevention1 q
  • Risk Management and Exceptions1 q
  • Third-Party Risk1 q

Browse more · Report this quiz

Question catalog for this preview

Catalog listing of the 5 preview questions for this quiz.

Question 1

A payroll manager receives a chat message that appears to come from the CFO asking them to review a vendor payment portal. The link opens a Microsoft 365 consent screen for an app named InvoiceReview Sync. The user approves the request.

Within an hour, the SOC observes:

- Successful sign-ins from two countries

- New mailbox forwarding rules

- API activity reading SharePoint files

- No failed password attempts

- Continued activity after the user's password is reset

Which response best addresses the root cause?

Answer choices

  • A. Disable the user's mailbox, block external forwarding globally, and wait for the password reset to expire all active sessions.

  • B. Revoke the malicious OAuth consent grant, disable the enterprise application, revoke active tokens, reset credentials, and review mailbox/file access activity.

  • C. Reimage the user's laptop because the absence of failed password attempts proves a local keylogger captured the password before authentication.

  • D. Add the sender domain to the anti-spam block list because the attack depends on spoofed email delivery.

Question 2

After renewing a TLS certificate for an internal finance portal, most browsers continue to work. A new mobile application refuses to connect and reports: certificate chain could not be validated. The certificate is not expired, the hostname matches, and the root CA is trusted by the mobile device. A packet capture shows the server is presenting only the leaf certificate.

What is the most likely fix?

Answer choices

  • A. Replace the certificate with a wildcard certificate for the entire internal domain.

  • B. Install and present the correct intermediate certificate chain on the server.

  • C. Disable certificate validation in the mobile application because the root CA is already trusted.

  • D. Enable DNSSEC for the internal domain so clients can validate the certificate path.

Question 3

Developers want to log full payment card numbers in a production troubleshooting log because encrypted database storage already protects cardholder data at rest. The logs are searchable by several support teams and retained for one year.

Which design best meets troubleshooting needs while reducing compliance risk?

Answer choices

  • A. Allow full card numbers in logs as long as the log volume is encrypted at rest.

  • B. Tokenize or mask card numbers in logs, restrict log access, enforce retention limits, and monitor access to sensitive log data.

  • C. Hash card numbers with MD5 before logging them so support can compare values quickly.

  • D. Disable all production logging because any log data creates unacceptable compliance risk.

Question 4

A plant control workstation runs an unsupported operating system required by a vendor application. Replacing it will take nine months. The device is not internet-facing, but it is reachable from the engineering VLAN. A scan flags multiple critical vulnerabilities. Operations leadership refuses immediate replacement because downtime would halt production.

Which approach is most appropriate?

Answer choices

  • A. Mark the findings as false positives because unsupported systems cannot be remediated normally.

  • B. Document a time-bound risk exception or POA&M, obtain risk owner approval, apply compensating controls such as segmentation and allowlisting, and track replacement.

  • C. Patch the operating system using unofficial community packages to remove the scanner findings.

  • D. Disconnect the vulnerability scanner from the engineering VLAN so the system no longer appears on reports.

Question 5

Match each evidence pattern to the most likely attack or abuse technique.