CompTIA Security+ SY0-701 — Readiness Assessment (Mastery)
By Mr Sparkles · Updated Jun 17, 2026
| Certification | Security+ (SY0-701) |
| Questions | 25 |
| Passing Score | 75% |
| Format | 92% Multiple Choice |
| Sessions Logged | 662 |
| Your progress | Log in / Register to track times taken, best score, questions mastered, and coverage on this quiz. |
| Rating |
Certification Summary
CompTIA Security+ SY0-701 is the standard hurdle for systems administrators and junior security analysts tasked with maintaining basic infrastructure defenses. People sit this exam because their leads view it as a prerequisite for getting access to production environments, often using it to satisfy a checkbox for compliance audits or government contracts.
The exam leans on scenario based questions that force you to prioritize mitigation steps during a simulated breach. Security Operations at 28 percent, Threats, Vulnerabilities, and Mitigations at 22 percent, and Security Program Management and Oversight at 20 percent carry the weight of the assessment. You will also see questions on Security Architecture and General Security Concepts that require you to identify specific cryptographic implementations and the standard access control models defined in the CompTIA framework.
Topics covered
Threats, Vulnerabilities, and Mitigations5 questions
- Social Engineering and Identity Abuse1 q
- Application and Cloud Vulnerabilities1 q
- Credential Attacks1 q
- Wireless Attacks and Authentication1 q
- Application Security1 q
Security Operations7 questions
- Vulnerability Management1 q
- Incident Response and Malware1 q
- Secure Software Development and Secrets Management1 q
- Logging, Monitoring, and Evidence Preservation1 q
- Incident Response Lifecycle1 q
- IAM and Authorization Governance1 q
- Threat Detection and Incident Analysis1 q
Security Architecture6 questions
- Cloud Security and Data Protection1 q
- Zero Trust and Network Segmentation1 q
- OT and ICS Security1 q
- Identity Security and MFA1 q
- Resilience and Business Continuity1 q
- Container and Virtualization Security1 q
General Security Concepts2 questions
- Cryptography and PKI1 q
- Cryptography and Non-Repudiation1 q
Security Program Management and Oversight5 questions
- Compliance and Data Handling1 q
- Supply Chain Risk and Change Management1 q
- Privacy and Data Loss Prevention1 q
- Risk Management and Exceptions1 q
- Third-Party Risk1 q
Question catalog for this preview
Catalog listing of the 5 preview questions for this quiz.
Question 1
A payroll manager receives a chat message that appears to come from the CFO asking them to review a vendor payment portal. The link opens a Microsoft 365 consent screen for an app named InvoiceReview Sync. The user approves the request.
Within an hour, the SOC observes:
- Successful sign-ins from two countries
- New mailbox forwarding rules
- API activity reading SharePoint files
- No failed password attempts
- Continued activity after the user's password is reset
Which response best addresses the root cause?
Explanation
The OAuth consent grant is the key issue. The attacker obtained delegated access through an approved application, so a password reset alone may not remove the application's token-based access. The best response is to revoke the app consent, disable or remove the malicious enterprise application, revoke sessions/tokens, reset credentials, and investigate mailbox rules and file access.
Disabling the mailbox or blocking forwarding may reduce one symptom but does not address the app grant. Reimaging the laptop assumes endpoint malware without evidence and ignores the cloud API activity. Blocking the sender domain is too narrow because the compromise has already moved into identity and application authorization.
Question 2
After renewing a TLS certificate for an internal finance portal, most browsers continue to work. A new mobile application refuses to connect and reports: certificate chain could not be validated. The certificate is not expired, the hostname matches, and the root CA is trusted by the mobile device. A packet capture shows the server is presenting only the leaf certificate.
What is the most likely fix?
Explanation
The server is not presenting the intermediate chain needed to build trust from the leaf certificate to the trusted root. Some browsers may retrieve missing intermediates automatically, while stricter clients often fail. Installing the proper intermediate chain fixes the validation path.
A wildcard certificate does not solve a missing chain. Disabling validation weakens security and masks the problem. DNSSEC protects DNS integrity but does not replace the PKI certificate chain.
Question 3
Developers want to log full payment card numbers in a production troubleshooting log because encrypted database storage already protects cardholder data at rest. The logs are searchable by several support teams and retained for one year.
Which design best meets troubleshooting needs while reducing compliance risk?
Explanation
Logs are a common source of sensitive data exposure. Tokenization or masking allows troubleshooting without storing full payment card data. Access control, retention limits, and monitoring further reduce risk.
Encryption at rest alone does not prevent authorized support users from viewing sensitive data. MD5 is weak and hashing full card numbers may still create compliance and privacy problems. Disabling all logging harms operations and incident response.
Question 4
A plant control workstation runs an unsupported operating system required by a vendor application. Replacing it will take nine months. The device is not internet-facing, but it is reachable from the engineering VLAN. A scan flags multiple critical vulnerabilities. Operations leadership refuses immediate replacement because downtime would halt production.
Which approach is most appropriate?
Explanation
When immediate remediation is not feasible, the organization should formally document the risk, assign ownership, set an expiration or remediation plan, and implement compensating controls. This keeps the risk visible and managed.
Calling real vulnerabilities false positives is dishonest. Unofficial patches may destabilize a control system and violate support constraints. Removing visibility from reports does not reduce risk.
Question 5
Match each evidence pattern to the most likely attack or abuse technique.
Explanation
Long randomized subdomains are a common indicator of DNS tunneling or DNS-based exfiltration. Repeated push prompts indicate MFA fatigue. Persistent access after password reset points to OAuth consent or token abuse. Attempts to read /etc/passwd through a path parameter indicate local file inclusion or traversal. Compressing directories and sending them externally over HTTPS indicates data exfiltration over an allowed protocol.
The distractors are intentionally close because all five patterns involve legitimate-looking infrastructure being abused: DNS, MFA, OAuth, web parameters, and HTTPS.