Security+ Fundamentals (SY0-701-aligned) Practice Exams
Three 50-question timed practice papers across general security concepts, threats and mitigations, security architecture, security operations, and programme management, weighted to the published SY0-701 objectives.
3 practice papers · 150 questions · 90 minutes each · pass mark 70% · ₹196 for all papers
What the SY0-701 practice exams cover
Written from the published CompTIA Security+ SY0-701 exam objectives.
- General security concepts (12%): control categories and types: technical, managerial, operational and physical; the CIA triad, non-repudiation, authentication, authorisation and accounting; zero trust: control and data planes, policy engine and policy enforcement point; cryptographic building blocks: symmetric, asymmetric, hashing, salting and digital signatures; public key infrastructure, certificate authorities and revocation; change management and its security implications
- Threats, vulnerabilities and mitigations (22%): threat actors, motivations and attributes; social engineering: phishing, pretexting, business email compromise and watering holes; application vulnerabilities: injection, buffer overflow, race conditions and insecure deserialisation; malware families and indicators of compromise; network attacks: on-path, DDoS, DNS poisoning and credential replay; mitigation techniques: segmentation, hardening, patching, least privilege and monitoring
- Security architecture (18%): architecture models: on-premises, cloud, hybrid, serverless and microservices trade-offs; secure network design: DMZ, segmentation, SD-WAN, proxies and failure modes; data classification, data states, tokenisation and masking; resilience: redundancy, capacity planning, backups and site considerations; secure infrastructure controls: firewalls, IPS, VPN and network access control
- Security operations (28%): secure baselines, hardening targets and mobile device management; identity and access management: provisioning, federation, privileged access and MFA factors; vulnerability management: scanning, prioritisation, CVSS, remediation and validation; monitoring and alerting: SIEM, SCAP, log aggregation and correlation; incident response phases, root-cause analysis and digital forensics handling; automation and orchestration in secure operations
- Security programme management and oversight (20%): security governance: policies, standards, procedures and guidelines; risk management: identification, assessment, appetite, treatment and register; third-party risk: vendor assessment, contracts, SLAs and supply chain; compliance, privacy obligations and consequences of non-compliance; audits, assessments and penetration-testing types; security awareness programmes and their measurement
Practice papers
- Security+ Fundamentals (SY0-701 aligned) — Practice Paper 1 — 50 questions, 90 minutes
- Security+ Fundamentals (SY0-701 aligned) — Practice Paper 2 — 50 questions, 90 minutes
- Security+ Fundamentals (SY0-701 aligned) — Practice Paper 3 — 50 questions, 90 minutes
Free SY0-701 sample questions
Sample question 1 (General security concepts)
A hospital's electronic health record system enforces automatic logoff after 15 minutes of inactivity so that an unattended workstation cannot be used to view patient data. Which security principle is primarily being protected by this control?
- Integrity
- Availability
- Confidentiality
- Non-repudiation
Answer: C. Confidentiality
Automatic logoff prevents unauthorized viewing of data when a workstation is left unattended, which directly protects confidentiality by ensuring only authorized users can access patient records. Option A, integrity, concerns preventing unauthorized modification of data, not viewing. Option B, availability, concerns ensuring systems and data remain accessible to users, not restricting access. Option D, non-repudiation, concerns proving a specific party performed an action, which is unrelated to session timeout.
Sample question 2 (Threats, vulnerabilities and mitigations)
An attacker calls a help desk claiming to be a senior executive who is traveling and urgently needs a password reset for an account locked during an overseas trip. The attacker provides the executive's employee ID and manager's name, both available on a public corporate website, and pressures the agent by saying a critical client meeting depends on immediate access. Which social engineering technique does this scenario best describe?
- Phishing
- Pretexting
- Watering hole
- Business email compromise
Answer: B. Pretexting
Pretexting involves fabricating a plausible scenario or identity to obtain information or action from a target; here the attacker creates a false narrative of being a stranded executive who needs urgent help. Option A is incorrect because phishing relies on deceptive electronic messages rather than a voice call with a fabricated story. Option C is wrong because a watering hole compromises a site the target already visits rather than directly contacting an individual. Option D is incorrect because business email compromise specifically uses spoofed or compromised email accounts to trick organizations into fraudulent payments or data transfers, not a voice call to a help desk.
Sample question 3 (Security architecture)
A company hosts a public-facing web server that must remain accessible from the internet, but the security team wants to ensure that if the server is compromised it cannot be used as a stepping stone to reach internal corporate systems. Which network design approach best meets this requirement?
- Place the web server on the same subnet as internal workstations and rely on host-based firewall rules to block internal traffic.
- Place the web server in a DMZ and enforce strict firewall rules that restrict traffic between the DMZ and the internal network.
- Place the web server behind a VPN concentrator and require all internet users to authenticate before reaching the server.
- Place the web server on the internal network and publish it to the internet using a NAT gateway only.
Answer: B. Place the web server in a DMZ and enforce strict firewall rules that restrict traffic between the DMZ and the internal network.
Option B is correct because placing the web server in a DMZ isolates internet-facing services from the internal network, and firewall rules between the DMZ and internal LAN limit lateral movement if the server is compromised. Option A is incorrect because relying on host firewall rules alone on the same subnet does not provide network-level isolation. Option C is incorrect because a VPN concentrator controls remote access, not the exposure of a public web server to the internet. Option D is incorrect because placing the server on the internal network and using NAT still exposes an internal asset and does not provide a separate security zone.
Sample question 4 (Security operations)
A company is implementing multi-factor authentication for its cloud email. The security team wants to use factors from different categories. Which of the following options combine two different authentication factor types? (Select two.)
- A user password and a fingerprint scan.
- A hardware security key and a smartphone push notification.
- A personal identification number and a one-time password generated by an authenticator app.
- An iris scan and a voiceprint recognition sample.
Answer: A. A user password and a fingerprint scan.; C. A personal identification number and a one-time password generated by an authenticator app.
Option A and Option C combine two different authentication factor categories. Option A combines knowledge (password) with inherence (fingerprint). Option C combines knowledge (PIN) with possession (authenticator app). Option B uses two possession factors. Option D uses two inherence factors. Since multi-factor authentication requires factors from distinct categories, only Option A and Option C meet the requirement.
Sample question 5 (Programme management and oversight)
A company identifies that a legacy payroll application has an unpatched vulnerability for which no vendor fix is available. The risk score is high, but the business cannot afford to replace the application immediately. Management decides to implement additional network segmentation and enhanced logging around the application while continuing to operate it. Which risk treatment strategy is management primarily applying?
- Risk avoidance
- Risk transference
- Risk mitigation
- Risk acceptance
Answer: C. Risk mitigation
Option C is correct because risk mitigation involves implementing controls that reduce the likelihood or impact of a risk while the risky activity continues. Segmentation and enhanced logging reduce exposure and improve detection, thereby lowering the risk. Option A, risk avoidance, would mean eliminating the risk by shutting down the application entirely, which is not what occurred. Option B, risk transference, would involve shifting the risk to a third party, such as purchasing insurance or outsourcing the function. Option D, risk acceptance, would mean acknowledging the risk and doing nothing to reduce it, which does not match the deployment of additional controls.
About these papers
Unofficial practice material. Every question is original, written from the vendor's publicly published exam objectives, and no real exam item is reproduced or paraphrased. This paper is not affiliated with, endorsed by, sponsored by or certified by the certification owner, and passing it does not confer any certification.
More certification practice exams
- Azure Fundamentals (AZ-900-aligned) Practice Exams
- Azure Administrator (AZ-104-aligned) Practice Exams
- AWS Cloud Practitioner (CLF-C02-aligned) Practice Exams
- AWS Solutions Architect Associate (SAA-C03-aligned) Practice Exams
- Certified in Cybersecurity Essentials (CC-aligned) Practice Exams
- Azure Data Fundamentals (DP-900-aligned) Practice Exams
- Project Management Professional (PMP-aligned) Practice Exams
- US Privacy Law (CIPP/US-aligned) Practice Exams
- Investment Foundations (CFA Level I-aligned) Practice Exams