CompTIA Security+ is an entry-level cybersecurity certification. This page covers the current exam code SY0-701 (version 7). CompTIA says a new version 8 is expected around November 17, 2026, so check which version you are booking. Try these 8 free practice questions.
Exam at a glance
- Up to 90 questions, a mix of multiple-choice and performance-based (source, as of Oct 9, 2026)
- 90 minutes (source, as of Oct 9, 2026)
- Passing score: 750 on a scale of 100–900 (source, as of Oct 9, 2026)
- 5 domains: General security concepts (12%); Threats, vulnerabilities, and mitigations (22%); Security architecture (18%); Security operations (28%); Security program management and oversight (20%) (source, as of Oct 9, 2026)
8 free Security+ practice questions
1. What does the 'I' in the CIA triad stand for?
- A. Identity
- B. Integrity
- C. Inspection
- D. Isolation
Show answer
Answer: B. CIA is confidentiality, integrity and availability. Integrity means data is not changed without authorization.
2. An email pretending to be from the payroll department asks staff to 'confirm' their passwords. This is:
- A. Phishing
- B. A DDoS attack
- C. SQL injection
- D. Shoulder surfing
Show answer
Answer: A. Phishing uses fake messages to trick people into revealing credentials or other sensitive data.
3. A hash function is mainly used to:
- A. Encrypt data so it can be decrypted later
- B. Verify data integrity
- C. Compress files
- D. Assign IP addresses
Show answer
Answer: B. A hash is a one-way fixed-length value. If the data changes, the hash changes, which shows tampering.
4. Requiring a password plus a code from a phone app is an example of:
- A. Single sign-on
- B. Multifactor authentication
- C. Least privilege
- D. Federation
Show answer
Answer: B. MFA combines factors from different categories, here something you know and something you have.
5. Giving users only the access they need to do their jobs is the principle of:
- A. Least privilege
- B. Separation of duties
- C. Defense in depth
- D. Implicit trust
Show answer
Answer: A. Least privilege limits access rights to the minimum required, reducing damage from mistakes or compromise.
6. A security camera that discourages intruders mainly acts as which control type?
- A. Corrective
- B. Deterrent
- C. Compensating
- D. Directive
Show answer
Answer: B. Visible cameras deter attackers. They can also be detective once footage is reviewed.
7. Which tool watches network traffic and actively blocks suspicious activity?
- A. IDS
- B. IPS
- C. SIEM dashboard only
- D. Proxy cache
Show answer
Answer: B. An intrusion prevention system (IPS) sits inline and can block traffic. An IDS only detects and alerts.
8. In the 'Security program management and oversight' domain, a business impact analysis (BIA) helps an organization:
- A. Patch servers
- B. Identify critical processes and the impact of their disruption
- C. Write firewall rules
- D. Encrypt laptops
Show answer
Answer: B. A BIA identifies key business functions and how outages would affect them, feeding recovery priorities.
Want the full study plan, key rules and more practice? Get the complete Security+ guide as an instant PDF.
Get the full Security+ guide — $10Independent study aid. Not affiliated with CompTIA. Original questions. No pass guarantee.