Free Security+ Practice Test: 10 SY0-701 Questions

Looking for free Security+ practice questions for SY0-701? Below are 10 original questions with answers and plain-English explanations, spread across all five exam domains. No acronym soup without a spoon: we explain each one the first time it shows up.

First, a quick look at the real test.

What the Security+ exam is

CompTIA Security+ is an entry-level cybersecurity certification from CompTIA (the Computing Technology Industry Association, a nonprofit IT trade group). The current exam code is SY0-701, also called V7. It checks whether you can spot threats, pick the right security controls, and respond to incidents in real-world scenarios.

The SY0-701 exam format

• Up to 90 questions, a mix of multiple-choice and performance-based questions (PBQs, short hands-on tasks like matching or configuring).
• 90 minutes to finish.
• Passing score: 750 on a scale of 100 to 900.
• Recommended experience: CompTIA Network+ and about two years of IT work with a security focus. It’s a recommendation, not a requirement.

That 750 is a scaled score, not a percentage, so don’t try to turn it into “83% right.”

Timing heads-up: CompTIA says the next version, Security+ V8, is expected to launch on or around November 17, 2026. The English SY0-701 exam retires June 11, 2027. Check which version your voucher and study materials match before you book.

Sources: CompTIA Security+ V7 page and the CompTIA Security+ overview, as of Oct 28, 2026.

What the exam covers

CompTIA splits SY0-701 into five domains:

• General security concepts: 12%
• Threats, vulnerabilities, and mitigations: 22%
• Security architecture: 18%
• Security operations: 28%
• Security program management and oversight: 20%

Our 10 questions follow roughly that mix: 1, 2, 2, 3, and 2.

Source: CompTIA Security+ V7 exam objectives summary, as of Oct 28, 2026.

How to use this practice set

• Time yourself. 90 minutes for up to 90 questions is about a minute each, and PBQs eat more than their share. Give these 10 about 10 minutes.
• Answer before you peek. Your future self in the testing room will thank you, quietly, because it’s a testing room.
• Read every explanation, even on the ones you got right. Security+ loves “which is the BEST answer,” and the why matters.

10 free Security+ practice questions

These are original questions written for this post. They are not from any real CompTIA exam.

1. (General security concepts) A company installs cameras in its parking lot mainly so that would-be thieves see them and decide not to try. What type of control is this, primarily?

A. Corrective
B. Deterrent
C. Compensating
D. Directive

Answer: B. A deterrent control discourages an attack before it starts. The same cameras also work as a detective control once you review the footage, but the question asks about the main purpose: scaring people off.

2. (Threats) An employee gets a text that looks like it’s from the IT help desk, asking them to tap a link and “re-verify” their password. What is this attack called?

A. Vishing
B. Smishing
C. Pharming
D. Whaling

Answer: B. Smishing is phishing by SMS text message. Vishing uses voice calls. Pharming redirects you to a fake site behind the scenes, and whaling targets senior executives.

3. (Threats) A web form passes user input straight into a database query. An attacker types ' OR 1=1 -- into the login box and gets in. Which mitigation fixes the root cause?

A. Use parameterized queries (prepared statements)
B. Require longer passwords
C. Turn on full-disk encryption on the database server
D. Add a login banner

Answer: A. This is SQL injection. Parameterized queries keep user input as data, so it can’t change the query itself. Input validation helps too. The other choices don’t touch how the query is built.

Architecture: where the network diagrams live

4. (Security architecture) A company wants its public web server reachable from the internet while keeping its internal file servers out of reach. Where should the web server go?

A. On the same subnet as the file servers
B. In a screened subnet (DMZ) between two firewall zones
C. On an employee laptop
D. Outside every firewall with no filtering

Answer: B. A screened subnet, often called a DMZ (demilitarized zone), holds public-facing systems. If the web server gets compromised, the attacker still has a firewall between them and the internal network. That’s segmentation doing its job.

5. (Security architecture) A team needs to recover from a full data center outage within hours and is willing to pay for a second site with hardware, power, and current data ready to go. Which option fits?

A. Cold site
B. Warm site
C. Hot site
D. Tape backups stored in the same building

Answer: C. A hot site is fully equipped and close to current, so recovery is fast but expensive. A warm site has some equipment and needs setup time. A cold site is basically an empty room with power. Tapes in the same building burn with the building.

Security operations: the biggest slice, so three questions

Security operations is 28% of the exam. If you have to pick one domain to over-study, this is the one. Bring coffee.

6. (Security operations) A security analyst confirms that malware is spreading from one workstation to others. According to the standard incident response order, what should happen next?

A. Lessons learned meeting
B. Containment, such as isolating the infected machines
C. Rebuilding every server in the company
D. Deleting the logs to save disk space

Answer: B. The usual flow is preparation, detection, analysis, containment, eradication, recovery, and lessons learned. Once you’ve confirmed the incident, you stop the spread first. And never delete logs: they’re your evidence.

7. (Security operations) Which tool collects logs from many systems in one place, links related events, and raises alerts?

A. SIEM
B. VPN
C. DLP
D. NAT

Answer: A. A SIEM (security information and event management) system gathers and correlates logs and alerts. A VPN (virtual private network) encrypts traffic between sites or users. DLP (data loss prevention) watches for sensitive data leaving. NAT (network address translation) maps private addresses to public ones.

8. (Security operations) A company wants employees to sign in once and then reach many approved apps without signing in again. What is this called?

A. Single sign-on (SSO)
B. Multifactor authentication (MFA)
C. Least privilege
D. Account lockout

Answer: A. SSO lets one trusted login work across many services. MFA means proving who you are with two or more types of factor, like a password plus a phone prompt. They often work together, but they’re different things.

Program management: the paperwork domain (it’s 20%, so don’t skip it)

9. (Program management) A company buys cyber insurance to cover losses from a possible breach. Which risk response is this?

A. Risk acceptance
B. Risk avoidance
C. Risk transference
D. Risk mitigation

Answer: C. Buying insurance shifts the financial hit to someone else, which is transference. Avoidance means stopping the risky activity entirely. Mitigation reduces the risk with controls. Acceptance means knowing the risk and living with it.

10. (Program management) A laptop is worth $2,000. Each theft costs the full value, and the company expects 3 laptop thefts per year. What is the annualized loss expectancy (ALE)?

A. $667
B. $2,000
C. $3,000
D. $6,000

Answer: D. Single loss expectancy (SLE) is the cost of one incident: $2,000. The annualized rate of occurrence (ARO) is 3. ALE = SLE x ARO = $2,000 x 3 = $6,000. This is about as much math as Security+ asks for, which is a relief to most of us.

How to score yourself

Count your correct answers, then look at where the misses came from. The pattern matters more than the total.

• Missed 1: review control types (deterrent, detective, corrective, and the rest).
• Missed 2-3: review social engineering names and common attacks like injection.
• Missed 4-5: review network segmentation and recovery site types.
• Missed 6-8: review the incident response steps, SIEM, and identity tools.
• Missed 9-10: review risk responses and the SLE/ARO/ALE formulas.

Ten questions can’t predict your exam result. Use practice scores as a trend, and move to longer timed sets as test day gets close.

The bottom line

SY0-701 is up to 90 questions in 90 minutes, with a passing score of 750 on CompTIA’s 100 to 900 scale. Security operations is the biggest domain at 28%, so most of your free Security+ practice questions should come from there. And keep an eye on the V8 launch before you schedule.

Exam facts checked against CompTIA’s Security+ V7 page and Security+ overview page as of Oct 28, 2026. Exams change, so always confirm with CompTIA before you test. ebooklessons.com is an independent study aid and is not affiliated with CompTIA.