CompTIA Security+ Certification Exam (2026) SY0-701 Practice Questions

Page: 1 / 14
Total 907 questions
Question 1

An IT team rolls out a new management application that uses a randomly generated MFA token sent to the administrator's phone. Despite this new MFA precaution, there is a security breach of the same software. Which of the following describes this kind of attack?



Answer : D

Comprehensive and Detailed Explanation From Exact Extract:

If MFA is in place yet attackers still breach the system, the compromise most likely resulted from social engineering, specifically pretexting. Pretexting occurs when an attacker fabricates a convincing scenario (a ''pretext'') to trick the victim into revealing authentication information, such as OTP codes, MFA prompts, or login details. Even strong MFA cannot prevent an attack when a human is tricked into voluntarily providing the code.

Smishing (A) involves fraudulent SMS messages, but no messaging is mentioned in the scenario. Typosquatting (B) involves deceptive URLs that appear similar to legitimate sites and is unrelated to MFA compromise. Espionage (C) refers to stealing sensitive or national-security-related information, not bypassing MFA protections.

Security+ SY0-701 details pretexting under Social Engineering Attacks, emphasizing that MFA does not fully mitigate human manipulation. Attackers frequently impersonate IT staff, vendors, or automated systems to convince victims to ''verify'' or ''confirm'' credentials. This perfectly matches a breach where MFA was present but still circumvented through deception.


Question 2

An organization is struggling with scaling issues on its VPN concentrator and internet circuit due to remote work. The organization is looking for a software solution that will allow it to reduce traffic on the VPN and internet circuit, while still providing encrypted tunnel access to the data center and monitoring of remote employee internet traffic. Which of the following will help achieve these objectives?



Answer : A

SASE stands for Secure Access Service Edge. It is a cloud-based service that combines network and security functions into a single integrated solution. SASE can help reduce traffic on the VPN and internet circuit by providing secure and optimized access to the data center and cloud applications for remote employees. SASE can also monitor and enforce security policies on the remote employee internet traffic, regardless of their location or device.SASE can offer benefits such as lower costs, improved performance, scalability, and flexibility compared to traditional VPN solutions.Reference:CompTIA Security+ Study Guide: Exam SY0-701, 9th Edition, page 457-4581


Question 3

A company is redesigning its infrastructure and wants to reduce the number of physical servers in use. Which of the following architectures is best suited for this goal?



Answer : C


Question 4

Which of the following is a feature of a next-generation SIEM system?



Answer : B


Question 5

Which of the following should be used to ensure that a device is inaccessible to a network-connected resource?



Answer : C

Host isolation ensures that a device cannot communicate with other systems on the network. Isolation is typically applied through EDR/XDR tools, quarantine mechanisms, or endpoint firewalls. Security+ SY0-701 identifies host isolation as a containment technique used when:

A device is suspected of compromise

Lateral movement must be prevented

Sensitive systems must be protected

A system must be completely cut off except for administrative access

Isolation enforces an immediate block on all inbound and outbound communications, effectively making the device inaccessible to any network-based resource.

Disablement of unused services (A) reduces attack surface but does not isolate the device.

A WAF (B) protects web applications, not device access.

A network IDS (D) only monitors traffic and does not block access.

Thus, C: Host isolation is the correct answer.


Question 6

A security analyst learns that an attack vector, which was used as a part of a recent incident, was a well-known IoT device exploit. The analyst needs to review logs to identify the time of initial exploit. Which of the following logs should the analyst review first?



Answer : A

Many IoT devices connect to the network via wireless access points. Reviewing these logs would reveal when the IoT device first connected, as well as any suspicious or anomalous traffic patterns associated with the exploit's initiation.


CompTIA Security+ SY0-701 Official Study Guide, Domain 4.1: 'Wireless access point logs can help determine initial connectivity and exploitation of IoT devices.'

Exam Objectives 4.1: ''Summarize the importance of logging and monitoring activities.''

Question 7

Which of the following can be used to mitigate attacks from high-risk regions?



Answer : C


Page:    1 / 14   
Total 907 questions