Security+ SY0-701 Practice Test

SY0-701 practice test: what's covered

• Cybersecurity Foundations

Free SY0-701 sample questions

1. A hospital deploys redundant power, clustered servers, and offsite replication so patient records stay reachable during outages. Which CIA triad goal is this primarily protecting?

   • A. Confidentiality of records
   • B. Integrity of records
   • C. Availability of records
   • D. Non-repudiation of records
   Show answer

   Correct: C. Redundancy and replication keep data reachable, which is the availability goal. Confidentiality is incorrect because it concerns preventing disclosure, not uptime. Integrity is wrong because it protects against unauthorized modification, not accessibility. Non-repudiation is not part of the core triad and addresses proving the origin of an action.

2. A vendor signs a software release so customers can prove it came from the vendor and was not altered, and the vendor cannot later deny publishing it. Which property does this provide?

   • A. Confidentiality through encryption
   • B. Non-repudiation via digital signatures
   • C. Availability via load balancing
   • D. Anonymization of the publisher
   Show answer

   Correct: B. A digital signature uses the signer's private key, so the origin can be proven and denial is prevented, which is non-repudiation. Confidentiality is incorrect because signing does not hide the content, only authenticates it. Availability is unrelated to signing. Anonymization is the opposite of the goal here because the signature deliberately ties the release to the publisher.

3. After an account compromise, an investigator needs to know which user logged in, what resources they touched, and when. Which AAA component supplies this record?

   • A. Authentication logging
   • B. Authorization policy
   • C. Accounting records
   • D. Federation metadata
   Show answer

   Correct: C. Accounting is the AAA component that records what an authenticated subject did and when, supporting audits and investigations. Authentication only confirms identity, not actions taken afterward. Authorization defines what is permitted but does not itself produce the activity log. Federation metadata describes trust between identity providers and is not an activity record.

4. A company is moving from a perimeter-trust model to Zero Trust. Which principles should guide the redesign? (Choose TWO)

   • A. Trust any device once it is on the internal VLAN
   • B. Verify every access request explicitly per session
   • C. Grant least privilege based on identity and context
   • D. Rely on a single hardened firewall at the edge
   • E. Disable all logging to reduce processing overhead
   Show answer

   Correct: B and C. Zero Trust requires explicit per-session verification and least-privilege access tied to identity and context. Trusting devices on the internal VLAN is incorrect because Zero Trust removes implicit network trust. A single edge firewall contradicts the assume-breach mindset. Disabling logging is wrong because Zero Trust depends on continuous monitoring and telemetry to make access decisions.

5. A security architect layers physical locks, network segmentation, endpoint controls, and encryption so that breaching one layer does not expose the asset. This design approach is best described as:

   • A. Security through obscurity
   • B. Defense in depth
   • C. Single sign-on
   • D. Implicit deny only
   Show answer

   Correct: B. Defense in depth uses multiple independent, layered controls so that one failure does not compromise the asset. Security through obscurity relies on hiding details and is not a layered control strategy. Single sign-on is an authentication convenience, not a layering model. Implicit deny is one access-control rule, not the broad multi-layer concept described here.

Last updated: 2026-10-19

SY0-701 practice test FAQ

Related practice tests

• N10-009 practice test
• CS0-003 practice test
• PT0-003 practice test
• ISC2 CC practice test
• 220-1101/220-1102 practice test
• CAS-005 practice test