A company posts signs at every entrance saying the building is under video surveillance. What type of control is the warning sign?
Keep practicing
Now make your own
Upload your prep book, slides or notes, or just tell Bo what you want to learn. You do not need a document to start.
About this test
This free Security Plus practice test has 15 questions, written by the StudyPDF team from the published CompTIA Security+ exam objectives. It samples all five domains: general security concepts, threats and vulnerabilities, security architecture, security operations, and security program management. You will meet multiple choice, select all that apply and fill in the blank. Answer all 15 questions, then check your score and read the explanation for every question. It tests concepts that stay the same across exam versions.
All 15 questions at a glance
Prefer to read before you play? Every question in the sampler is listed below. Answers and explanations stay collapsed until you open them.
1.A company posts signs at every entrance saying the building is under video surveillance. What type of control is the warning sign?
- A. Corrective
- B. Deterrent
- C. Compensating
- D. Detective
Answer: B. Deterrent
A deterrent control tries to discourage an action before it starts, and a sign works only by changing what a would-be intruder decides to do. The camera behind it would be a detective control, because it records what happens. A corrective control fixes damage afterward, and a compensating control stands in when the preferred control cannot be used.
2.Complete the sentence.
Hashing a file lets you detect whether it changed, which supports _____. A digital signature adds _____, because only the holder of the private key could have produced it.
Options for blank 1: confidentiality, integrity, availability
Options for blank 2: non-repudiation, availability, obfuscation
Answer: integrity, non-repudiation
A hash is a fixed-length fingerprint of the data, and any change to the file produces a different one, so comparing hashes checks integrity. A hash does not hide the contents, so it is not confidentiality. A digital signature is made with the signer's private key and checked with the public key, which ties the message to the signer. That makes it hard for the signer to deny sending it later, which is non-repudiation.
3.An employee who is about to resign copies the customer database to a personal cloud account to take to a competitor. Which threat actor and motivation fit best?
- A. An insider threat seeking financial gain
- B. A hacktivist seeking publicity
- C. A nation-state seeking espionage
- D. An unskilled attacker seeking notoriety
Answer: A. An insider threat seeking financial gain
The actor already has legitimate access and is taking data for personal or competitive advantage, which is an insider threat. Perimeter defenses do not stop someone who is already inside. The controls that help are least privilege, data loss prevention, activity monitoring, and removing access promptly when someone leaves.
4.Which of the following are social engineering techniques?
Select all that apply.
- A. A phishing email that imitates the payroll department
- B. SQL injection against a login form
- C. Calling the help desk and pretending to be a senior executive to get a password reset
- D. Following an employee through a badge-controlled door without a badge
- E. A buffer overflow in a network service
- F. A distributed denial-of-service flood
Answer: A. A phishing email that imitates the payroll department, C. Calling the help desk and pretending to be a senior executive to get a password reset, D. Following an employee through a badge-controlled door without a badge
Social engineering manipulates people, not software. Phishing tricks the reader, pretexting invents a believable story to get information or access, and tailgating uses courtesy to slip past a physical control. SQL injection, buffer overflows and denial-of-service floods attack systems directly, so they are application or network attacks. Technical controls alone will not stop the human kind, and security awareness training is the main defense.
5.An attacker types ' OR '1'='1 into the password field of a web login form and is logged in without a valid password. Which defense most directly prevents this attack?
- A. Forcing users to choose longer passwords
- B. Requiring a VPN to reach the web server
- C. Enabling full-disk encryption on the database server
- D. Using parameterized queries and validating input
Answer: D. Using parameterized queries and validating input
This is SQL injection. The application pastes user input into a database command, so the attacker's text becomes part of the command. Parameterized queries keep the input as data, never as code, and input validation adds a second layer. Longer passwords do not matter when the check is bypassed, a VPN does not stop an authorized user from sending bad input, and disk encryption protects data at rest, not queries.
6.A user on the office network opens a sensitive HR application. Under a zero trust model, how is the request handled?
- A. It is allowed, because the user is already inside the trusted network
- B. It is allowed once the user passes the firewall at the network edge
- C. It is evaluated on its own, checking identity, device health and context before access is granted
- D. It is blocked unless the user is physically in the office
Answer: C. It is evaluated on its own, checking identity, device health and context before access is granted
Zero trust drops the idea that being inside the network earns trust. Every request is verified explicitly, using identity, device posture, location and other signals, and access is limited to what the request needs. That limits how far an attacker or a compromised account can move once inside. Location can be one input, but it is never the only one.
7.Management says the business can tolerate losing no more than four hours of data after an outage. Which metric states that requirement?
- A. Recovery time objective (RTO)
- B. Recovery point objective (RPO)
- C. Mean time between failures (MTBF)
- D. Mean time to repair (MTTR)
Answer: B. Recovery point objective (RPO)
The recovery point objective is the most data loss the business accepts, measured as time back from the incident. A four-hour RPO means backups or replication must run at least every four hours. The recovery time objective is how fast a service must be back, which is a different question. MTBF and MTTR describe how reliable and how repairable a component is.
8.A company runs virtual machines on an infrastructure as a service (IaaS) cloud. Which of the following are the customer's responsibility?
Select all that apply.
- A. Patching the guest operating system
- B. Physical security of the provider's data centers
- C. Configuring user access and protecting the data stored in the virtual machines
- D. Maintaining the hypervisor and host hardware
- E. Hardening and patching the applications the customer installs
Answer: A. Patching the guest operating system, C. Configuring user access and protecting the data stored in the virtual machines, E. Hardening and patching the applications the customer installs
In the shared responsibility model, the provider secures the facilities, hardware and virtualization layer. In IaaS the customer owns everything above that: the guest operating system, applications, identities, access settings and data. The split moves with the service model. In software as a service the provider takes on much more, but the customer still owns user access and data.
9.Which combination is an example of multifactor authentication?
- A. A password and a security question
- B. A PIN and a password
- C. A password and a fingerprint scan
- D. Two different passwords
Answer: C. A password and a fingerprint scan
Multifactor authentication combines different factor types: something you know, something you have, something you are, and sometimes somewhere you are. A password is knowledge and a fingerprint is something you are, so that pair counts. A security question, a PIN and a second password are all knowledge, so each of those pairs is still a single factor used twice.
10.A company confirms ransomware on one workstation. Which of the following are appropriate incident response activities?
Select all that apply.
- A. Disconnect the workstation from the network to contain the spread
- B. Wait a week to see whether the alerts repeat before taking action
- C. Restore the affected systems from clean, tested backups after the malware is removed
- D. Delete the logs on the workstation to save disk space
- E. Hold a lessons-learned review and update the response plan afterward
Answer: A. Disconnect the workstation from the network to contain the spread, C. Restore the affected systems from clean, tested backups after the malware is removed, E. Hold a lessons-learned review and update the response plan afterward
Incident response moves through preparation, detection and analysis, containment, eradication, recovery and a review afterward. Isolating the machine contains the damage, restoring from clean backups recovers, and the lessons-learned review improves the plan. Waiting lets the malware spread, and deleting logs destroys evidence that the investigation and any legal process may need.
11.A vulnerability scan finishes without flagging a server that is in fact missing a critical patch. What is this result called?
- A. A false negative
- B. A false positive
- C. A true negative
- D. A true positive
Answer: A. A false negative
A false negative is a real problem that the tool failed to report, and it is the dangerous kind because nobody looks for something that was never flagged. A false positive is the reverse, a finding that turns out not to exist. Credentialed scans and a second tool or manual check are common ways to cut down on false negatives.
12.Complete the sentence.
An intrusion detection system _____ suspicious traffic and raises an alert, while an intrusion prevention system placed inline can also _____ it.
Options for blank 1: encrypts, detects, routes
Options for blank 2: archive, replicate, block
Answer: detects, block
A detection system watches a copy of the traffic and tells people about problems. A prevention system sits in the path of the traffic, so it can drop the packets or reset the connection as well. The tradeoff is that an inline system can interrupt legitimate traffic if it is wrong, so it needs careful tuning.
13.Complete the sentence.
A single loss event is expected to cost $20,000 and to happen about once every two years. The annualized loss expectancy is $_____.
Options for blank 1: 5,000, 10,000, 20,000, 40,000
Answer: 10,000
Annualized loss expectancy is the single loss expectancy times the annualized rate of occurrence. One event every two years is a rate of 0.5 per year, so 20,000 x 0.5 = 10,000. The 40,000 option multiplies by two instead of halving. The figure helps decide whether a control that costs less than the expected annual loss is worth buying.
14.A company buys cyber insurance to cover the costs of a data breach instead of changing how it stores data. Which risk response is this?
- A. Avoid
- B. Accept
- C. Mitigate
- D. Transfer
Answer: D. Transfer
Transfer moves the financial impact to another party, such as an insurer. It does not lower the likelihood of a breach, and other harm like lost trust stays with the company. Avoid means dropping the risky activity, mitigate means reducing likelihood or impact with controls, and accept means knowingly living with the risk.
15.Before a penetration test begins, which document defines what may be tested, when, and with which methods?
- A. Business impact analysis
- B. Rules of engagement
- C. Acceptable use policy
- D. Incident response plan
Answer: B. Rules of engagement
The rules of engagement set the scope, the schedule, the permitted techniques, who to contact and how to stop if something breaks. Written authorization is what separates a penetration test from an attack. A business impact analysis ranks business functions by how bad their loss would be, an acceptable use policy governs everyday use of company systems, and an incident response plan covers real incidents.
What the Security+ exam covers and what this page practices
CompTIA Security+ is a cybersecurity certification from CompTIA. When this page was last checked, in October 2026, CompTIA listed two versions. The current one is V7, exam code SY0-701, which launched in November 2023 and which CompTIA says retires in English on June 11, 2027. The next one is V8, exam code SY0-801, which CompTIA says is expected to launch on or around November 17, 2026. Both are listed with a maximum of 90 questions, a mix of multiple choice and performance-based questions, 90 minutes, and a passing score of 750 on a scale of 100 to 900.
Both versions use five domains. In V7 the weights are general security concepts 12 percent, threats, vulnerabilities and mitigations 22 percent, security architecture 18 percent, security operations 28 percent, and security program management and oversight 20 percent. V8 shifts them to 16, 24, 19, 27 and 14 percent, renames the second domain to threats, vulnerabilities and attacks, and adds AI-related risks. Security operations is the biggest domain in both, so give it the most study time. For V7, CompTIA lists Network+ and two years of experience in a security or systems administrator job role as recommended, not required.
This sampler uses 15 questions spread across the five domains and sticks to concepts that appear in both versions, so it stays useful when V8 replaces V7. It cannot reproduce the performance-based questions, which are hands-on simulations. Check CompTIA's own pages for the current objectives, price and retirement dates before you book anything.
How to use this sampler and what to practice first
Take all 15 questions in one sitting without notes, then read the explanation for every question, including the ones you got right. Treat each miss as a topic. If you missed the injection question and the social engineering question, that points to attacks, not to two unrelated facts.
Security+ questions often hinge on a few words. Look for what the question asks you to pick: the best control, the first step, the most likely cause. Several options are usually true statements that answer a different question. Name the category before you read the choices, for example whether the scenario is about prevention, detection or recovery, and the wrong options become easier to drop.
For the weeks before the exam, build short lists in your own words: control types with one example each, the steps of incident response in order, the factors of authentication, the risk responses, and the main acronyms. Then practice scenario questions, because the real exam gives you a situation and asks what to do. If you are unsure about a topic, the version-specific detail matters less than the concept behind it.
How StudyPDF builds full practice tests from your own study material
Fifteen questions can show you which domain needs the most work. They cannot get you ready on their own, and a generic set does not know which course or study guide you use.
StudyPDF works from your material instead. Upload your Security+ study guide, your course slides or your own notes. Then press New material, pick a practice test, choose those files as the sources and set how long it should be. You get a test written from those exact pages, and every explanation cites where the answer comes from. Narrow one to a single domain, such as security operations, and run it again after you review.
Bo is the tutor for the rest. Ask why an answer is right and Bo explains it from your own pages, with a hint first if you want one.
You do not have to upload anything to start. Name a topic instead, for example incident response or public key infrastructure, and you get practice questions on it. Starting is free.
Written by the StudyPDF team. Last updated August 19, 2026.
Good to know
Is this Security Plus practice test really free?
Yes. All 15 questions, the score screen and every explanation are free to play in your browser, and there is no paywall on this page.
How many questions is the Security+ exam, and what score do I need?
When this page was last checked, CompTIA listed a maximum of 90 questions, a mix of multiple choice and performance-based, 90 minutes, and a passing score of 750 on a scale of 100 to 900 for both V7 (SY0-701) and the upcoming V8 (SY0-801). CompTIA expects V8 on or around November 17, 2026, so confirm the current version, objectives and price on CompTIA's own site before you book.
Are these real Security+ questions, and are you affiliated with CompTIA?
No. The StudyPDF team wrote all 15 questions and explanations from the published exam objectives. None comes from the real exam, from a vendor's bank or from recalled exam items. StudyPDF is not affiliated with CompTIA, and CompTIA and Security+ are marks of CompTIA, Inc. Use the official CompTIA objectives to check what is on the current exam.
Can I get more Security+ questions from my own study material?
Yes. Upload your Security+ study guide, course slides or notes to StudyPDF, and Bo builds full-length practice tests from those exact pages, with explanations that cite where each answer came from. If you only have a paper book, name a topic instead, for example public key infrastructure or incident response, and Bo writes a test from that.