Practice questions for the CompTIA Security+ exam objectives
Security+ SY0-701Domain 1 · General Security Concepts
An organization is designing its zero-trust architecture per NIST SP 800-207. The team has identified the resources to be protected and the subjects requesting access. They need to add the component that evaluates the access request against policy and decides whether to grant access. Which NIST 800-207 component performs this function?
ConfidenceI think so
2 / 3
Practice and timed mocks are free, with right or wrong on every answer and your total score.
About this CompTIA Security+ practice test
This free CompTIA Security+ practice test has 150 original questions written from the outline of the CompTIA. The real exam has 90 questions and a limit of 1 hour 30 minutes. Practice shows right or wrong on every answer; the full analysis, $39 once, adds each explanation and source. Bank checked 2026-05-22.
These three are published in full. For every other question, practice shows right or wrong and the full analysis adds the answer.
Sample question 1: Security Program Management and Oversight
A third-party risk team is reviewing a contract with a critical software vendor. The contract must obligate the vendor to a specific minimum service-level expectation with measurable metrics and remedies for breach. Which agreement type matches that obligation?
Memorandum of Understanding (MOU)
Service-Level Agreement (SLA)
Non-Disclosure Agreement (NDA)
Master Service Agreement (MSA)
Answer: B. Service-Level Agreements specify measurable service-level expectations and remedies for breach. MOUs are non-binding statements of intent. NDAs govern confidentiality. MSAs are umbrella contracts that often reference but do not themselves contain the SLA metrics. The SY0-701 governance objectives enumerate these contract types and require the candidate to map each to its purpose.
An organization wants to add a passwordless authentication option for employees. Requirements: must support phishing-resistant authentication, must work across the major browsers, and must let users authenticate without typing a shared secret. Which technology best meets the requirements?
Time-based one-time password (TOTP) via an authenticator app
SMS one-time password (OTP)
FIDO2 / WebAuthn passkey (hardware-backed or platform-bound)
Username and complex password rotated every 60 days
Answer: C. FIDO2 / WebAuthn passkeys are the canonical phishing-resistant passwordless mechanism. The cryptographic challenge-response is bound to the origin, which defeats phishing sites that proxy the credential. TOTP and SMS OTP can both be phished or intercepted; complex passwords plus rotation remain shared-secret authentication. NIST SP 800-63B and CISA's MFA guidance both single out phishing-resistant authenticators.
Sample question 3: Threats, Vulnerabilities, and Mitigations
A risk register lists a single threat actor described as well-funded, persistent, focused on long-term intelligence collection, and operating with the support of a government. Which category of actor best matches this profile under the SY0-701 actor taxonomy?
Organized crime
Hacktivist
Unskilled attacker
Nation-state actor (APT)
Answer: D. Government sponsorship plus long-term, persistent, intelligence-collection focus is the defining set of attributes for a nation-state actor, often described as an Advanced Persistent Threat. Organized crime is motivated by financial gain; hacktivists pursue ideological objectives with shorter operations; unskilled attackers (formerly script kiddies) have limited resources and persistence. The CompTIA SY0-701 actor catalog explicitly enumerates these five categories.
The questions are drafted with AI (Anthropic's Claude) from the official outline and primary sources, then checked against the source each one cites. A licensed professional has not reviewed them unless this page says so. See the AI disclosure.
Who stands behind this page
Accountable editor
Julian Calvo, Ed.D., founder. Ed.D. in Learning Sciences (University of Miami), MBA (Lynn University), Master's in Organizational Learning and Leadership (Barry University). His credentials are in learning sciences and assessment design, not in the field this exam covers.
Licensed professional review
None on record. No licensed professional has reviewed this question bank. It is drafted with AI and checked against its cited sources by the DecipherU item team.
How the questions are made
Drafted with AI (Anthropic's Claude) from the official outline and primary sources, then checked against the source each question cites by the DecipherU item team. Julian Calvo designed this method. No real exam content is used. Read the AI disclosure and the methodology.
What this bank shows
150 live questions; 150 cite at least one primary source. None carries a scheduled re-check date.