Security+ Practice Questions
Prepare for SY0-701 with more than an answer.
Unlock the full exam and previous versions
- v1Version 1 425 questions Current
- SY0-501Legacy Security+ (2020) 980 questions Locked
- SY0-601Legacy Security+ (2021) 78 questions Locked
- Exam fee
- $392 USD
- Level
- Entry-Level to Intermediate
- Valid for
- 3 years
Domains covered on the exam 5
- General Security Concepts12%
- Threats, Vulnerabilities, and Mitigations22%
- Security Architecture18%
- Security Operations28%
- Security Program Management and Oversight20%
- 1
A security team wants to detect when attackers attempt to enumerate users in a cloud application. They create a fake user account with administrative privileges in the directory but strictly monitor it for any login attempts. No legitimate user is aware of this account. What type of deception technology is this?
Show answer details
Correct answer: D
A Honeytoken is a piece of data (like a fake user credential, API key, or database entry) that allows organizations to track misuse. Unlike a Honeypot (which is a system), a Honeytoken is a digital asset embedded in production systems. If anyone attempts to use the Honeytoken (in this case, the fake admin account), it triggers an alert, indicating potential reconnaissance or compromise.
- 2
Which of the following threat actors is MOST likely to insert malicious microchips into server hardware during the manufacturing process to facilitate long-term espionage against government targets?
Show answer details
Correct answer: C
Nation-state actors typically have the high level of funding, resources, and sophistication required to compromise hardware supply chains at the manufacturing level. Their motivation is often long-term espionage (Advanced Persistent Threat) against high-value targets like foreign governments or critical infrastructure.
- 3
A user receives a phone call from someone claiming to be from 'Corporate IT Support' asking for their password to resolve a 'critical account sync issue.' At the same time, the user receives an SMS message appearing to be from the same support desk with a verification code. Which TWO social engineering techniques are being combined in this attack? (Select TWO)
Show answer details
Correct answer: B, D
Smishing (SMS Phishing) involves using text messages to trick users. The concurrent SMS message with the verification code is an example of Smishing used to reinforce the Vishing attempt.
Vishing (Voice Phishing) is the use of phone calls to deceive users into surrendering sensitive information. The attacker claiming to be IT Support over the phone is conducting Vishing.
- 4
While reviewing application logs, a security analyst notices a sequence of operations where a user checks the balance of a gift card and then immediately redeems it. However, due to a delay in updating the database balance, the user is able to redeem the same card multiple times within a few milliseconds. What type of vulnerability is being exploited here?
Show answer details
Correct answer: B
This scenario describes a Race Condition, specifically Time-of-Check to Time-of-Use (TOCTOU). The application checks the balance (Time-of-Check) and finds it sufficient. Before it can deduct the balance and complete the transaction (Time-of-Use), a second request interferes, exploiting the gap in time to perform an unauthorized action (double spending).
- 5
A developer has implemented an API that allows users to retrieve their profile information using the endpoint
/api/user/{id}/profile. A security tester discovers that by changing the{id}to another user's ID, they can view that user's private profile data without authorization. Which API vulnerability does this represent?Show answer details
Correct answer: B
Broken Object Level Authorization (BOLA), also known as Insecure Direct Object Reference (IDOR), occurs when an API exposes a reference to an object (like a user ID) but fails to validate that the authenticated user has permission to access that specific object. Changing the ID to access another user's data is the classic example of this vulnerability.
- 6
A security analyst is investigating a compromised server and observes network traffic attempting to communicate with a known Command and Control (C2) server at regular 5-minute intervals. The traffic payload is small and consistent in size. What type of activity is the analyst observing?
Show answer details
Correct answer: D
Beaconing is the practice of malware sending regular signals (heartbeats) to a Command and Control (C2) server to check for instructions or updates. The regularity (every 5 minutes) and small consistent payload are hallmark indicators of beaconing activity.
- 7
During an incident response investigation, analysts discover malicious code running directly in the RAM of a workstation. There are no associated files on the hard drive, and the malware disappears upon reboot. Which type of malware is this?
Show answer details
Correct answer: C
Fileless malware operates in memory (RAM) and uses existing system tools (like PowerShell or WMI) to execute malicious activity without writing executable files to the disk. This makes it harder for traditional antivirus to detect and it typically does not persist after a reboot unless specific persistence mechanisms are established.
- 8
An attacker calls a company's helpdesk pretending to be a senior executive who has forgotten their password and needs urgent access to a project file before a board meeting. The attacker uses an authoritative tone and creates a sense of panic. Which social engineering principle is the attacker primarily exploiting?
Show answer details
Correct answer: A
The attacker is using 'Authority' by impersonating a senior executive to intimidate the helpdesk staff, and 'Urgency' by claiming the need is for an immediate board meeting. This combination pressures the victim to bypass standard verification procedures.
- 9
A cloud administrator accidentally configures an S3 bucket containing customer data with 'Public Access' enabled. Within hours, the data is indexed by search engines. Which type of vulnerability led to this exposure?
Show answer details
Correct answer: A
Security Misconfiguration is the failure to implement security controls properly. In cloud environments, setting storage buckets to 'Public' instead of 'Private' is a common misconfiguration that leads to data exposure without any advanced hacking techniques.
- 10
To prevent unauthorized applications from running on corporate endpoints, a security administrator wants to implement a control that strictly permits only pre-approved software to execute. Which mitigation technique should be deployed?
Show answer details
Correct answer: B
Application Allow-listing (formerly whitelisting) is a 'deny-by-default' approach where only explicitly approved software is allowed to run. This is far more effective against zero-day malware and unauthorized software than block-listing, which relies on knowing what is bad.
- 11
What is the primary benefit of implementing a Zero Trust Architecture in a corporate network?
Show answer details
Correct answer: A
Zero Trust Architecture focuses on continuous verification of each user and device, ensuring access control is maintained at all times.
- 12
Infrastructure as Code (IaC) is a critical component in modern DevOps practices. Which of the following is a key advantage of using IaC?
Show answer details
Correct answer: C
IaC allows for automated and consistent system configuration, reducing errors and increasing deployment speed.
