40 Security Operations & Identity/Access Mgmt Practice Questions & Answers
Every Security Operations & Identity/Access Mgmt practice question from the CompTIA Security+ Practice Test, with the correct answer and a short explanation.
Start practice test →1. Granting users only the minimum access rights they need to perform their job, and nothing more, is the principle of:
- A.Separation of duties
- B.Defense in depth
- C.Least privilege✓ Answer
- D.Implicit deny
Least privilege limits each user (and process) to only the access required for their role, shrinking the attack surface if the account is compromised.
2. A system requires a password AND a one-time code from a hardware token. These represent which two authentication factors?
- A.Something you know and something you have✓ Answer
- B.Something you know and something you are
- C.Something you are and somewhere you are
- D.Two instances of something you know
A password is 'something you know' and a hardware token is 'something you have,' so combining them is true multifactor authentication.
3. Which type of system aggregates and correlates log data from many sources across the network to provide real-time security monitoring and alerting?
- A.Firewall
- B.Proxy server
- C.Load balancer
- D.SIEM✓ Answer
A SIEM (Security Information and Event Management) collects and correlates logs from across the environment to detect and alert on security events in real time.
4. In which access-control model are permissions assigned to roles (like 'Accountant' or 'Manager'), and users gain permissions by being placed into a role?
- A.Discretionary access control (DAC)
- B.Role-based access control (RBAC)✓ Answer
- C.Mandatory access control (MAC)
- D.Attribute-based access control (ABAC)
Role-based access control assigns permissions to roles and grants users those permissions through role membership, simplifying administration.
5. What is the correct order of the incident response phases in common frameworks such as NIST?
- A.Detection, Preparation, Recovery, Containment
- B.Containment, Preparation, Identification, Recovery
- C.Preparation, Identification, Containment, Eradication, Recovery, Lessons learned✓ Answer
- D.Recovery, Eradication, Preparation, Identification
The standard incident response lifecycle is Preparation → Identification → Containment → Eradication → Recovery → Lessons learned.
6. Requiring two different employees to complete a sensitive financial transaction—one to initiate it and another to approve it—is an example of:
- A.Separation of duties✓ Answer
- B.Least privilege
- C.Job rotation
- D.Mandatory vacation
Separation of duties splits a critical task among multiple people so no single individual can complete it alone, reducing fraud and error.
7. The 3-2-1 backup rule recommends keeping your data how?
- A.One copy on one medium
- B.Two copies both stored on-site
- C.Three copies all in the same cloud account
- D.Three copies on two different media, with one copy off-site✓ Answer
The 3-2-1 rule: keep 3 copies of data, on 2 different types of media, with 1 copy stored off-site to survive local disasters.
8. Which device not only detects malicious network traffic but can also automatically block or drop it in real time?
- A.Intrusion detection system (IDS)
- B.Intrusion prevention system (IPS)✓ Answer
- C.Passive network tap
- D.Syslog server
An IPS sits inline and can actively block malicious traffic, whereas an IDS only detects and alerts without stopping the traffic itself.
9. A ransomware attack that makes critical files inaccessible to legitimate users MOST directly violates which element of the CIA triad?
- A.Availability✓ Answer
- B.Confidentiality
- C.Non-repudiation
- D.Authentication
The CIA triad is Confidentiality, Integrity, and Availability. Blocking legitimate access to data primarily harms availability.
10. Which ongoing security operation is MOST important for closing known software vulnerabilities before attackers can exploit them?
- A.Password rotation
- B.Data classification
- C.Patch management✓ Answer
- D.Physical badge access
Patch management applies vendor updates that fix known vulnerabilities, closing the window attackers use before an exploit is weaponized against you.
11. An employee is terminated. Which action should be taken IMMEDIATELY to reduce security risk?
- A.Schedule their password to rotate in 90 days
- B.Disable or remove their user account and access✓ Answer
- C.Archive their email for one year
- D.Give their manager the employee's credentials
Prompt deprovisioning—disabling the account and revoking access at termination—prevents the former employee from using lingering credentials.
12. Which technology is designed to detect and prevent sensitive data (such as credit-card numbers) from leaving the organization via email or file uploads?
- A.SIEM
- B.IPS
- C.Load balancer
- D.Data loss prevention (DLP)✓ Answer
Data loss prevention (DLP) inspects content in motion and at rest to detect and block unauthorized transfer of sensitive data out of the organization.
13. Which assessment actively attempts to exploit vulnerabilities to demonstrate real-world impact, going beyond merely identifying them?
- A.Penetration test✓ Answer
- B.Vulnerability scan
- C.Compliance audit
- D.Asset inventory
A penetration test actively exploits weaknesses to prove real-world impact, whereas a vulnerability scan only identifies potential weaknesses without exploiting them.
14. During evidence collection on a compromised server, which data source should a forensic analyst capture FIRST according to the order of volatility?
- A.CPU registers and cache✓ Answer
- B.Configuration files on the system drive
- C.A full image of the hard disk
- D.Archived backup tapes stored offsite
The order of volatility requires collecting the most short-lived data first because it disappears the moment power is lost or the state changes; CPU registers and cache are the most volatile of all, followed by RAM, disk, and finally archival media.
Source: RFC 3227, Section 2.1 (Order of Volatility); CompTIA SY0-701 Objective 4.8 (digital forensics)Report a problem with this question
15. Why must investigators maintain a chain of custody document for every piece of digital evidence?
- A.It ranks the severity of the incident for management reporting
- B.It records who handled the evidence, when, and why, so its integrity can be proven in court✓ Answer
- C.It encrypts the evidence so attackers cannot read it
- D.It guarantees a backup copy of the evidence exists
A chain of custody creates an unbroken, documented record of every transfer and access from collection to courtroom; without it, opposing counsel can argue the evidence may have been altered, making it inadmissible.
Source: CompTIA SY0-701 Objective 4.8 (digital forensics: chain of custody)Report a problem with this question
16. A forensic analyst computes a SHA-256 hash of a disk image immediately after acquisition and again before analysis. What is the purpose of this step?
- A.To encrypt the image so only investigators can open it
- B.To prove the image has not been altered since acquisition✓ Answer
- C.To compress the image for faster storage
- D.To recover deleted files from the image
A cryptographic hash acts as a digital fingerprint: if even one bit of the image changes, the hash changes, so matching before-and-after hashes proves the evidence preserved its integrity throughout handling and analysis.
Source: NIST SP 800-86, Section 3.1.2 (data integrity verification); CompTIA SY0-701 Objective 4.8 (preservation, acquisition)Report a problem with this question
17. A SOC already uses a SIEM to aggregate and alert on logs. What additional capability would deploying a SOAR platform provide?
- A.Long-term storage of raw log data
- B.Signature-based scanning of endpoint files
- C.Automated execution of response actions through predefined playbooks✓ Answer
- D.Real-time correlation of events from multiple sources
The distinguishing function of SOAR is orchestration and automation: it takes alerts (often from the SIEM) and automatically carries out response steps such as disabling accounts or isolating hosts, whereas log aggregation and correlation are core SIEM functions.
Source: CompTIA SY0-701 Objective 4.7 (automation and orchestration: SOAR use cases)Report a problem with this question
18. In incident response, what is a playbook?
- A.A tool that captures full packet data during an attack
- B.A documented, step-by-step checklist for responding to a specific incident type, such as phishing✓ Answer
- C.A contract defining response times with an outsourced SOC
- D.A network diagram showing all monitored assets
A playbook standardizes response by prescribing the exact sequence of actions for a given scenario, which reduces errors under pressure and enables SOAR platforms to automate those same steps consistently.
Source: CompTIA SY0-701 Objectives 4.7–4.8 (playbooks within automation and incident response)Report a problem with this question
19. Which capability BEST describes an endpoint detection and response (EDR) solution?
- A.Scanning source code for vulnerabilities before deployment
- B.Blocking spam and phishing messages at the mail gateway
- C.Continuously monitoring endpoint behavior to detect threats and enabling responses such as isolating the host✓ Answer
- D.Filtering web traffic by URL category at the network perimeter
EDR goes beyond signature-based antivirus by recording and analyzing endpoint process, file, and network behavior to spot suspicious activity, and it gives responders remote actions like host isolation and process termination.
Source: CompTIA SY0-701 Objective 4.5 (endpoint detection and response)Report a problem with this question
20. How does XDR differ from traditional EDR?
- A.XDR is an on-premises appliance, while EDR is always cloud-based
- B.XDR only works on servers, while EDR only works on laptops
- C.XDR correlates telemetry across endpoints, network, email, and cloud, not just endpoint data✓ Answer
- D.XDR replaces the need for any human analysts
The "extended" in XDR means detection and response are built on telemetry from multiple security layers, allowing the platform to correlate, for example, a phishing email with a subsequent endpoint infection and lateral network movement that EDR alone would see only partially.
Source: CompTIA SY0-701 Objective 4.5 (extended detection and response)Report a problem with this question
21. Which statement BEST characterizes threat hunting?
- A.Purchasing threat intelligence feeds and forwarding them to the firewall
- B.Scanning systems monthly for missing patches
- C.Waiting for the SIEM to generate an alert before investigating
- D.Proactively searching for threats that evaded existing controls, based on a hypothesis of attacker behavior✓ Answer
Threat hunting assumes compromise may already have occurred: analysts form a hypothesis (often from threat intelligence or TTP frameworks) and actively query telemetry to find intrusions that automated, alert-driven detection missed.
Source: CompTIA SY0-701 Objective 4.8 (threat hunting)Report a problem with this question
22. An analyst needs to confirm whether an internal workstation established outbound connections to a known-malicious external IP address. Which log source would BEST show this?
- A.Firewall logs showing source, destination, port, and allow/deny decisions✓ Answer
- B.Windows account lockout events
- C.Application crash logs from the workstation
- D.DHCP lease assignment logs
Firewall logs record each connection attempt crossing the network boundary with source and destination IPs, ports, and whether it was permitted, which is exactly the evidence needed to tie an internal host to traffic toward a specific external address.
Source: CompTIA SY0-701 Objective 4.9 (log data sources: firewall logs)Report a problem with this question
23. A SIEM receives logs from firewalls, Linux servers, and Windows domain controllers, each in a different format. Which SIEM function converts these into a consistent structure so events can be compared?
- A.Alert tuning
- B.Archiving
- C.Retention
- D.Normalization✓ Answer
Normalization parses heterogeneous log entries and maps their fields (timestamp, source IP, username, action) into a common schema; correlation rules can only match events across different products after this common structure exists.
Source: CompTIA SY0-701 Objective 4.4 (security alerting and monitoring: SIEM)Report a problem with this question
24. Why is bcrypt recommended for storing passwords instead of a fast hash such as MD5 or SHA-256?
- A.bcrypt produces a shorter hash that saves database space
- B.bcrypt uses key stretching with a configurable work factor, making each guess computationally expensive for attackers✓ Answer
- C.bcrypt allows the original password to be decrypted by administrators when needed
- D.bcrypt eliminates the need for users to choose strong passwords
Fast hashes let attackers test billions of guesses per second against stolen hashes; bcrypt deliberately repeats its internal work thousands of times (the cost factor), slowing each guess by orders of magnitude while remaining tolerable for a single legitimate login.
Source: CompTIA SY0-701 Objective 1.4 (key stretching); NIST SP 800-63B Section 5.1.1.2 (memorized secret storage)Report a problem with this question
25. What attack does adding a unique random salt to each password hash primarily defeat?
- A.Precomputed rainbow table attacks against stolen hashes✓ Answer
- B.SQL injection against the login form
- C.Phishing emails that harvest credentials
- D.Keylogging on the user's device
Rainbow tables work because the same password always produces the same hash; a unique salt changes each hash input, so a precomputed table becomes useless and identical passwords no longer produce identical stored hashes.
Source: CompTIA SY0-701 Objective 1.4 (salting); NIST SP 800-63B Section 5.1.1.2Report a problem with this question
26. Authentication logs show the password "Summer2024!" was attempted once against hundreds of different user accounts over several hours. What attack does this indicate?
- A.Dictionary attack against a single account
- B.Pass-the-hash attack
- C.Rainbow table attack
- D.Password spraying✓ Answer
Password spraying inverts brute force: instead of many passwords against one account, it tries one common password across many accounts, staying under per-account lockout thresholds while still likely hitting someone who chose that weak password.
Source: CompTIA SY0-701 Objective 2.4 (password attacks: spraying)Report a problem with this question
27. Attackers take username/password pairs leaked in a breach of an unrelated website and replay them against a company's login portal. What is this attack called?
- A.Credential stuffing✓ Answer
- B.Downgrade attack
- C.On-path (man-in-the-middle) attack
- D.Birthday attack
Credential stuffing exploits password reuse: because many users repeat the same credentials across sites, automated replay of one site's breach data succeeds elsewhere, which is why unique passwords and MFA are the standard mitigations.
Source: CompTIA SY0-701 Objective 2.4 (password attacks); OWASP Credential Stuffing definitionReport a problem with this question
28. An attacker exfiltrates a database of password hashes and cracks them on their own GPU rig without ever touching the victim's login system again. Which control would NOT have slowed this cracking phase?
- A.Account lockout after five failed login attempts✓ Answer
- B.Requiring long passphrases that increase guessing space
- C.Adding a unique salt to every password hash
- D.Hashing passwords with bcrypt and a high work factor
Account lockout is an online control enforced by the authentication service, but in an offline attack the guessing happens entirely on the attacker's own hardware where no lockout applies; only slow hashing, salting, and larger guessing spaces raise the offline cracking cost.
Source: CompTIA SY0-701 Objective 2.4 (brute force, offline vs. online password attacks)Report a problem with this question
29. Which privileged access management (PAM) feature grants an administrator elevated rights only for the duration of an approved task, removing them automatically afterward?
- A.Federation with an external IdP
- B.Single sign-on
- C.Password complexity policies
- D.Just-in-time permissions✓ Answer
Just-in-time permissions eliminate standing privilege: administrative rights are granted on request for a limited window and revoked automatically, so a compromised admin account carries elevated power only during those brief approved intervals.
Source: CompTIA SY0-701 Objective 4.6 (privileged access management tools: just-in-time permissions)Report a problem with this question
30. An employee has changed departments three times and can still access systems from every previous role. Which practice is designed to detect and correct this condition?
- A.Penetration testing of external web applications
- B.Increasing the SIEM log retention period
- C.Periodic user access reviews (account audits) with recertification by managers✓ Answer
- D.Deploying a web application firewall
The condition described is privilege creep, and periodic access reviews counter it by forcing data or system owners to re-approve each permission a user holds; anything no longer justified by the current role is revoked during the audit.
Source: CompTIA SY0-701 Objective 4.6 (identity and access management: permission assignments and access reviews)Report a problem with this question
31. A quarterly audit finds several enabled accounts belonging to employees who left the company months ago. Why do these dormant accounts pose a heightened security risk?
- A.They consume software licenses that increase costs
- B.Attackers can use them without a legitimate owner noticing unusual activity✓ Answer
- C.They force other users to change passwords more often
- D.They slow down the domain controller's replication
Because nobody legitimately logs into a dormant account, a takeover generates no complaints and no conflicting sessions, letting attackers operate quietly; timely deprovisioning during offboarding is the control that removes this attack surface.
Source: CompTIA SY0-701 Objective 4.6 (provisioning/de-provisioning user accounts)Report a problem with this question
32. In a SAML-based single sign-on flow, which component issues the signed assertion that vouches for the user's identity?
- A.The service provider (SP)
- B.The certificate authority (CA)
- C.The identity provider (IdP)✓ Answer
- D.The user's browser
In SAML the IdP authenticates the user and then generates a digitally signed XML assertion; the service provider never sees the user's credentials and simply trusts the assertion because it verifies the IdP's signature.
Source: OASIS SAML 2.0 Core specification (assertions issued by the identity provider); CompTIA SY0-701 Objective 4.6 (SSO: SAML)Report a problem with this question
33. A mobile app wants to read a user's cloud calendar without ever learning the user's password. Which framework was designed for exactly this delegated access?
- A.LDAP
- B.TACACS+
- C.RADIUS
- D.OAuth 2.0✓ Answer
OAuth 2.0 is an authorization framework: the user approves a scoped grant at the provider, and the app receives an access token limited to those permissions, so the password is never shared and access can be revoked without changing it.
Source: RFC 6749 (The OAuth 2.0 Authorization Framework); CompTIA SY0-701 Objective 4.6 (federation and SSO: OAuth)Report a problem with this question
34. What does OpenID Connect (OIDC) add on top of OAuth 2.0?
- A.A replacement for TLS encryption on the wire
- B.An authentication layer that issues a signed ID token proving who the user is✓ Answer
- C.A hardware token standard for MFA
- D.A protocol for synchronizing passwords between directories
OAuth 2.0 by itself only authorizes access to resources and says nothing about who the user is; OIDC adds a standardized identity layer whose signed ID token (a JWT) lets the relying application verify the user's authenticated identity.
Source: OpenID Connect Core 1.0 specification (ID Token); CompTIA SY0-701 Objective 4.6 (SSO: Open ID Connect)Report a problem with this question
35. Two partner companies want employees of each firm to access the other's collaboration portal using their existing home-company credentials. Which IAM approach enables this?
- A.Creating duplicate local accounts for every partner employee
- B.Sharing a single service account between both companies
- C.Requiring partners to connect through a jump server with shared passwords
- D.Federation, where each company's IdP is trusted by the partner's service✓ Answer
Federation establishes a trust relationship between identity providers and services across organizational boundaries, so each user authenticates once with their own IdP and receives access at the partner via assertions, avoiding duplicated accounts and shared credentials.
Source: CompTIA SY0-701 Objective 4.6 (identity and access management: federation)Report a problem with this question
36. After a domain controller's clock drifts 20 minutes, users across the network suddenly cannot authenticate. Why does Kerberos fail in this situation?
- A.Kerberos rejects tickets whose timestamps fall outside the allowed clock skew, a defense against replay attacks✓ Answer
- B.Kerberos requires a new certificate whenever the time changes
- C.Kerberos tickets are only valid during business hours
- D.Clock drift corrupts the password hashes stored in the directory
Kerberos embeds timestamps in authenticators and tickets specifically so that captured messages cannot be replayed later; when clocks differ by more than the permitted skew, legitimate tickets look like replays and the KDC rejects them, which is why time synchronization is an operational requirement.
Source: RFC 4120, Section 3.3 (Kerberos V5: clock skew and replay protection); CompTIA SY0-701 Objective 4.6 (authentication protocols)Report a problem with this question
37. During smart-card (certificate-based) authentication, how does the server confirm the user is genuine?
- A.The card sends its serial number, which the server looks up in a list
- B.The client signs a challenge with the private key on the card, and the server verifies it using the public key in the trusted certificate✓ Answer
- C.The server compares a photo stored on the card with the user's badge
- D.The card transmits the user's password in encrypted form
Certificate-based authentication is a proof-of-possession scheme: only the holder of the private key can produce a valid signature over the server's fresh challenge, and the certificate binds the matching public key to the user's identity through a trusted CA, so no reusable secret ever crosses the network.
Source: CompTIA SY0-701 Objective 4.6 (multifactor authentication: security keys/smart cards); X.509 challenge-response authentication modelReport a problem with this question
38. Which security control could automatically block an outgoing email because it contains a spreadsheet full of customer Social Security numbers?
- A.Vulnerability scanner
- B.Full-disk encryption
- C.Network intrusion detection system (NIDS)
- D.Data loss prevention (DLP)✓ Answer
DLP inspects content in motion, in use, and at rest against patterns and labels for sensitive data (such as SSN formats), and it can enforce policy by blocking, quarantining, or encrypting the transmission; a NIDS only alerts on attack signatures and disk encryption protects data at rest, not outbound email.
Source: CompTIA SY0-701 Objective 4.5 (enterprise security capabilities: DLP)Report a problem with this question
39. What is the primary purpose of assigning classification labels such as "public," "internal," and "confidential" to company data?
- A.To determine the handling requirements and security controls proportional to each dataset's sensitivity✓ Answer
- B.To reduce the total volume of stored data
- C.To satisfy software licensing agreements
- D.To make files easier to find in search results
Classification exists to tie protection to value: once data carries a sensitivity label, policies can mandate the right encryption, access restrictions, retention, and DLP rules for that level, instead of over-protecting trivial data or under-protecting critical data.
Source: CompTIA SY0-701 Objective 3.3 (data classifications: sensitive, confidential, public, restricted)Report a problem with this question
40. Before deploying a firewall rule change, a change management board requires a documented backout plan. What is the purpose of the backout plan?
- A.To estimate the financial cost of the change
- B.To assign blame if the change causes an outage
- C.To schedule the change during business hours for visibility
- D.To define a tested procedure for restoring the previous working state if the change fails or causes problems✓ Answer
Change management reduces the risk that modifications cause unplanned outages, and the backout plan is the safety net: by documenting in advance exactly how to revert to the known-good configuration, the team can recover quickly within the maintenance window instead of improvising during an incident.
Source: CompTIA SY0-701 Objective 1.3 (change management processes: backout plan)Report a problem with this question
Practice questions based on the CompTIA Security+ SY0-701 exam objectives. This is an independent study tool, not affiliated with or endorsed by CompTIA, and does not grant certification. About Security+ →