These 10 free practice questions for the CompTIA Security+ (SY0-701) exam test your application of Domain 1, "General Security Concepts." They focus on scenario-based judgment involving risk formulas, control types, threat intelligence, and cryptographic principles, mirroring the format of the official exam where simple memorization is not enough to pass.
Key facts
- Exam Domain: 1.0 General Security Concepts
- Exam Code: SY0-701
- Domain Weighting: 12% of the total exam
- Key Topics: Risk management, threat intelligence sources, security control types, cryptographic concepts
- Passing Score: 750 on a scale of 100-900
- Official Body: CompTIA
CompTIA's official SY0-701 exam objectives state that the General Security Concepts domain accounts for 12% of your score, making it a foundational area you must master.
How Do You Apply General Security Concepts? (10 Practice Questions)
These 10 questions simulate the real SY0-701 exam experience for Domain 1. They are not vocabulary checks. They are designed to test your ability to analyze a scenario, compare options, and make a judgment call, just as you would on the job.
For each question, choose your answer and write down a single sentence explaining why you chose it. This forces you to articulate your reasoning, which is the skill the exam actually measures. For a larger, adaptive set of questions, you can try VoraPrep's complete Security+ course with a free trial.
Studying for CompTIA Security+ SEC1? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
Question 1
A retail company processes approximately 10,000 credit card transactions per month. A recent threat assessment identified a specific malware variant that could compromise their point-of-sale (POS) system. The security team estimates that a successful breach would cost the company $50,000 in fines, remediation, and reputational damage. Based on data from similar companies, they believe such an attack is likely to occur once every two years.
What is the Annualized Loss Expectancy (ALE) for this specific threat?
A) $25,000 B) $50,000 C) $100,000 D) $1,000,000
Answer & Explanation The correct answer is A) $25,000.This is a classic quantitative risk analysis problem. The exam expects you to have the formulas for Single Loss Expectancy (SLE) and Annualized Loss Expectancy (ALE) memorized and know how to apply them.
- Single Loss Expectancy (SLE): This is the total monetary loss for a single incident. The question gives this to you directly: $50,000.
- Annualized Rate of Occurrence (ARO): This is how many times the incident is expected to happen in one year. The question states it occurs "once every two years," so the ARO is 0.5.
- Annualized Loss Expectancy (ALE): This is the total expected loss for a year. The formula is ALE = SLE x ARO.
Plugging in the numbers: ALE = $50,000 x 0.5 = $25,000.
Why the wrong answers are tempting:- B) $50,000: This is the SLE, not the ALE. Candidates who forget to factor in the ARO will pick this.
- C) $100,000: This is what you get if you incorrectly multiply the SLE by 2 instead of 0.5.
- D) $1,000,000: This is a distractor calculated from irrelevant numbers in the problem (e.g., mixing up transactions with dollars).
- Identify the Single Loss Expectancy (SLE). This is the cost of one event. The problem states: "...a successful breach would cost the company $50,000". So, SLE = $50,000.
- Identify the Annualized Rate of Occurrence (ARO). This is the frequency of the event per year. The problem states: "...likely to occur once every two years". To get the annual rate, you calculate 1 incident / 2 years = 0.5 incidents per year.
- Calculate the Annualized Loss Expectancy (ALE). Use the formula: ALE = SLE × ARO.
ALE = $50,000 × 0.5 ALE = $25,000
This $25,000 figure is what a manager would use to justify spending on a security control. If a new firewall solution costs $10,000 per year, it's an easy decision because it's less than the expected annual loss.
Question 2
A security administrator is hardening a new web server. They install and configure a host-based firewall, enable SELinux, and disable all unnecessary services. According to the security control functions, what have they primarily implemented?
A) Detective controls B) Corrective controls C) Preventive controls D) Compensating controls
Answer & Explanation The correct answer is C) Preventive controls.The key is to understand the goal of the actions taken. A firewall, SELinux (a security module), and disabling services are all designed to stop an incident from happening in the first place. This is the definition of a preventive control.
Why the wrong answers are tempting:- A) Detective controls: These controls identify that an incident is happening or has already happened. An Intrusion Detection System (IDS), log monitoring, or file integrity checkers are examples. The actions in the question are proactive, not reactive.
- B) Corrective controls: These controls are used after an incident to limit the damage or restore systems. Examples include restoring from backup or activating a disaster recovery site.
- D) Compensating controls: These are alternative controls used when a primary control is not feasible. For example, if you can't implement complex password policies on a legacy system, you might add extra monitoring as a compensating control. The actions here are all primary, standard hardening techniques.
Question 3
A financial services firm wants to obtain timely, relevant, and actionable information about new malware campaigns specifically targeting their industry from a particular Advanced Persistent Threat (APT) group. Which of the following would be the MOST appropriate source for this type of threat intelligence?
A) A public vulnerability feed like CVE (Common Vulnerabilities and Exposures) B) An academic research paper on cryptographic weaknesses C) An Information Sharing and Analysis Center (ISAC) D) A vendor-specific security advisory
Answer & Explanation The correct answer is C) An Information Sharing and Analysis Center (ISAC).ISACs are industry-specific organizations created to share threat intelligence among members. The Financial Services ISAC (FS-ISAC) is a prime example. They provide highly relevant, curated, and often real-time information about threats, threat actors (like APTs), and campaigns targeting that specific sector.
Why the wrong answers are tempting:- A) CVE: This is a critical resource, but it's a list of vulnerabilities, not a source of intelligence about active campaigns or threat actors targeting a specific industry. It's too broad.
- B) Academic papers: While valuable, these are typically not timely or directly actionable for defending against an immediate campaign. They focus on theoretical or long-term issues.
- D) Vendor advisories: This is useful if you use that vendor's products, but it won't give you a comprehensive view of all threats targeting your industry, only those affecting that vendor. An ISAC aggregates intelligence from many sources.
Question 4
To protect data in transit, a company's security policy mandates the use of strong, widely-supported encryption. A security architect needs to choose a protocol to secure web traffic. Which of the following is an asymmetric cryptographic algorithm commonly used for digital signatures within the initial TLS handshake?
A) AES B) DES C) RSA D) SHA
Answer & Explanation The correct answer is C) RSA.This question tests precision. RSA is an asymmetric algorithm (using a public/private key pair), not a protocol. During a TLS handshake (which secures web traffic), RSA is commonly used to digitally sign the server's certificate, proving its identity to the client.
Why? To achieve Perfect Forward Secrecy (PFS). With ECDHE, a unique, temporary session key is generated for every session and then discarded. If an attacker later steals the server's long-term private key, they still can't decrypt past recorded traffic. This is a critical concept for the SY0-701 exam.
- A) AES (Advanced Encryption Standard): This is the most common symmetric algorithm used for encrypting the bulk data after the secure channel is established. It's fast and efficient, but it's not asymmetric.
- B) DES (Data Encryption Standard): This is an old, insecure symmetric algorithm. It should never be chosen for modern applications.
- D) SHA (Secure Hash Algorithm): This is a hashing function used for integrity (to create a message digest for digital signatures), not an encryption algorithm used for confidentiality.
Question 5
A company wants to implement a policy to reduce the risk of employees clicking on malicious links in emails. The policy requires all suspicious emails to be reported and automatically quarantines emails with known malicious attachments. Which type of security control does this policy represent?
A) Technical B) Physical C) Administrative D) Corrective
Answer & Explanation The correct answer is C) Administrative.This question tests your understanding of control types. A policy is a classic example of an administrative control. Administrative controls are the "human" element of security: policies, procedures, training, and guidelines that direct user behavior. The technical implementation (the quarantine system) is a technical control, but the policy itself is administrative.
| Control Type | Description | Example from the question |
|---|---|---|
| Administrative | Policies, procedures, and training for people. | The policy requiring users to report suspicious emails. |
| Technical | Controls implemented in software or hardware. | The system that automatically quarantines attachments. |
| Physical | Controls you can physically touch. | Locks, fences, security guards, fire suppression. |
- A) Technical: This is the most common wrong answer. Candidates focus on the "automatic quarantine" part, which is a technical control. However, the question asks about the policy, which is the guiding administrative document.
- B) Physical: This is incorrect as there are no physical barriers involved.
- D) Corrective: This describes a control's function, not its type. While quarantining could be seen as corrective or preventive, the question asks for the control type (Admin, Technical, Physical). Don't mix up types and functions.
Question 6
During a risk assessment guided by the NIST Risk Management Framework (RMF), an analyst identifies a legacy server that cannot be patched. The vulnerability is critical, but the application is essential for business operations. The team places the server on an isolated network segment, protected by a firewall that only allows traffic from a single management workstation. This is an example of:
A) Risk acceptance B) Risk transference C) Risk avoidance D) Risk mitigation
Answer & Explanation The correct answer is D) Risk mitigation.Mitigation means reducing the impact or likelihood of a risk. By isolating the server and restricting access with a firewall, the team has not eliminated the vulnerability, but they have made it much harder to exploit. They have reduced the risk to an acceptable level. This is the essence of mitigation.
Why the wrong answers are tempting:- A) Risk acceptance: This would mean doing nothing and formally documenting the decision to accept the risk. The team took active steps, so this is incorrect.
- B) Risk transference: This involves shifting the financial impact of the risk to a third party, for example, by buying a cybersecurity insurance policy. That is not what happened here.
- C) Risk avoidance: This would mean eliminating the risk entirely, for instance, by decommissioning the legacy server. Since the server is business-essential, this was not an option.
Question 7
A security operations center (SOC) analyst is reviewing network traffic and sees a large number of connection attempts from a known malicious IP address listed on a popular open-source threat feed. This IP address is associated with a botnet command-and-control (C2) server. This information is best classified as an:
A) Indicator of Compromise (IoC) B) Tactic, Technique, and Procedure (TTP) C) Vulnerability D) Zero-day exploit
Answer & Explanation The correct answer is A) Indicator of Compromise (IoC).An IoC is a piece of forensic data or evidence that points to a potential intrusion. A malicious IP address, a suspicious domain name, a file hash of known malware, or unusual outbound network traffic are all examples of IoCs. They are the "bread crumbs" that suggest a system has been compromised.
Why the wrong answers are tempting:- B) TTP: This describes the behavior of an attacker. For example, using a specific type of spear-phishing email to gain initial access is a TTP. The IP address is the artifact (the IoC), not the behavior itself.
- C) Vulnerability: A vulnerability is a weakness in a system that could be exploited. The IP address is evidence of a potential attack, not the weakness itself.
- D) Zero-day exploit: This is an attack that exploits a previously unknown vulnerability. The information given doesn't support this conclusion.
Question 8
Which of the following ensures that a sender of a message cannot later deny having sent the message?
Calculate Your CompTIA Security+ Score & Study Hours by Domain
Adjust your practice scores across official CompTIA Security+ blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
A) Confidentiality B) Integrity C) Availability D) Non-repudiation
Answer & Explanation The correct answer is D) Non-repudiation.This is a core security concept definition. Non-repudiation is the assurance that someone cannot deny the validity of something. In cryptography, it's typically achieved using digital signatures, which link a specific user (via their private key) to a specific piece of data.
Why the wrong answers are tempting: These are the other pillars of the "CIA Triad" (plus Availability), and candidates who haven't memorized the specific definition of non-repudiation might get confused.- A) Confidentiality: Ensures that data is not disclosed to unauthorized individuals. This is about secrecy (achieved with encryption).
- B) Integrity: Ensures that data has not been altered or tampered with. This is about trustworthiness (achieved with hashing).
- C) Availability: Ensures that systems and data are accessible when needed.
Question 9
A developer is writing code for an application that will handle sensitive user data. The security policy requires that all stored passwords be hashed with a salt. What is the primary security goal of hashing the passwords?
A) To ensure the availability of the passwords for authentication. B) To ensure the confidentiality of the passwords if the database is breached. C) To provide non-repudiation for user logins. D) To reduce the storage space required for passwords.
Answer & Explanation The correct answer is B) To ensure the confidentiality of the passwords if the database is breached.Hashing is a one-way function. You can't reverse a hash to get the original password. If an attacker steals a database of hashed passwords, they don't have the actual passwords. They would have to try to crack each hash individually, which is computationally expensive. Using a salt (a random value added to each password before hashing) prevents attackers from using pre-computed "rainbow tables" to crack common passwords instantly. Modern systems use slow, password-specific hashing functions like bcrypt or PBKDF2 to make this cracking process even more difficult.
Why the wrong answers are tempting:- A) Availability: Hashing has no direct impact on the availability of the authentication system.
- C) Non-repudiation: This is related to digital signatures and proving identity, not protecting stored secrets.
- D) Storage space: While a hash might be a fixed length, the primary reason for using it is security, not storage optimization.
Question 10
A company's acceptable use policy (AUP) explicitly forbids employees from using corporate assets for personal financial gain. This is an example of what kind of security control?
A) Physical control B) Technical control C) Administrative control D) Compensating control
Answer & Explanation The correct answer is C) Administrative control.Just like in Question 5, this is about identifying the control type. An Acceptable Use Policy (AUP) is a document that defines the rules and constraints users must agree to. Policies, standards, and procedures are always classified as administrative controls because they govern human behavior and organisational processes.
Why the wrong answers are tempting:- B) Technical control: A web filter that blocks access to stock trading websites would be the technical enforcement of this policy, but the policy itself is administrative.
- A) Physical control: This is incorrect as no physical barrier is involved.
- D) Compensating control: This is an alternative control, which doesn't apply here. The AUP is a primary, fundamental control.
How Did You Score?
Count your correct answers. Domain 1 is not a warm-up; it's a filter. Weakness here guarantees you will struggle with scenario questions in later domains.
- 8-10 Correct: You have a strong command of the foundational concepts. You can apply formulas and differentiate between nuanced terms. Your next step is to use a large, adaptive practice bank to expose yourself to a wide variety of scenarios and solidify this knowledge.
- 5-7 Correct: You have critical gaps. You are likely confusing control types with functions, misinterpreting the roles of cryptographic algorithms, or misapplying risk management responses. This is a major warning sign. Your priority is to revisit your study materials, focusing specifically on the purpose and context of each concept you missed.
- 0-4 Correct: You have significant foundational weaknesses. Do not move on to other domains. Your immediate task is to master the definitions and use cases for risk responses, control types, and core cryptographic functions. Simple re-reading is not enough; you need active practice that forces you to apply these concepts correctly.
Your next step isn't just to "study more." It's to study smarter. Analyze why you got each question wrong. Was it a misread? A confused term? A forgotten formula? This analysis is where real learning happens. To see how different platforms can help you diagnose these weaknesses, compare the top-rated Security+ study platforms.
Get More CompTIA Security+ Practice on VoraPrep
A handful of free questions isn't enough to build the judgment required to pass the SY0-701. You need to drill these concepts until the correct application becomes second nature.
This is where the VoraPrep course stands apart from overpriced, passive video lectures. Our adaptive practice bank contains over 1,500 exam-calibrated questions covering every SY0-701 objective. The system learns your weak spots. If you're struggling with risk management, it will serve you more questions on ALE, risk mitigation, and control types until you achieve mastery.
Each question comes with a detailed rationale that doesn't just tell you the right answer. It teaches you to think like an examiner by explaining:
- The underlying concept being tested.
- Why the correct answer is the best choice for the given scenario.
- The specific reason why each of the incorrect "distractor" answers is wrong.
And if you're still stuck, you can ask Vory, your 24/7 personal tutor, for a step-by-step explanation right inside the question. VoraPrep is a complete 6-pillar interactive course that includes textbook-grade lessons, FSRS flashcards, 1:1 exam simulators, and a personalized study plan to guide you every day. Visit the official VoraPrep page to see a full breakdown of the course.