A candidate faced a classic risk scenario. A potential data breach had a Single Loss Expectancy (SLE) of $200,000 and an Annualized Rate of Occurrence (ARO) of 10%. They correctly calculated the Annualized Loss Expectancy (ALE) as $20,000. Then the trap: should they implement a new security control costing $25,000 per year? They chose "Yes," assuming more security is always better. That single choice, a failure of business judgment, cost them the exam.
These free SY0-701 practice questions for Domain 5 focus on business judgment, not just technical recall. They test your ability to apply risk management, compliance, and business continuity principles to cost-benefit scenarios, which is where many candidates lose critical points. Try more free CompTIA practice questions with VoraPrep.
Key facts
- Exam Code: SY0-701
- Domain 5 Weighting: 20% of the exam
- Exam Format: Maximum of 90 questions (includes multiple-choice and performance-based)
- Testing Time: 90 minutes (total time in the center is approx. 105 minutes)
- Passing Score: 750 (on a 100-900 scale)
- Official Body: CompTIA
The U.S. Bureau of Labor Statistics projects 32% growth for information security analyst jobs from 2022 to 2032, far outpacing the average occupation (BLS.gov).
What makes Domain 5 questions so difficult?
Domain 5 questions are tough because they require you to think like a manager, not just a technician. The exam moves beyond "what does this acronym stand for?" and into "which of these four valid options is the most prudent business decision?" You will be asked to weigh the cost of a security control against the risk it mitigates.
Studying for CompTIA Security+? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
This is where candidates who rely on pure memorization fail. You must apply concepts from frameworks like the NIST Risk Management Framework (RMF) to practical situations. You'll need to perform both quantitative risk analysis (calculating financial loss) and qualitative risk analysis (prioritizing risks based on a high/medium/low scale).
The questions below are designed to mimic this challenge. They present a scenario and force you to make a judgment call, just like on the real SY0-701 exam.
Security Program Management and Oversight Practice Questions
Work through each question carefully. Read the entire scenario and all the options before making a choice. Pay close attention to keywords that signal the examiner's intent, such as "first," "best," or "most likely."
Question 1
A retail company processes thousands of credit card transactions daily. A recent risk analysis determined that the asset value (AV) of its customer database is $2,500,000. The exposure factor (EF) of a potential data breach is estimated to be 30%. What is the Single Loss Expectancy (SLE) for this event?
Answer and Explanation: The correct answer is B) $750,000.This is a straightforward quantitative risk analysis calculation. You must know the formula.
Why the wrong answers are tempting:Why B is correct: The formula for Single Loss Expectancy (SLE) is: SLE = Asset Value (AV) × Exposure Factor (EF)
- A) $75,000: This is a common calculation error, likely off by a factor of ten. Under exam pressure, simple math mistakes are easy to make. Double-check your zeros.
- C) $2,500,000: This is the Asset Value (AV), not the SLE. The question is asking for the expected loss from a single event, which is a percentage of the total value, not the total value itself.
- D) $8,333,333: This result comes from incorrectly dividing the AV by the EF (2,500,000 ÷ 0.30). The formula is multiplication, not division.
Plugging in the numbers from the scenario: SLE = $2,500,000 × 0.30 = $750,000
This means the company can expect to lose $750,000 each time this specific data breach event occurs. This figure is critical for making decisions about which security controls to purchase.
Question 2
A cybersecurity analyst detects a ransomware infection that is actively encrypting files on a critical file server. According to the NIST incident response lifecycle (SP 800-61), what is the IMMEDIATE next step?
Answer and Explanation: The correct answer is B) Disconnect the server from the network.This question tests your knowledge of the correct sequence in the NIST incident response lifecycle: Preparation, Detection & Analysis, Containment, Eradication, Recovery, and Post-Incident Activity.
Why the wrong answers are tempting:Why B is correct: The phase immediately following Detection & Analysis is Containment. The primary goal of containment is to stop the incident from causing further damage. Disconnecting the infected server from the network is the fastest and most effective way to contain the threat and prevent the ransomware from spreading laterally across the network to other servers or workstations.
- A) Eradicate the malware: Eradication is a crucial step, but it comes after containment. Trying to remove the malware while the server is still connected to the network risks the ransomware spreading to other systems.
- C) Begin recovery from backups: Recovery also comes later in the process. Attempting to restore files while the system is still compromised and connected could lead to the backups themselves becoming encrypted.
- D) Conduct a post-incident meeting: This is the final step in the lifecycle (Post-Incident Activity). It is performed long after the immediate threat has been neutralized.
Question 3
A financial services firm is developing a business continuity plan. The plan states that in the event of a catastrophic failure of the primary data center, the Tier 1 trading application must be operational at a secondary site within 30 minutes. This 30-minute requirement defines the:
Answer and Explanation: The correct answer is C) Recovery Time Objective (RTO).The key to this question is understanding the difference between time-based and data-based recovery metrics.
Why the wrong answers are tempting:Why C is correct: The Recovery Time Objective (RTO) is a business metric that defines the maximum tolerable downtime for a critical business process or system. The scenario explicitly states the application "must be operational... within 30 minutes." This is a direct definition of the RTO.
- A) Recovery Point Objective (RPO): This is the most common distractor. RPO defines the maximum acceptable amount of data loss, measured in time (e.g., "we can afford to lose up to 15 minutes of transaction data"). The question specifies a time to restore service, not a quantity of data loss.
- B) Mean Time To Repair (MTTR): MTTR is the average time it takes to repair a failed component. While related, RTO is a business-defined target for the entire service restoration, not just the technical repair time of a single device.
- D) Mean Time Between Failures (MTBF): MTBF is a reliability metric that predicts the average time a component will operate before it fails. It's used for planning and purchasing, not for defining disaster recovery timelines.
| Metric | Focus | Question It Answers | Example |
|---|---|---|---|
| RTO | Time / Service | "How quickly must we be back online?" | The website must be live within 2 hours of an outage. |
| RPO | Data / Loss | "How much data can we afford to lose?" | We must not lose more than 5 minutes of customer orders. |
| MTTR | Repair / Component | "How long does it take to fix a broken part?" | It takes, on average, 45 minutes to replace a failed power supply. |
| MTBF | Reliability / Uptime | "How long will this device run before it fails?" | These hard drives have an MTBF of 1.2 million hours. |
Question 4
An organization wants to implement a new security awareness training program. Which of the following is the MOST effective way to measure the program's success in changing user behavior?
Answer and Explanation: The correct answer is C) Conduct periodic, unannounced phishing simulations.This question is about measuring effectiveness, not just completion. The goal of security awareness training is to change behavior, not just to check a compliance box.
Why the wrong answers are tempting:Why C is correct: Phishing simulations directly test the behavior the training is meant to improve: identifying and reporting suspicious emails. By measuring the click rate and report rate of simulated phishing campaigns before and after the training, the organization can gather concrete data on whether user behavior has actually changed. This is a direct, measurable, and actionable metric of the program's effectiveness.
- A) Track completion rates: This is a weak metric. It shows who attended the training but says nothing about whether they learned or changed their behavior. This is a classic "vanity metric."
- B) Survey employees: Employee satisfaction is good to know, but it does not correlate with security effectiveness. A training module could be entertaining but teach nothing of value.
- D) Monitor SIEM alerts: This is too indirect. A change in SIEM alerts could be caused by many factors (new threats, changes in logging, etc.), not just the training program. It lacks direct attribution.
Calculate Your CompTIA Security+ Score & Study Hours by Domain
Adjust your practice scores across official CompTIA Security+ blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
How do you calculate risk for the Security+ exam?
You must be able to perform a full quantitative risk assessment. The exam will give you a scenario and expect you to calculate the risk and make a cost-benefit decision about a proposed control.
Let's walk through a full quantitative risk assessment, just like you'll see on the exam.
A cloud hosting company identifies a risk that a specific software vulnerability could be exploited, leading to a major service outage.
- The Asset Value (AV) of the affected service platform is estimated at $5,000,000.
- If the exploit occurs, it's estimated that 20% of the platform's functionality and data would be impacted. This is the Exposure Factor (EF).
- Historical data suggests an exploit of this type is likely to occur once every four years.
The company is considering a new Web Application Firewall (WAF) that costs $30,000 per year to license and maintain. Should they purchase it?
Step 1: Calculate the Single Loss Expectancy (SLE)
The SLE is the monetary loss from a single occurrence of the risk.
- Formula: SLE = AV × EF
- Calculation: SLE = $5,000,000 × 0.20 = $1,000,000
Step 2: Calculate the Annualized Rate of Occurrence (ARO)
The ARO is how many times the event is expected to happen per year.
- Calculation: ARO = 1 occurrence ÷ 4 years = 0.25
Step 3: Calculate the Annualized Loss Expectancy (ALE)
The ALE is the total expected monetary loss for one year.
- Formula: ALE = SLE × ARO
- Calculation: ALE = $1,000,000 × 0.25 = $250,000
Step 4: Make a Business Decision
Now, compare the annual cost of the risk (ALE) to the annual cost of the control (the WAF).
- Annual Risk (ALE): $250,000
- Annual Control Cost: $30,000
Question 5
A new startup is formalizing its security policies. Management wants to create a document that outlines what employees are and are not allowed to do with company computers and network resources. This document should explicitly forbid activities like installing unauthorized software and accessing illegal content. Which type of policy should be created?
Answer and Explanation: The correct answer is B) Acceptable Use Policy (AUP).This question requires you to know the purpose of different governance documents.
Why the wrong answers are tempting:Why B is correct: An Acceptable Use Policy (AUP) is the specific document designed to define the rules and constraints that users must agree to in order to access a corporate network or the internet. While the AUP governs user behavior, a comprehensive governance program also includes a data classification policy (to define data sensitivity) and a password policy (to enforce authentication strength).
- A) Business Impact Analysis (BIA): A BIA is a process used to identify critical business functions and determine the impact of their disruption. It's a foundational document for business continuity, not a set of rules for employees.
- C) Service Level Agreement (SLA): An SLA is a contract between a service provider and a customer that defines the level of service expected. It deals with metrics like uptime and response times, not employee behavior.
- D) Disaster Recovery Plan (DRP): A DRP is a technical document that outlines the procedures to recover IT infrastructure after a disaster. It is a component of the overall Business Continuity Plan.
Question 6
During a vendor due diligence process, a security manager is reviewing the SOC 2 report for a potential cloud storage provider. Which section of the report would provide the auditor's opinion on the effectiveness of the vendor's controls?
Answer and Explanation: The correct answer is B) Independent Service Auditor's Report.This is a knowledge-based question that requires familiarity with common compliance reports used in third-party risk management.
Why the wrong answers are tempting:Why B is correct: Section 2, the Independent Service Auditor's Report, is the most critical part of the SOC report. It contains the auditor's formal, independent opinion on whether the vendor's controls were suitably designed (Type 1) and operating effectively (Type 2) over a period of time. This is the "verdict" of the audit.
- A) Management's Assertion: This section is where the vendor's management claims that their controls are designed and operating effectively. It's their side of the story, not the independent auditor's conclusion.
- C) System Description: This section provides a detailed narrative of the system, services, and control environment. It describes what is being audited but does not contain the audit opinion.
- D) Tests of Controls and Results: This section contains the details of the specific tests the auditor performed and the outcomes of those tests. While it provides the evidence, the formal opinion is stated in Section 2.
How should I interpret my score?
Count up your correct answers. This small sample is a valuable diagnostic for your readiness on Domain 5.
- 5-6 Correct: You have a strong command of the core concepts. You can apply risk formulas and correctly sequence incident response. Your next step is to master complex scenarios with VoraPrep's adaptive question bank, which includes challenging performance-based questions.
- 3-4 Correct: You know the definitions but struggle to apply them when faced with tricky distractors. This is a common weak point. You might know what AUP stands for but mix up RTO and RPO. Your focus should be on deliberate practice. For every question you get wrong, write down why the right answer is the better business decision.
- 0-2 Correct: You have significant foundational gaps. Simply doing more practice questions at this stage will be frustrating. Go back to the source material. Use a structured study guide to review the fundamentals of risk management, the purpose of key policies, and the phases of business continuity planning.
No matter your score, the path forward is targeted practice. If you missed the calculation question, drill risk formulas. If you missed the policy question, use flashcards for the main governance documents.
Go Beyond Sample Questions with VoraPrep
A handful of questions is a good diagnostic, but it is not enough to prepare for a 90-minute, high-stakes exam. Passing the Security+ requires a systematic approach that builds both knowledge and judgment.
VoraPrep offers a complete, 6-pillar interactive course built for how busy professionals learn. For a simple monthly subscription, you get everything you need:
- Textbook-Grade Lessons: Clear, concise study guides breaking down every objective on the SY0-701 blueprint.
- Adaptive Practice Bank: Over 1,500 questions that adapt to your performance, forcing you to spend more time on your weak areas.
- 1:1 Exam Simulators: Full-length, timed mock exams that perfectly replicate the Pearson VUE testing experience.
- FSRS Spaced-Repetition Flashcards: An intelligent flashcard system that schedules reviews based on memory science.
- Personalized Study Plan: A dynamic calendar that tells you exactly what to study each day to be ready by your exam date.
- Vory, Your 24/7 Personal Tutor: Stuck on a concept? Ask Vory inside any lesson or question for a step-by-step explanation.
Don't just memorize facts. Learn to think like a security professional and pass your exam with confidence. You can explore the complete VoraPrep Security+ course and see how it aligns with the SY0-701 blueprint.