25 complimentary Security+ (SY0-601) practice test questions

These 25 original practice questions use security topics associated with the retired CompTIA Security+ SY0-601 generation. They are an educational historical study set, not actual exam items, and they do not represent a currently bookable SY0-601 exam. For current preparation, use the CompTIA Security+ SY0-701 objectives as the relevant 2026 reference, and confirm the version and booking policies directly with CompTIA before purchasing training or scheduling a test. Choose the single best answer for each scenario before reading the explanation. Some scenarios resemble real workplace decisions because certification knowledge should transfer into defensible action, not merely memorized terminology.

25 Original SY0-601 Practice Questions

Question 1. A user receives a login alert from a service they do not use. What is the safest first response?

• A: Reply to the alert asking for details
• B: Open the service from a known bookmark and check the account
• C: Follow the alert link and reset the password
• D: Forward the alert to colleagues for votes

Correct Answer: B

Explanation: Accessing a known destination separates account verification from the untrusted message. If the account is real, the user can inspect sessions and notify security using an approved channel. Clicking an unexpected link or replying may expose credentials; colleagues are not a substitute for incident-reporting procedures.

Question 2. A server needs to verify the integrity of a downloaded configuration file. Which evidence is most direct?

• A: The file extension
• B: The download timestamp
• C: A cryptographic hash compared with a trusted publisher value
• D: The directory name

Correct Answer: C

Explanation: A cryptographic hash comparison detects differences between the received bytes and the published reference. It does not prove the publisher is trustworthy unless the reference itself comes from an authenticated channel. File names and timestamps can remain unchanged even when content is modified.

Question 3. An administrator must allow a contractor access only to one project folder for two weeks. Which design is strongest?

• A: A shared administrator account
• B: A permanent global read role
• C: An individual scoped account with an expiry
• D: A reusable team password

Correct Answer: C

Explanation: A named identity with minimum necessary permissions and an explicit expiration reduces both overexposure and uncertainty about attribution. The access should have a documented owner and a review path. Shared accounts weaken accountability; permanent access outlives the business need.

Question 4. A backup process reports success but restores have never been tested. What is the priority?

• A: Retain the success email
• B: Increase backup frequency without testing
• C: Test a restore in an isolated environment
• D: Delete the oldest records

Correct Answer: C

Explanation: A successful backup log proves only that a process ran, not that a usable system can be recovered. A controlled restoration checks recoverability, integrity, required keys and realistic recovery time. The test must not overwrite production data or expose protected information.

Question 5. A team sees many denied logins for one account followed by a successful unfamiliar session. What should they do?

• A: Immediately erase all logs
• B: Investigate account activity and contain if authorized
• C: Ignore it because the final login succeeded
• D: Block the entire corporate network

Correct Answer: B

Explanation: The pattern may suggest password spraying or credential compromise, but logs alone do not establish the cause. Preserve evidence, validate the user and session context, and use the incident process for proportional containment. Arbitrary network outages or evidence destruction make investigation harder.

Question 6. Which practice most directly reduces the impact of a stolen user password?

• A: Longer session timeouts
• B: Multifactor authentication with appropriate recovery controls
• C: Publishing the password policy
• D: Putting the password in a shared vault without access controls

Correct Answer: B

Explanation: A second independent factor can prevent a stolen password from being sufficient for login. The effectiveness depends on the factor type, phishing resistance, enrollment, and recovery path. It complements rather than replaces unique passwords and monitoring.

Question 7. An application accepts untrusted input as part of a database query. Which is the best first control?

• A: Parameterized queries
• B: Additional error messages
• C: More complex table names
• D: Client-side field hiding

Correct Answer: A

Explanation: Parameterization separates values from query structure, reducing injection risk. Proper authorization, error handling and least privilege remain necessary, but renaming objects or hiding form fields does not enforce the boundary between executable SQL and user-supplied data.

Question 8. A laptop is reported lost while it may contain customer information. Which response is best?

• A: Wait for the device to reappear
• B: Follow the incident process and assess encryption and access
• C: Delete the inventory record
• D: Ask the finder to email its contents

Correct Answer: B

Explanation: The organization needs a timely, auditable assessment of data exposure, device-management state, account sessions and legal notification obligations. Encryption and remote management can reduce impact, but those controls must be verified rather than assumed from a device policy.

Question 9. Which network device function is most directly associated with separating broadcast domains?

• A: A basic repeater
• B: VLAN-aware switching with appropriate routing boundaries
• C: A passive cable
• D: An unmanaged hub

Correct Answer: B

Explanation: VLAN-aware switching can create distinct Layer 2 broadcast domains. Inter-VLAN routing and access controls still determine what traffic crosses between them. A separate VLAN is not automatically a complete security boundary without appropriate router or firewall policy.

Question 10. A team wants to verify a digitally signed update. Which property matters most?

• A: The installer icon
• B: The application color
• C: The signature chain and authorized signer
• D: The download speed

Correct Answer: C

Explanation: Verifying the signature and signer’s trust chain helps establish integrity and publisher identity within the intended trust model. A valid signature is not an unconditional guarantee that the software is safe; reputation, provenance and deployment policy still matter.

Question 11. A workstation generates an alert showing a new scheduled task after suspicious activity. Which action is most defensible?

• A: Collect task details and related evidence
• B: Assume the alert is harmless
• C: Delete all event logs
• D: Ignore process ancestry

Correct Answer: A

Explanation: A scheduled task can be legitimate maintenance or a persistence mechanism. Record its creator, command, timing, process ancestry and context before drawing conclusions. Preserve necessary evidence and coordinate any remediation through the incident process.

Question 12. A company has one flat network for guest devices and payroll servers. What is the most direct architectural improvement?

• A: Give guests stronger hostnames
• B: Segment guest access from sensitive services with enforced policy
• C: Use the same administrator password everywhere
• D: Disable internal logging

Correct Answer: B

Explanation: Segmentation with explicit routing and firewall restrictions narrows the paths a lower-trust guest can take toward sensitive systems. The control should be tested from representative devices and complemented by host security, identity policy and monitoring.

Question 13. An analyst receives a hash-only threat indicator. What limitation should be remembered?

• A: Hashes always prove attribution
• B: The hash can identify one byte sequence but does not describe behavior by itself
• C: Hashes are encrypted passwords
• D: Hashes automatically remove malware

Correct Answer: B

Explanation: A file hash is useful for identifying an exact byte sequence, but small modifications may change it and shared hashes do not reveal execution context. Combine indicators with file provenance, behavior, related events and trusted analysis before making response decisions.

Question 14. A developer stores production API keys in a public repository. Which control is most urgent?

• A: Rename the folder
• B: Revoke and rotate exposed secrets, then prevent recurrence
• C: Add a warning comment
• D: Wait until the next release

Correct Answer: B

Explanation: Public exposure should trigger immediate evaluation of access and rotation or revocation, plus log review for misuse. Removing the visible secret alone does not invalidate copies or history. Follow with secret scanning, least privilege and secure storage.

Question 15. Which metric best checks whether incident response is improving?

• A: The number of dashboard colors
• B: Measured detection-to-triage and containment time with context
• C: The size of the policy PDF
• D: Total email volume

Correct Answer: B

Explanation: Timing metrics become useful when definitions are stable, severity and incident mix are understood, and data quality is documented. Faster response without correct decisions can create harm, so balance speed with evidence preservation and remediation quality.

Question 16. A phishing simulation shows employees reporting suspicious messages late. Which intervention fits best?

• A: Punish anyone who hesitates
• B: Clarify the one-click report route and practice it
• C: Ban all external email
• D: Publish only a quarterly slide deck

Correct Answer: B

Explanation: An accessible report mechanism and short, role-specific practice can reduce confusion during a real event. Feedback should focus on expected action and remove fear that suppresses reporting. Measure actual reporting behavior and review false positives proportionately.

Question 17. Which approach is most appropriate for testing a web application you do not own?

• A: Begin scanning public endpoints without consent
• B: Obtain written scope and authorization before testing
• C: Use someone else’s credentials
• D: Hide traffic inside a public proxy

Correct Answer: B

Explanation: Technical ability does not create authorization. A written scope identifies permitted assets, time windows, test intensity, protected data, contacts and stopping rules. That boundary protects both users and the tester while making results repeatable and useful.

Question 18. A TLS certificate has expired on an internal service. What is the correct underlying fix?

• A: Tell browsers to ignore warnings permanently
• B: Renew or replace the certificate and validate the chain and name
• C: Disable HTTPS for every user
• D: Remove all security logging

Correct Answer: B

Explanation: Certificate replacement should restore valid identity and encryption while preserving the expected hostname and trust chain. The team should also diagnose why renewal or monitoring failed and test clients after deployment. Training users to bypass warnings undermines the identity check.

Question 19. An organization needs to preserve evidence from a compromised server. What is the best general sequence?

• A: Document the state, follow forensic acquisition policy and maintain chain of custody
• B: Reformat immediately
• C: Allow every employee to inspect the live host
• D: Upload the disk publicly

Correct Answer: A

Explanation: Forensic preservation depends on incident-specific priorities and approved acquisition methods. Record who performed the collection, when, what was collected, integrity values and secure custody. Uncontrolled handling can alter volatile evidence or expose confidential information.

Question 20. What does a least-privilege service account need?

• A: Domain administrator membership by default
• B: Only the permissions and token lifetime necessary for its task
• C: A shared password in plain text
• D: No logging at all

Correct Answer: B

Explanation: Service permissions should be explicitly tied to operations and reviewed when the service changes. Short-lived, scoped credentials and workload identities can reduce exposure, while logs help detect anomalous use. Blanket administrator rights make compromise more damaging.

Question 21. What is the strongest reason to define a recovery time objective?

• A: To guarantee no outage
• B: To state the maximum acceptable time to restore a service
• C: To eliminate backups
• D: To promise zero data loss

Correct Answer: B

Explanation: An RTO expresses a business recovery-time tolerance that guides architecture, staffing and testing. It is different from an RPO, which addresses acceptable data loss. Neither is achieved simply by writing it in a policy; restoration exercises test whether the objective is realistic.

Question 22. A firewall rule permits broad outbound traffic from a high-risk server. What should the reviewer do?

• A: Leave it because outbound traffic is always safe
• B: Identify required destinations and reduce permission with testing
• C: Disable monitoring
• D: Add another broad allow rule

Correct Answer: B

Explanation: Egress rules should follow the server’s justified dependencies and be reviewed against actual traffic, operational exceptions and incident requirements. Narrowing permissions helps contain compromise, but testing and a rollback plan are needed to avoid interrupting legitimate services.

Question 23. A company uses a third-party SaaS app for sensitive data. Which shared-responsibility question matters?

• A: Who owns customer identities, access, data retention and incident reporting?
• B: What color is the SaaS logo?
• C: Does the provider have the most followers?
• D: Can everyone share one account?

Correct Answer: A

Explanation: The contract, platform configuration and regulatory context determine which controls each party owns. The customer often remains responsible for identities, data governance and monitoring even when the provider operates infrastructure. Assumptions should be written and verified.

Question 24. A vulnerability scanner marks a critical issue on an isolated lab server and a medium one on an internet-facing service. What should drive triage?

• A: The scanner severity alone
• B: Context including exploitability, exposure, asset value and compensating controls
• C: Alphabetical server names
• D: Which report is easiest to print

Correct Answer: B

Explanation: Severity is an input, not an automatic work order. Real risk also depends on accessibility, affected assets, exploitability, existing controls and business consequences. Record why a finding receives priority and verify remediation rather than relying on a closed ticket.

Question 25. A vendor offers an unverified “real exam questions” download. What is a sound study decision?

• A: Use the download to bypass learning
• B: Seek authorized objectives and original practice material with explanations
• C: Share credentials with the vendor
• D: Assume every answer is current

Correct Answer: B

Explanation: Authorized objectives identify the exam scope, while original practice scenarios assess reasoning rather than memorizing stolen questions. Unverified dumps may violate exam agreements, contain wrong answers or encourage weak security habits. A legitimate practice set should disclose its source and limitations.

How to use this historical practice set

Review why the incorrect approaches fail in the stated scenario. If a question involves a control you have never configured, use a small authorized lab or vendor documentation to connect it with actual behavior. Record one takeaway and retest the topic later rather than repeating the same answer until it feels familiar. A retired exam code may remain useful for foundational learning, but it cannot substitute for the latest issuer blueprint, approved exam policies or original current-version practice. All questions above are newly written and are not reproductions of CompTIA exam content.

• Category: Others