2026 Actual CompTIA SY0-701 Dumps, Updated Exam Questions for Guaranteed Pass

SY0-701 free sample questions and answers

CompTIA SY0-701 practice quiz with correct answers for search indexing.

1. Question 1

   A company performs a risk assessment on the information security program each year. Which of the following best describes this risk assessment?

   ARecurring
   

   BAd hoc
   

   COne time
   

   DContinuous
   

   Correct answer: A

   Because the organization performs the risk assessment each year, it is being done on a regular, scheduled interval. In Security+ terminology, that makes it a recurring risk assessment, not ad hoc, one-time, or continuous. The Study Guide differentiates these modes and states: ''Recurring risk assessments are performed at regular intervals, such as annually or quarterly.'' This matches the scenario exactly (annually = each year).

   To avoid confusion with the other options: a one-time assessment is described as a ''point-in-time view'' performed when the organization wants a snapshot (often tied to a specific need), while ad hoc assessments are triggered by a specific event or situation (like a new project or significant change). In contrast, the key distinguishing factor of recurring is the planned cadence used to ''track the evolution of risks over time'' and ensure risk management adapts. The guide also notes continuous risk assessment involves ongoing monitoring and analysis, often supported by automated scanning and frequent updates, which is different from a once-per-year schedule. Therefore, the annual assessment described is best classified as recurring.

   
   

2. Question 2

   A company performs a vulnerability assessment and gets the following results:

   Vulnerability | Server location | CVSS score 1 | Internet | 9.8 2 | Internal | 4.0 3 | Internet | 4.0 4 | Internal | 9.8

   Which of the following vulnerabilities should the company patch first?

   A1
   

   B2
   

   C3
   

   D4
   

   Correct answer: A

   Vulnerability 1 should be patched first because it has both the highest severity and the highest exposure. A CVSS score of 9.8 indicates a critical vulnerability, and the affected server is internet-facing. Internet-facing systems are directly exposed to external threat actors, automated scanning, exploit kits, and opportunistic attacks. Vulnerability 4 also has a CVSS score of 9.8, but it is internal, so the exposure is lower unless an attacker already has access inside the environment. Vulnerabilities 2 and 3 have lower CVSS scores and therefore lower technical severity. Security+ prioritization considers severity, asset exposure, exploitability, and business impact. The critical internet-facing vulnerability is the most urgent.

   
   

3. Question 3

   Which of the following is a risk of conducting a vulnerability assessment?

   AA disruption of business operations
   

   BUnauthorized access to the system
   

   CReports of false positives
   

   DFinding security gaps in the system
   

   Correct answer: A

   A key risk of conducting a vulnerability assessment is the potential for disruption of services during active system testing. This occurs because:

   • Active scanning can overload systems - intensive vulnerability scans consume bandwidth and CPU resources, potentially degrading performance
   • Test exploits may crash services - some assessment techniques attempt to exploit vulnerabilities, which can cause systems or applications to become unstable or unresponsive
   • Impact on business operations - if assessments run during normal business hours, users may experience service interruptions or slowdowns
   • Database locks and resource contention - scanning can lock database records or monopolize system resources

   This is why vulnerability assessments should be scheduled during maintenance windows or off-peak hours when possible, and why coordination with system administrators is essential.

4. Question 4

   A penetration testing report indicated that an organization should implement controls related to database input validation. Which of the following best identifies the type of vulnerability that was likely discovered during the test?

   AXSS
   

   BCommand injection
   

   CBuffer overflow
   

   DSQLi
   

   Correct answer: D

   Poor input validation in databases typically leads to SQL Injection (SQLi) vulnerabilities, where attackers manipulate input fields to execute arbitrary SQL commands and gain unauthorized data access or control.

   XSS (A) affects web applications' output rendering, command injection (B) affects OS commands, and buffer overflow (C) affects memory management, so they don't directly relate to database input validation.

   SQLi is a critical vulnerability extensively covered in the Application Security domain6:Chapter 6CompTIA Security+ Study Guide.

   
   

5. Question 5

   A legacy device is being decommissioned and is no longer receiving updates or patches. Which of the following describes this scenario?

   AEnd of business
   

   BEnd of testing
   

   CEnd of support
   

   DEnd of life
   

   Correct answer: D

   When a legacy device is no longer receiving updates or patches, it is considered to be at the end of life (EOL). This means the manufacturer has ceased support for the device, and it will no longer receive updates, security patches, or technical assistance. EOL devices pose security risks and are often decommissioned or replaced.

   End of support may seem similar but typically refers to the cessation of technical support, whereas EOL means the device is fully retired.

   End of business and End of testing do not apply in this context.