Security+ Practice Questions (2026): 10 Free SY0-701 Questions with Answers

Integrity means data is not altered by an unauthorised party; changing the account number breaks it. Confidentiality (A) is about unauthorised disclosure — the attacker modified the data, not merely read it. Availability (C) concerns uptime and access, which were unaffected. Non-repudiation (D) is a valuable property but is not one of the three CIA pillars, which makes it the trap answer here.

Ransomware encrypts victim data and extorts payment for the decryption key — exactly the behaviour described. A rootkit (A) hides an attacker's presence with elevated privileges but does not demand ransom. Spyware (C) covertly collects information rather than encrypting files. A logic bomb (D) is dormant code that fires on a trigger such as a date; the defining traits here — encryption plus a ransom note — point to ransomware.

Vishing (voice phishing) is social engineering conducted over the phone, here reinforced by impersonation, authority (the CIO's name) and urgency. Phishing (A) refers specifically to fraudulent email or messages, not a live call. Tailgating (B) is following someone through a physical door. A watering-hole attack (D) compromises a website the target group is known to visit. The delivery channel — a phone call — makes this vishing.

A false positive is a finding the scanner reports as a vulnerability that does not actually exist in the environment — exactly the case when the patch is present and the service disabled. A true positive (B) would be a real, confirmed vulnerability. A false negative (C) is the dangerous opposite: a real vulnerability the scanner missed. A zero-day (A) is an unknown flaw with no fix available, which contradicts “the patch is already installed.”

An IPS is deployed inline and can block or drop malicious traffic automatically as it passes through. An IDS (A) only detects and alerts — it is typically out-of-band and cannot stop traffic on its own. A SIEM (C) aggregates and correlates logs for analysis but does not sit inline dropping packets. A network TAP (D) is a passive device that copies traffic for monitoring and cannot block anything.

AES-256 is a symmetric block cipher — fast and well suited to encrypting large volumes of data at rest. RSA-4096 (A) is asymmetric and far too slow for bulk data; asymmetric crypto is used to exchange or protect the symmetric key, not to encrypt terabytes. SHA-256 (C) is a hashing algorithm that provides integrity, not confidentiality, and is one-way, so it cannot be reversed to read the data. Base64 (D) is encoding, not encryption, and offers no confidentiality at all.

True MFA combines factors from different categories. A password is “something you know” and a hardware security key is “something you have,” so this is genuine multifactor authentication. It is not single-factor (A). It is not “something you are” (C) — that category is biometrics such as a fingerprint or face, which is not used here. And it is not two knowledge factors (D); a password plus a PIN would be two of the same factor and would not qualify as true MFA.

A SIEM (Security Information and Event Management) centralises log collection, normalises and correlates events across sources, and generates alerts on rule matches — precisely what is described. SOAR (A) is the tempting distractor: it layers automated orchestration and response playbooks on top, but the requirement explicitly excludes automated response, so SIEM is the better answer. DLP (C) prevents data exfiltration; NAC (D) controls device admission to the network — neither performs cross-source log correlation.

The incident-response lifecycle runs Preparation → Detection/Analysis → Containment → Eradication → Recovery → Lessons Learned. Once a compromise is confirmed, containment comes first: isolate the host to cut off the C2 channel and prevent lateral movement. Eradication (A) — removing the malware — comes after containment, not before. Recovery (B) restores systems only once the threat is eliminated. Lessons learned (D) is the final phase, held after the incident is closed.

Buying insurance shifts the financial impact of a risk to a third party — the definition of risk transference. Risk avoidance (A) means eliminating the activity that creates the risk altogether. Risk acceptance (B) means acknowledging the residual risk and choosing to take no further action. Risk mitigation (D) means applying controls to reduce likelihood or impact — which the company already did; the insurance addresses only what remains.