Security+ SY0-701 Domain 1: General Security Concepts — 6 practice questions with answers

Domain 1 is 12% of the CompTIA Security+ (SY0-701) exam, which works out to roughly 11of the up to 90 questions on the real test. Below are study notes for the domain's objectives, then every question from our free Security+ SY0-701 practice test that targets this domain, with the correct answer and the reasoning behind it. Try to answer each one before reading the explanation.

Objectives in this domain

• 1.1 Compare and contrast various types of security controls
• 1.2 Summarize fundamental security concepts
• 1.3 Explain the importance of change management processes and the impact to security
• 1.4 Explain the importance of using appropriate cryptographic solutions

What to focus on

This is the smallest domain by weight, but it supplies the vocabulary every other domain assumes. Expect to classify controls two ways at once: by category (technical, managerial, operational, physical) and by type (preventive, deterrent, detective, corrective, compensating, directive). A locked server-room door is a physical, preventive control; a CCTV camera is physical and detective, and can also be a deterrent. Questions often describe a control in a sentence and ask for one of the two labels, so learn both axes rather than a single list.

The CIA triad, non-repudiation and AAA (authentication, authorization, accounting) come up as definitions, while zero trust is tested through its parts: the control plane (policy engine, policy administrator) and the data plane (policy enforcement point). Change management is examined as process: approval, impact analysis, backout plans, maintenance windows and updating documentation afterwards.

Objective 1.4 is the cryptography block. Know when to use symmetric versus asymmetric encryption, what hashing and salting protect against, what a digital signature proves, and the PKI pieces: certificate authorities, CSRs, CRLs versus OCSP, and wildcard versus SAN certificates. Key escrow, TPMs, HSMs and secure enclaves are fair game as "where should the key live" questions.

Practice questions and explanations

1. 1. Which of the following BEST describes the concept of least privilege?

   1. A) Users should have administrative access to perform all tasks efficiently
   2. B) Users should be granted only the minimum permissions necessary to perform their job functions
   3. C) All users should share a common set of elevated credentials for convenience
   4. D) Privileges should be assigned based on seniority within the organization

   Answer: B — Users should be granted only the minimum permissions necessary to perform their job functions

   The principle of least privilege ensures that users, processes, and systems are granted only the minimum level of access necessary to perform their intended functions. This reduces the attack surface and limits the potential damage from compromised accounts or insider threats.

2. 2. An organization wants to implement a security framework that categorizes controls as preventive, detective, and corrective. Which concept does this represent?

   1. A) Defense in depth
   2. B) Security control types (functional classification)
   3. C) Zero trust architecture
   4. D) Risk transference

   Answer: B — Security control types (functional classification)

   Classifying controls by what they do is what SY0-701 calls control types: preventive controls stop incidents before they occur, detective controls identify incidents that have occurred, and corrective controls restore systems after an incident. The exam also uses a second axis, control categories (technical, managerial, operational and physical), which describes how a control is implemented rather than what it does, so one control has both a type and a category.

3. 3. What is the primary purpose of implementing non-repudiation in a security system?

   1. A) To encrypt data at rest and in transit
   2. B) To ensure that a party cannot deny having performed a specific action
   3. C) To provide redundant backup systems
   4. D) To authenticate users with biometric data

   Answer: B — To ensure that a party cannot deny having performed a specific action

   Non-repudiation ensures that a party involved in a communication or transaction cannot deny having sent or received a message or having performed an action. Digital signatures and audit logs are common mechanisms for achieving non-repudiation.

4. 4. Which of the following authentication factors is an example of 'something you are'?

   1. A) A smart card
   2. B) A one-time password from an authenticator app
   3. C) A fingerprint scan
   4. D) A memorized PIN

   Answer: C — A fingerprint scan

   Authentication factors are categorized as: something you know (passwords, PINs), something you have (smart cards, tokens), and something you are (biometrics like fingerprints, retina scans, facial recognition). A fingerprint scan is a biometric factor — something you are.

5. 5. A security administrator implements a policy requiring all employees to change passwords every 90 days and use complex passwords. Which security concept is being applied?

   1. A) Separation of duties
   2. B) Password policy enforcement
   3. C) Data loss prevention
   4. D) Network segmentation

   Answer: B — Password policy enforcement

   Password policy enforcement defines rules for password creation, complexity, expiration, and reuse. Requiring regular password changes and complexity requirements are standard password policy controls that help protect against credential-based attacks. Be aware that current NIST guidance (SP 800-63B) actually advises against forced periodic changes unless there is evidence of compromise, favouring length and breached-password checks; the exam still expects you to recognise this as a password policy.

6. 6. Which of the following BEST describes the Zero Trust security model?

   1. A) Trust all internal users and verify external users only
   2. B) Never trust any entity by default, always verify regardless of location
   3. C) Trust is established once and maintained throughout the session
   4. D) External traffic requires MFA while internal traffic does not

   Answer: B — Never trust any entity by default, always verify regardless of location

   Zero Trust operates on the principle of 'never trust, always verify.' It assumes no implicit trust based on network location or prior authentication. Every access request is fully authenticated, authorized, and encrypted before access is granted, regardless of whether the request originates inside or outside the network.

Reading answers is not the same as recalling them. When you have worked through every domain, take the timed Security+ SY0-701 practice test: it shuffles the questions and options and scores you by domain, so you can see whether this one still needs work.