CompTIA Security+ Interview Questions and Answers for SY0-701

Key takeaways

• Interviewers use Security+ as a baseline and test whether you can apply ideas, not recite definitions.
• The current exam is SY0-701. Check the CompTIA site for the latest exam code before you cite it.
• Answer in three parts: define, give an example, say how you would detect or prevent it.
• Prepare two short stories from labs or projects. Examples beat definitions.

How to use this list

Security+ is a vendor-neutral entry certification from CompTIA. Its exam objectives are grouped into five domains: general security concepts, threats and vulnerabilities and mitigations, security architecture, security operations, and security programme management and oversight. The exam version covered here is SY0-701. Confirm the current version and objectives on the CompTIA certifications page before you rely on any list, including this one.

For each question, give a short definition, an example and how you would prevent or detect it. Do not read the model answers aloud. Put them in your own words.

Domain 1: General security concepts

1. What is the CIA triad?

Confidentiality (only the right people see data), integrity (data is not changed without authorisation) and availability (systems work when needed). Example: encryption protects confidentiality, hashing and digital signatures protect integrity, backups and redundancy protect availability.

2. What is the difference between authentication, authorisation and accounting?

Authentication proves who you are, authorisation decides what you may do, accounting records what you did. A login is authentication, a role that can read but not delete is authorisation, and a log entry is accounting.

3. What is multi-factor authentication?

Using two or more different types of proof: something you know (password), have (token or phone) or are (fingerprint). Two passwords are not MFA. Phishing-resistant methods such as FIDO2 security keys are stronger than SMS codes.

4. Explain least privilege and zero trust.

Least privilege gives users and systems only the access they need. Zero trust assumes no user or device is trusted just because it is inside the network, so every request is verified.

5. Symmetric versus asymmetric encryption?

Symmetric uses one shared key and is fast, for example AES. Asymmetric uses a public and private key pair, for example RSA, and solves key exchange and signatures. Real systems use both: asymmetric to exchange a key, then symmetric for the bulk data.

6. What is hashing and how is it different from encryption?

A hash is a one-way fingerprint with a fixed length. You cannot reverse it. Encryption is reversible with the key. Use hashing, with salting and a slow password algorithm, for passwords.

7. What is a digital certificate?

A signed statement binding a public key to an identity, issued by a certificate authority. Browsers use certificates in TLS to confirm they are talking to the right site.

Domain 2: Threats, vulnerabilities and mitigations

8. Name common types of malware.

Viruses, worms, trojans, ransomware, spyware, rootkits and keyloggers. Be ready to explain how each spreads and how you detect it.

9. What is phishing, and how do you reduce it?

Fraudulent messages that trick people into revealing data or running malware. Reduce it with email filtering, SPF, DKIM and DMARC, MFA, user training and a simple way to report suspicious mail.

10. What is social engineering?

Manipulating people instead of systems: pretexting, tailgating, vishing, baiting. Defences are policy, verification steps such as call-back for payment changes, and awareness.

11. What is SQL injection?

Untrusted input is placed into a database query and changes its meaning. Prevent it with parameterised queries, input validation and least-privilege database accounts.

12. What is cross-site scripting (XSS)?

An attacker gets a script to run in another user's browser through a vulnerable page. Prevent it with output encoding, a content security policy and framework protections.

13. What is a DDoS attack?

Many devices flood a service so legitimate users cannot reach it. Mitigation uses upstream scrubbing, rate limiting, CDNs and capacity planning.

14. What is the difference between a vulnerability, a threat and a risk?

A vulnerability is a weakness, a threat is something that can exploit it, and risk is the likelihood and impact of that happening.

15. What is a zero-day?

A vulnerability the vendor does not yet know or has not patched. You cannot rely on a patch, so layers such as segmentation, monitoring and least privilege matter.

Domain 3: Security architecture

16. What is defence in depth?

Layering controls, such as firewall, segmentation, endpoint protection, MFA and monitoring, so the failure of one does not mean compromise.

17. What does a firewall do and how does a next-generation firewall differ?

A firewall allows or blocks traffic by rules. A next-generation firewall also inspects applications, users and sometimes content, and can include intrusion prevention.

18. What is network segmentation?

Dividing a network into zones so a breach in one cannot easily spread. A DMZ for public servers and separate VLANs for guests and servers are examples.

19. IDS versus IPS?

An IDS detects and alerts. An IPS sits in the path and can block. Tuning matters, because a noisy IPS can break legitimate traffic.

20. What is the shared responsibility model in cloud?

The provider secures the underlying infrastructure and you secure what you put on it: identity, data, configuration and your own workloads. Details vary by service type. See the AWS documentation for one provider's version.

21. What is a VPN and what does it protect?

An encrypted tunnel between a device and a network. It protects traffic on untrusted networks. It does not make you anonymous or protect an infected device.

Domain 4: Security operations

22. What are the steps of incident response?

Preparation, detection and analysis, containment, eradication, recovery and lessons learned. Mention evidence handling and communication.

23. What is a SIEM?

A platform that collects logs, correlates events and raises alerts. An analyst's job is to investigate alerts, separate true from false positives and escalate.

24. What is vulnerability management?

Regularly finding, ranking and fixing weaknesses. Scan, rank by severity and exposure, patch, verify. CVSS scores and the National Vulnerability Database help with ranking.

25. What is the difference between a vulnerability scan and a penetration test?

A scan is automated and finds known weaknesses. A penetration test is a manual, authorised attempt to exploit them and show real impact.

26. How would you respond to a suspected ransomware infection?

Isolate the affected machine from the network, preserve evidence, report to the incident team, identify scope, restore from clean backups after removing the cause, and review how it got in. Do not rely on paying as a plan.

Domain 5: Security programme management and oversight

27. What is risk management?

Identifying risks, assessing likelihood and impact, then choosing to mitigate, transfer, accept or avoid. The NIST Cybersecurity Framework is a common reference.

28. What is the difference between a policy, a standard and a procedure?

A policy states what must be done and why, a standard sets measurable requirements, and a procedure gives the steps.

29. What is the purpose of a business continuity and disaster recovery plan?

To keep critical functions running and restore systems after a disruption. Know RTO (how fast to restore) and RPO (how much data loss is acceptable).

30. Why do organisations care about compliance and awareness training?

Laws, contracts and standards set minimum controls, and people are often the weakest point. Training turns policy into habits.

Scenario questions to practise

• A user reports a strange login prompt after clicking an email link. What do you do first?
• You see repeated failed logins from one IP followed by one success. What does this suggest and what is your next step?
• A manager asks for exceptions to MFA for executives. How do you respond?

For each, state facts, risks and a clear next action, and say who you would escalate to.

Next steps

If you are preparing for security analyst roles, practise with the SOC analyst path or read more interview material in the cybersecurity interview questions for beginners and network security interview questions.

Related reading

• Common Cybersecurity Questions and Answers for Entry-Level Roles
• [2026] Top 200+ Cyber Security Interview Questions and Answers for Freshers
• Common Cyber Security Certification Exam Questions 2026