Free CompTIA Security+ (SY0-701) practice test

1.An organization implements a system in which employees attempting to access the corporate VPN are evaluated against the following conditions before access is granted: their device must have a current antivirus signature file, the operating system must not have critical patches outstanding for more than 72 hours, and the connection must originate from a recognized country. Employees whose devices fail any condition are redirected to a remediation portal rather than granted VPN access. Which access control concept does this system implement?

2.A company uses OpenID Connect (OIDC) to allow users to log in to its application using their Google account. Which IAM function does OIDC provide in this scenario?

3.An organisation enforces a policy that each user account must only have the minimum permissions necessary to perform the user's assigned job duties and nothing more. Which principle does this policy implement?

4.A security engineer is hardening a Linux web server. They configure the web server process to run under a dedicated service account that has read access to web content directories, write access to log directories, and no other filesystem permissions. The account cannot execute system binaries outside the web server application, cannot access other users' home directories, and has no sudo privileges. If the web server process is compromised, the attacker operates within the constraints of this account. Which security principle does this configuration most directly implement, and what is its defensive value in a compromise scenario?

5.A security analyst is reviewing an embedded RTOS device used in a medical infusion pump. The device has no user interface and communicates only via a proprietary protocol over a local network. Which security control is MOST feasible to implement on this device?

6.An attacker sends an email with a PDF attachment that exploits a vulnerability in the PDF reader to execute malicious code. Which threat vector does this represent?

7.A penetration tester is given only the organization's company name and public-facing IP ranges before beginning the assessment. What type of environment is this?

8.Which attribute most distinguishes a nation-state threat actor from organized crime?

9.An organisation has a new SIEM deployment and initially receives 10,000 alerts per day, nearly all false positives. Which strategy BEST addresses this problem over time?

10.Which data sanitization method is MOST appropriate when a company needs to reassign an internal hard drive to a different employee for continued use?