What score do I need to pass SY0-701?

The published pass mark is 750 on the 100 to 900 scale. A raw score out of fifteen is not that number: the real exam is scaled, so treat this page as a gap finder and a full simulation as the measurement.

Are these the real exam questions?

No. They were written for this page and mapped to the published SY0-701 objectives. They are checked against the SecLern bank so they do not repeat a paid question, and nothing is copied from a live exam.

How long should the fifteen questions take?

About 15 minutes, which matches the real pace of 90 minutes for 90 questions. If you finish far faster than that, check whether you read the whole stem; if you finish far slower, the pacing is the thing to practise next.

Why does every option have an explanation?

Because the exam rarely asks whether you know the definition; it asks you to choose between four plausible controls, orders or owners. The distractor explanations are where that judgement is learned, and they are the part most free question sets leave out.

What should I do after the SY0-701 practice test?

Read every explanation, list the misses by objective id, then work the matching labs and PBQ examples for those objectives. Come back to a fresh set of questions, not this one, and only book when two unseen sittings clear the pass margin.

Home Practice testsSecurity+ SY0-701

Security+ SY0-701 practice test: 15 free questions

15 original Security+ SY0-701 questions with a reason for every option, a score at the end, and the domain weights and pass mark the real exam uses.

SY0-701 is 90 questions in 90 minutes, 750 on the 100 to 900 scale. Facts checked 16 October 2026 against comptia.org. Nothing below is drawn from the paid bank or from a real exam.

15 questions about 15 minutes every option explained

The 15 questions

Pick an option to see that question's explanations.

0 of 15 answered · suggested 15 minutes · Security+ SY0-701

01
An archive team must be able to prove, months later, that a stored contract file has not changed since it was written. Which measure meets that requirement?
Options for question 1
02
A finance team needs to prove that an approval email came from a specific manager and was not altered in transit. Which control provides both properties?
Options for question 2
03
An intrusion holds a foothold in a defence supplier for eleven months, uses previously unseen tooling, and focuses on design documents rather than payment data. Which actor profile fits the evidence?
Options for question 3
04
An employee gets a phone call from someone claiming to be the service desk, who asks them to read out the six-digit code just sent to their phone. Which term describes this attack?
Options for question 4
05
A SIEM shows one failed login for each of 400 different usernames, all from the same address, within four minutes. No username is tried twice. Which attack does this indicate?
Options for question 5
06
A company must publish a web application to the internet while keeping the database unreachable from outside. Which design meets the requirement?
Options for question 6
07
A laptop holding personnel records is stolen from a car. Which control most directly limits the disclosure of the data on the disk?
Options for question 7
08
A payroll database must survive the loss of its primary site with no committed transaction lost. Which arrangement meets that requirement?
Options for question 8
09
An identity provider flags a session that authenticated in Cairo at 09:10 and then in São Paulo at 09:40 from the same account. Which indicator is being reported?
Options for question 9
10
A file server starts encrypting shared documents and dropping ransom notes. Which action should the responder take first?
Options for question 10
11
A vulnerability scan reports four findings: 9.8 on an internet-facing API with a public exploit, 7.5 on an internal print server, 6.1 on a developer laptop and 5.3 on a test host. Which should be remediated first?
Options for question 11
12
An application builds SQL by pasting a user-supplied account number into the query string. Which change removes the injection risk?
Options for question 12
13
A company documents that a legacy label printer will stay unpatched because replacing it costs more than the expected loss, and the decision is signed off by the service owner. Which risk response is this?
Options for question 13
14
Who is accountable for deciding that a new dataset is confidential and for approving who may access it?
Options for question 14
15
Two organisations need to connect their networks to exchange order data and must define the security requirements and the right to audit each other. Which document is used?
Options for question 15

What this Security+ SY0-701 practice test measures

This set probes the judgement Security+ actually asks for: which control answers the stated goal, which order contains an incident, and who owns a decision. The questions lean on operations and threats because those two domains carry half the exam, and they avoid trivia that a search engine can answer in three seconds.

The fifteen questions are grouped the way SY0-701 is grouped, so the domains that carry the most marks get the most questions. Each question has one key and three distractors, and every option carries its own explanation: the key says why it is right, and each distractor says the specific thing that makes it wrong. That is the part most free question sets skip, and it is the part that turns a miss into a lesson.

Nothing here is drawn from the paid bank or from a real exam. The questions were written for this page, mapped to the published SY0-701 objectives, and checked against every question in the SecLern packs so the same idea is not tested twice in different words.

Domain	Weight	Questions here
Security concepts	12%	2
Threats and mitigations	22%	3
Architecture	18%	3
Operations	28%	4
Program oversight	20%	3

Weights from the published SY0-701 objectives, checked 16 October 2026.

How to use a practice test without wasting it

A practice test is a measurement, and a measurement you have already seen is worth less the second time. Take this one once, cold, before you revise anything: no notes, no lookups, no pausing. Fifteen questions will not take long, and the score is only useful if it reflects what you actually know today.

Mark every question you were unsure about, even the ones you got right. A lucky guess and a confident answer look identical in the score, and they are not the same thing. At the end, the questions you flagged tell you more than the ones you missed.

Then leave it alone for a while. Come back in a week and the same fifteen questions will feel different, which is useful evidence about whether the revision landed.

Take it cold, once. Sit the fifteen questions in one go with a clock running and nothing open beside them. The result is a baseline, not a verdict.
Read every explanation, including the ones you got right. The three distractors teach the distinctions the exam tests: which control, which order, which owner. A right answer for the wrong reason will not survive a differently worded question.
Write the miss down by objective. Not "I got four wrong": name the objective id and the idea behind the question. That list becomes the next study session instead of a vague feeling of weakness.
Move the miss into another format. If the miss was about a control, find the lab that uses it. If it was about order, find a PBQ that grades sequence. Reading the same explanation twice is not revision.
Measure again with fresh questions. Repeat on unseen questions, not this set. When two fresh sittings land comfortably above the pass margin, the exam date is a scheduling decision rather than a hope.

What SY0-701 actually asks, domain by domain

The percentages below are the published weights, not a study plan. They say where the marks are, which is where your calendar should go first: Operations carries 28% of SY0-701 and deserves the largest share of the remaining weeks.

The exam is 90 questions in 90 minutes, which is about 1 minutes per question on average, before you account for the 5 performance-based questions the simulation serves. That average is the whole timing argument: a question that takes three minutes has borrowed a minute from two others.

Security concepts (12%). General security concepts is the vocabulary tax: the CIA triad, non-repudiation, authentication factors, change management and the control categories. Questions here are short and exact, so read for the property the scenario needs rather than the technology it names.
Threats and mitigations (22%). Threats and mitigations is the heaviest question source after operations. Expect a scenario with an actor, a vector and an indicator, and expect the distractors to be real techniques that simply do not fit the evidence you were given.
Architecture (18%). Architecture questions ask where a control belongs: which segment, which layer, which resilience arrangement. The right answer is usually the one that satisfies the stated availability or isolation requirement with the least machinery.
Operations (28%). Operations is the largest domain at 28% and the most scenario-shaped. Log triage, containment order, vulnerability prioritisation and secure coding all appear, and the wrong answers are usually plausible but out of sequence.
Program oversight (20%). Programme oversight is governance: risk treatment, data roles, agreements and third-party obligations. The answers are decided by accountability, not by technology, so ask who owns the risk before you choose a control.

Reading your score honestly

The published pass mark is 750 on the 100 to 900 scale. Your raw score out of fifteen is not that number: the real exam is scaled, and 90 questions sample far more objectives than fifteen can. Use the raw score to find gaps; use a full simulation before you book.

A useful rule for a fifteen-question sample: anything under ten correct means at least one domain is unlearned, not unlucky. Twelve or more with two flagged guesses means the knowledge is there and the risk is pace and wording. The number that matters is not the percentage; it is which domains the misses cluster in.

The app's full simulation is the honest test: 90 questions on the real clock, with the same domain mix the objectives describe, and 5 performance-based questions in front of it. Free accounts get thirty study questions a day and three PBQs; the timed simulations are Pro. That is the line between practising and measuring.

The week after this test

Five steps, in order. Each one uses a different surface, because reading the same page twice is not revision.

Step 1. List every miss against its objective id and open that objective page. Two misses in one domain is a study session, not a coincidence.
Step 2. Work the SY0-701 labs that use the same surface: the firewall rule table, the SIEM queue and the Linux hardening host. Seeing the control in a tool fixes the distinction faster than re-reading it.
Step 3. Take one PBQ from the PBQ examples page with hints off, then read the score report line by line. The report names the item you got wrong, which is the same information a missed question gives you.
Step 4. Re-read only the two heaviest domains (operations and threats) and write one sentence per objective you cannot explain out loud. Those sentences are the gaps.
Step 5. Book a full timed simulation, and only book the exam when two fresh simulations land above the pass mark with time left on the clock.

Keep going

6 free sets are live: SY0-701, N10-009, 200-301, CS0-004, 220-1201, 220-1202.

SY0-701 practice test questions

Yes. All 15 questions, every option explanation and the score are free with no account. The free SecLern account adds thirty study questions a day, three PBQs, the lessons and every free tool.

Create a free account

Thirty study questions a day, three PBQs and every free tool. No card, and the 7-day Pro trial is optional.

Turn today's misses into this week's study plan

Save your score, name the domains that leaked points, and work the SY0-701 lessons and labs for them. The next fresh sitting is the measurement that matters.

Start studying free

Free tier, no card. Pro starts with a 7-day trial; a card is required and you can cancel before day 7.

Security+ SY0-701 practice test: 15 free questions

The 15 questions

An archive team must be able to prove, months later, that a stored contract file has not changed since it was written. Which measure meets that requirement?

A finance team needs to prove that an approval email came from a specific manager and was not altered in transit. Which control provides both properties?

An intrusion holds a foothold in a defence supplier for eleven months, uses previously unseen tooling, and focuses on design documents rather than payment data. Which actor profile fits the evidence?

An employee gets a phone call from someone claiming to be the service desk, who asks them to read out the six-digit code just sent to their phone. Which term describes this attack?

A SIEM shows one failed login for each of 400 different usernames, all from the same address, within four minutes. No username is tried twice. Which attack does this indicate?

A company must publish a web application to the internet while keeping the database unreachable from outside. Which design meets the requirement?

A laptop holding personnel records is stolen from a car. Which control most directly limits the disclosure of the data on the disk?

A payroll database must survive the loss of its primary site with no committed transaction lost. Which arrangement meets that requirement?

An identity provider flags a session that authenticated in Cairo at 09:10 and then in São Paulo at 09:40 from the same account. Which indicator is being reported?

A file server starts encrypting shared documents and dropping ransom notes. Which action should the responder take first?

A vulnerability scan reports four findings: 9.8 on an internet-facing API with a public exploit, 7.5 on an internal print server, 6.1 on a developer laptop and 5.3 on a test host. Which should be remediated first?

An application builds SQL by pasting a user-supplied account number into the query string. Which change removes the injection risk?

A company documents that a legacy label printer will stay unpatched because replacing it costs more than the expected loss, and the decision is signed off by the service owner. Which risk response is this?

Who is accountable for deciding that a new dataset is confidential and for approving who may access it?

Two organisations need to connect their networks to exchange order data and must define the security requirements and the right to audit each other. Which document is used?