Security+ Security Operations Practice Questions
Domain 4 of 5 · 28% of SY0-701 and 27% of SY0-801
90 questions across all five domains in 90 minutes, with a score for each domain so you know where you stand.
Free Security Operations drillA company wants to stop developers from accidentally committing API keys to its code repositories. Which control fits best?
Security Operations on the Security+ exam
Security Operations is the largest domain: 28% of SY0-701 and 27% of SY0-801, about 25 of 90 questions on SY0-701 and 24 on SY0-801. It is the day-to-day work of a security team: hardening and monitoring systems, managing vulnerabilities and identities, automating, and responding to incidents.
- Share of the exam
- 28% of SY0-701 (about 25 of 90 questions) and 27% of SY0-801 (about 24)
- Our drill
- 10 questions from 100 Security Operations questions, untimed, a note on every option or row; one free attempt, unlimited with a pass
What Security Operations questions test
- Mitigating controls: hardening, segmentation, application allow lists, sandboxing, firewalls and WAFs, IDS/IPS, EDR and XDR, NAC and 802.1X, MDM, DNS filtering, DLP, secrets scanning, secure coding, Group Policy and SELinux
- Email security: SPF, DKIM, DMARC and BIMI; wireless: WPA3-Enterprise, SAE and RADIUS
- Asset management and media sanitization; vulnerability scanning, false positives and negatives, CVSS-based prioritization, exceptions and verification
- Monitoring: SIEM, syslog, NetFlow, SNMPv3, SCAP and benchmarks, alert tuning, port mirroring
- Identity and access: MFA factors, SSO, SAML, OAuth, access control models, just-in-time access, passkeys, provisioning and access reviews
- Automation and orchestration (SOAR), incident response phases, threat hunting, chain of custody, legal hold, order of volatility and log sources
Sit the full exam under the real clock
90 questions across all five domains in 90 minutes, with a score for each domain so you know where you stand.
Free Security Operations drillHow to study it
- Learn the incident response phases in order and one action for each; questions ask which comes first.
- Know which protocol replaces which: SSH for Telnet, SFTP for FTP, LDAPS for LDAP, SNMPv3 for v1/v2c.
- For access control models, ask who decides: the system's labels (MAC), the owner (DAC), the role (RBAC) or a rule.
- This domain is over a quarter of the exam: drill it until you score 85% or better before your mock.
Common questions
What is the biggest domain on Security+?
Security Operations: 28% of SY0-701 and 27% of SY0-801, about 25 of 90 questions on SY0-701 and 24 on SY0-801.
Are incident response questions on Security+?
Yes. Expect questions on the order of the phases, what belongs to containment versus eradication, chain of custody, legal hold and which log source answers an investigation question. Incident response also appears in performance-based questions.
90 questions across all five domains in 90 minutes, with a score for each domain so you know where you stand.
Free Security Operations drillMore Security+ practice
Sources
Original practice questions for exam preparation, written to the CompTIA Security+ SY0-701 domain weights and the SY0-801 exam objectives; none comes from a real exam. Independent practice, not affiliated with or endorsed by CompTIA. CompTIA and Security+ are trademarks of CompTIA, Inc.