FirstTry

Objective 4.1

SY0-701

Given a scenario, apply common security techniques to computing resources

Objective 4.1 sits in Security Operations, which carries 28% of the Security+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.

Objective title verbatim from the official objectives. CompTIA exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

4-1Security Operations

A 16-character hexadecimal session ID has its first 8 characters fixed for every user and only the last 8 characters randomly generated. How much actual entropy does this identifier provide?

32 bits of entropy from the random halfCorrect · your answerCorrect. Eight unpredictable hex characters, four bits apiece.
64 bits of entropy from the full identifierThat figure treats the fixed prefix as if it varied. It does not.
16 bits of entropy from the fixed portionAn undercount: eight hex characters carry twice that.
8 bits of entropy from a single characterTwo hex characters would give this. The scenario leaves eight unpredictable.

Correct.

Checked against learn.microsoft.com, July 2026

Concept

Entropy counts only the parts an attacker cannot predict. A value's length says nothing on its own, because any portion that is constant, derived from something guessable, or reused across users contributes zero. For a hexadecimal string, each unpredictable character is worth four bits, and the guessing cost is two raised to that total. A structurally long token can therefore be far weaker than its size suggests.

Why A

Each hex character carries 4 bits of entropy; with only 8 random characters remaining, the effective entropy is 32 bits, below the required minimum.

Source

For example, if half of a 16-character hexadecimal session ID is fixed, only the remaining 8 characters are random, providing just 32 bits of entropy — which is insufficient for strong security.

OWASP Session Management Cheat Sheet, checked July 2026
#application-security#session-management

Now you: objective 4.1 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

4-1Security Operations

Disclosure, capture, prediction, brute force, or fixation of a session identifier can lead to which attack, in which an attacker fully impersonates a victim user?

Sample question 2 of 3

4-1Security Operations

An attacker targets any valid user session rather than a specific privileged account, and also attempts to submit a session ID through a URL query string to bypass cookie protections. Which combination best describes this risk?

Sample question 3 of 3

4-1Security Operations

A DevOps team wants infrastructure as code misconfigurations and exposed secrets found across GitHub and GitLab repositories correlated with cloud security context for remediation prioritization. Which capability provides this?

That’s 3 of the full Security+ bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Security Operations