70 questions / 10 random questions
Random questions, instant feedback, and review for missed questions.
View recommended CompTIA Security+ resources →
Which CIA-triad element ensures that only authorized users can read customer data?
Answer: Confidentiality
Confidentiality limits information disclosure to authorized entities.
What is commonly used to verify that a file has not changed?
Answer: Compare it with a trusted hash
A cryptographic hash can detect content changes and support integrity verification.
What does authentication using a password plus a security key provide?
Answer: Multi-factor authentication using different factor types
A password is knowledge and a security key is possession, so the combination is MFA.
Why is symmetric encryption commonly used for bulk data encryption?
Answer: It is generally faster than asymmetric encryption
Symmetric encryption is fast, but its shared key must be distributed and stored securely.
What is most important before changing a production firewall rule?
Answer: Prepare impact analysis, approval, testing, and rollback
Managed change evaluates security and availability impact and enables recovery from failure.
What is a targeted message impersonating an executive to request an urgent transfer?
Answer: Business Email Compromise
BEC impersonates trusted executives or partners to induce payment or data disclosure.
Which malware encrypts files and demands payment for recovery?
Answer: Ransomware
Ransomware defenses include offline backups, patching, restricted privileges, detection, and response exercises.
Input such as ' OR 1=1 -- appears in a web request. Which attack is likely?
Answer: SQL injection
Parameterized queries and validation prevent input from being interpreted as SQL syntax.
Which web vulnerability causes attacker-controlled script to run in a user's browser?
Answer: Cross-Site Scripting
XSS is mitigated with output encoding, safe templates, and defenses such as CSP.
Which attack floods a service with traffic from many sources?
Answer: Distributed Denial of Service
DDoS exhausts resources with distributed traffic and reduces availability.
What is a previously unknown or unpatched vulnerability exploited before a fix is available commonly called?
Answer: A zero-day vulnerability
Defense against zero-days relies on layered controls such as behavioral detection, segmentation, and least privilege.
Which attack tries credentials leaked from one service against other services?
Answer: Credential stuffing
Credential stuffing automates reuse of leaked credentials; MFA and unique passwords reduce risk.
What attack category compromises a legitimate vendor update to distribute malware?
Answer: A software supply-chain attack
Signature verification, SBOMs, dependency pinning, and vendor assessment reduce supply-chain risk.
Which control helps detect insecure server configuration before production?
Answer: Configuration scanning against a secure baseline
Baseline comparison and policy as code can detect drift and unsafe settings early.
Which statement reflects a core Zero Trust principle?
Answer: Do not trust location alone; verify continuously and grant least privilege
Zero Trust emphasizes explicit verification, least privilege, and assuming breach.
Which design limits lateral movement from a compromised endpoint to critical servers?
Answer: Network segmentation with strict access controls
Segmentation separates trust boundaries and limits blast radius and lateral movement.
What is a common architecture for separating a public web server from an internal database?
Answer: Place the web tier in a DMZ and the database in an internal segment
Tier separation and narrowly allowed ports reduce impact if the public system is compromised.
Which combination protects both data at rest and data in transit?
Answer: Storage encryption and TLS
Data at rest and in transit require different controls; Base64 is not encryption.
What is the security objective of deploying a service across multiple regions?
Answer: Improved resilience and availability
Separating failure domains improves tolerance of a regional outage.
What does an RPO of four hours mean?
Answer: Up to about four hours of data loss is acceptable
RPO expresses acceptable data loss; RTO expresses target recovery time.
What is a primary role of a SIEM?
Answer: Aggregate and correlate logs to support alerts and investigations
A SIEM centrally analyzes events and provides context for detection, triage, and investigation.
What does EDR primarily provide on endpoints?
Answer: Behavior monitoring, detection, investigation, and response such as isolation
EDR collects endpoint telemetry and supports detection and response to suspicious activity.
What is appropriate after a scanner reports a critical vulnerability?
Answer: Validate asset context, exposure, and exploitability; remediate by priority and rescan
Risk-based vulnerability management cycles through validation, prioritization, remediation, and verification.
What should be done whenever possible before an emergency patch?
Answer: Assess impact, prepare backup or rollback, record approval, and monitor afterward
Even emergencies need streamlined change control and recovery preparation to limit secondary failures.
What is the highest-priority action for a departing employee's account?
Answer: Disable access at the approved offboarding time and recover credentials or assets
A joiner-mover-leaver process synchronizes access lifecycle with HR events.
Which practice is appropriate for privileged accounts?
Answer: Separate them from daily accounts and use MFA, PAM, and session recording
Privileged use should be limited, approved, recorded, and separated from ordinary activity.
What is important early in incident response before containment?
Answer: Triage scope and impact, preserve evidence, and establish communications
Early response preserves situational awareness, evidence chain, and coordination for containment decisions.
Why isolate a compromised endpoint from the network?
Answer: Limit lateral movement and external communication while preserving the system for investigation
Isolation is containment; eradication and recovery are separate phases.
Why record a hash when acquiring a forensic image?
Answer: To verify evidence integrity after acquisition
Matching acquisition and analysis hashes demonstrates that evidence has not changed.
What is a common goal of SOAR?
Answer: Automate repeatable alert enrichment and response workflows
SOAR automates repeatable playbooks so analysts can focus on higher-value decisions.
Why is asset inventory important to security operations?
Answer: It identifies owners, criticality, software, and patch state for response scope
Without knowing what exists, patching, monitoring, and incident scoping cannot be managed well.
How should inconsistent timestamps across security logs be addressed?
Answer: Synchronize time using authenticated NTP or equivalent and standardize time zones
Accurate time is essential for event correlation, timelines, and evidentiary value.
What is the basic formula for annualized loss expectancy?
Answer: SLE × ARO
ALE estimates annual loss by multiplying single loss expectancy by annualized rate of occurrence.
Which is an example of transferring risk?
Answer: Purchase cyber insurance
Insurance transfers part of financial impact, but does not eliminate all responsibility or loss.
What should be understood early in a third-party vendor assessment?
Answer: Data handled, access scope, subcontractors, controls, and incident-notification duties
Understanding data flows, access, and contractual duties enables inherent and residual risk assessment.
Which statement correctly relates policy, standards, and procedures?
Answer: Policy sets direction, standards set mandatory criteria, and procedures give steps
The hierarchy translates governance direction into enforceable criteria and executable steps.
What is a primary responsibility of a data owner?
Answer: Determine data classification and access requirements
The owner approves classification, use, and protection requirements based on business value and risk.
What is the purpose of a tabletop exercise?
Answer: Discuss a scenario to find gaps in roles, decisions, communications, and procedures
A tabletop exercise tests response plans and coordination with low operational risk.
What is an appropriate improvement after a phishing simulation?
Answer: Analyze results and use them for non-punitive targeted education and better reporting
Awareness programs should improve behavior and early reporting through measured, continuous improvement.
What should a security exception include?
Answer: Business justification, risk owner, compensating controls, expiry, and review
Exceptions transparently accept or mitigate risk and need expiry and reassessment to avoid becoming permanent.
An administrator needs privileged access only for a two-hour maintenance window. Which approach is best?
Answer: Approval-based just-in-time privilege with automatic expiry
Just-in-time access activates privileges only for an approved period and reduces exposure from standing privileges.
A payment test environment must replace real card numbers while securely retaining a mapping back to the originals. Which technique fits?
Answer: Tokenization
Tokenization replaces sensitive values with nonsensitive tokens and protects the mapping in a token vault.
What attack repeatedly sends MFA prompts until a user mistakenly approves one?
Answer: MFA fatigue attack
MFA fatigue abuses repeated push prompts to induce user error. Number matching and phishing-resistant authentication help.
What technique registers a domain one character away from a legitimate domain to lure users to a login page?
Answer: Typosquatting
Typosquatting abuses domains resembling common typing mistakes. Domain monitoring, browser protection, and awareness help.
An attacker uses PowerShell and built-in system tools without dropping an additional malware file. What describes this activity?
Answer: A fileless attack using living-off-the-land techniques
Abuse of legitimate tools can evade file signatures, so monitoring process chains, command lines, and behavior is important.
What attack compromises an industry site frequently visited by the target organization and delivers malware to its visitors?
Answer: Watering hole attack
A watering hole compromises a site used by targets to infect them indirectly. Browser updates, web isolation, and behavioral detection help.
An employee plugs in a USB drive labeled 'Salary Update' left in a meeting room and becomes infected. Which technique was used?
Answer: Baiting
Baiting uses an enticing object or message to induce a risky action. Removable-media controls and awareness reduce the risk.
Which architecture delivers cloud-based security controls to remote workers based on user, device, and application context?
Answer: SASE with ZTNA
SASE integrates networking and security at cloud edges, while ZTNA provides application access based on explicit verification.
Who is normally responsible for patching the guest operating system of a virtual machine running on IaaS?
Answer: The cloud customer
Under shared responsibility, the provider secures physical infrastructure while the IaaS customer manages the guest OS, applications, data, and configuration.
Factory OT devices use legacy protocols and cannot yet be replaced. Which design best limits compromise from the enterprise network?
Answer: Place OT in a separate zone and allow only required traffic through an industrial firewall and jump host
OT security reduces risk through zoning, allowlisted traffic, controlled administration paths, and passive monitoring while respecting availability constraints.
Traffic must be distributed across multiple application servers and failed nodes removed automatically. What is needed?
Answer: A load balancer with health checks
A load balancer with health checks sends traffic only to healthy nodes and uses redundancy to improve availability.
Which control can detect and block employees uploading large volumes of customer identifiers to personal cloud storage?
Answer: DLP with content inspection
DLP detects, alerts on, or blocks sensitive-data movement based on classification, patterns, and destinations.
What is the best way to remove a database password from application source code and rotate it regularly?
Answer: Store it in a secrets manager, retrieve it with workload identity, and rotate it automatically
A secrets manager provides encrypted storage, access control, auditing, and rotation while keeping secrets out of source code.
Which control blocks endpoint requests to known malware command-and-control domains at the DNS layer and records them for investigation?
Answer: DNS filtering or a sinkhole
DNS filtering blocks malicious resolution, while a sinkhole redirects requests to a controlled destination that can help identify infected hosts.
What activity proactively tests a hypothesis that an attacker is abusing service accounts even when no alert has fired?
Answer: Threat hunting
Threat hunting proactively searches for hidden compromise using hypotheses, threat intelligence, and endpoint, identity, and network telemetry.
Which control prevents unsigned container images from being deployed to a production cluster?
Answer: An admission policy that verifies image signatures
Combining signatures and admission control allows only images whose integrity and approved pipeline origin can be verified.
How should a response team communicate safely during an incident in which corporate email is compromised?
Answer: Use a preapproved out-of-band communication channel
Incident plans should predefine secure alternate contacts, authentication methods, and conditions for use when primary channels are compromised.
What should a business impact analysis establish first?
Answer: Critical processes, dependencies, outage impacts, and recovery priorities
A BIA identifies time, financial, and legal impacts plus dependencies, providing the basis for RTOs, RPOs, and recovery order.
Which data lifecycle policy best reduces privacy risk?
Answer: Collect only data needed for the purpose and verifiably delete it after the retention period
Data minimization, purpose limitation, retention controls, and secure disposal reduce both stored data and breach impact.
Which security terms are most appropriate in a contract with a vendor that handles critical data?
Answer: Control requirements, incident notification deadlines, audit rights, data return or deletion, and subcontractor conditions
Contracts should define responsibility, assurance, reporting, data lifecycle, and fourth-party risk to support monitoring and a controlled exit.
A public web server's TLS private key has leaked. Which key-management action should accompany containment of the intrusion?
Answer: Revoke the old certificate and reissue with a new key
Generate a fresh key pair in a secure environment and replace the certificate without reusing the exposed key. Revoke the old certificate, update all deployments sharing the key, and investigate the compromise scope.
An image-import API fetches user-supplied URLs and risks SSRF to internal administration services. Only fixed partner domains are needed. Which control is central?
Answer: Validate allowed hosts and resolved IPs and restrict redirects
SSRF abuses the server's network reachability. Validate fixed allowed destinations, resolved addresses, and redirects, and combine this with network egress restrictions to block internal requests.
A cookie-authenticated transfer page receives an unintended transfer request when a user visits another site. Which control should protect state-changing requests?
Answer: Validate the CSRF token included in the transfer request
This is CSRF exploiting the browser's automatic cookie attachment. Validate an unpredictable session-bound token and use SameSite cookies and origin checks as additional defenses.
A password-reset link can change the password again after it has already been used. Which measure directly prevents recurrence?
Answer: Atomically invalidate the reset token when it is used
Reset tokens need sufficient randomness, expiry, and single-use enforcement. Server-side consumption and password changes must remain consistent even under concurrent requests.
Two equally business-critical servers are vulnerable. One has a higher CVSS score but is isolated; the other is internet-facing with confirmed active exploitation. Which remediation should come first?
Answer: Prioritize the server with active exploitation and exposure
Prioritize using severity, active exploitation, reachability, business impact, and existing mitigations. Sources such as CISA KEV provide exploitation evidence; absence from the catalog does not imply safety.
A device connecting to the corporate LAN fails patch-compliance checks. Which NAC action permits remediation while protecting business systems?
Answer: Place it on a quarantine VLAN with remediation-only access
Isolate noncompliant devices on a remediation network and allow only required update services. Reassess compliance before restoring normal access.
Business endpoints must execute only approved signed applications. Which endpoint control directly implements this requirement?
Answer: Application allowlisting of approved signed executables
Application allowlisting limits execution to approved publishers or files. A signature alone is not sufficient trust; approval scope and update procedures must also be controlled.
Authentication logs show the same few common passwords tried infrequently across hundreds of accounts. Which attack best fits this pattern?
Answer: Password spraying across many different user accounts
Password spraying tries a small password set across many users to evade per-account lockouts. Combine cross-account detection with MFA and other authentication protections.
Normal administrator authentication fails because an external IdP is unavailable. Which design is appropriate for an emergency administrator account?
Answer: Use an independent authentication path and alert on every use
Emergency access should avoid common-mode failure with the normal path and combine protected credentials, strong authentication, usage monitoring, and periodic tests. It is not a shared account for daily work.
All 100 alerts from a detection rule are investigated: 20 are attacks and 80 are false positives. What is the rule's precision?
Answer: 20% (true positives divided by all alerts)
Precision is TP / (TP + FP), giving 20 / 100 = 20%. Recall cannot be computed without the number of missed attacks, so precision alone does not describe overall detection effectiveness.