Free CompTIA Security+ Sample Questions

Correct answers: A, C — Managerial category; Directive control type

• A. Managerial controls govern the security program through policy, risk management, and oversight. A leadership-approved policy is a textbook managerial control.
• B. Physical controls protect facilities and equipment, such as fences and badge readers. A written policy document does not restrict physical access.
• C. Directive controls state what is required or prohibited, and a policy that sets mandatory employee behavior is the standard example.
• D. Corrective controls limit impact or restore normal operation after an incident. A policy that states required behavior in advance is not a recovery measure.
• E. Technical controls are enforced by hardware or software, such as firewalls and encryption. A policy document relies on people to follow it, so it is not technical.

Correct answer: D — shop.example.com and api.example.com validate, but a.dev.example.com fails, because the wildcard matches only a single label

• A. Incorrect. A wildcard certificate is bound to the names it lists, and validating the organization does not extend coverage to other domains.
• B. Incorrect. The wildcard appears in the name field, and it matches subdomains, so shop.example.com and api.example.com are covered.
• C. Incorrect. A wildcard replaces exactly one DNS label, so a multi-level name such as a.dev.example.com is not matched.
• D. Correct. The asterisk stands for one label, so single-level subdomains are covered, while a two-level name needs its own entry or a second wildcard such as *.dev.example.com.

Correct answer: B — A history of who changed what and when, plus the ability to compare revisions and restore a known-good configuration

• A. Incorrect. Tracking commits supports accountability but does not replace the approval process that authorizes changes.
• B. Correct. Version control records authorship and timing, supports diffing between versions, and makes rollback to a known-good state straightforward.
• C. Incorrect. Version control stores and tracks files; it does not enforce allow list policy on devices unless separate tooling is added.
• D. Incorrect. Encryption at rest is a separate storage feature, and repositories still need access controls to prevent unauthorized edits.

Correct answer: B — Accounting, which logs the user's activity during the session so that it can be audited and attributed afterward

• A. Authorization decides what an authenticated user is permitted to do, but it produces a permit or deny decision rather than a record of the activity that took place.
• B. Accounting is the AAA function that tracks what an authenticated user did, including session timing and commands, which supports auditing, billing, and forensics.
• C. Federation extends trust across identity providers so users can sign in with external identities. It is not one of the three AAA functions and records nothing about commands.
• D. Authentication proves who the user is at the start of the session; it does not keep a running record of the commands executed after login.

Correct answer: A — Infrared sensor, which detects the thermal radiation of a warm body passing through its field of view

• A. A passive infrared sensor detects the heat a person radiates, works in total darkness, and transmits nothing, which matches every requirement.
• B. A pressure sensor reacts to weight, not heat, and a person could avoid the mat. It also does not rely on thermal radiation as the stem requires.
• C. An ultrasonic sensor is also active, since it emits sound waves and listens for echo changes. It detects motion rather than body heat.
• D. A microwave sensor is active: it transmits pulses and measures their reflection. That contradicts the requirement that the sensor emits nothing.

Correct answer: C — Shadow IT, an internal source of risk because unapproved services sit outside security controls

• A. Incorrect. Nothing shows a criminal party involved, and the risk comes from the team's own unsanctioned adoption of the services.
• B. Incorrect. The scenario describes convenience-driven workarounds, not a recruited insider or a directed intelligence operation.
• C. Correct. Shadow IT is the use of hardware, software or services without IT approval, which leaves data outside logging, DLP and access governance.
• D. Incorrect. The team is not attacking for a cause and is not external; it is simply working around controls to get work done.

Correct answer: D — As an internal actor, because the account grants trusted access inside the perimeter

• A. Incorrect. Payroll status is not the deciding factor; the contractor's authorized access gives insider-level reach to the finance share.
• B. Incorrect. Sophistication is a separate attribute from internal/external, and it cannot be inferred from the contractor's job title.
• C. Incorrect. Connecting remotely does not make someone external once credentials authenticate them into trusted resources.
• D. Correct. The internal/external attribute depends on access and trust, so a contractor with valid credentials is modeled like an insider even though not an employee.

Correct answer: B — Enforce 802.1X port-based authentication on access switches and shut down unused ports

• A. A shorter lease only changes how quickly an address expires. The rogue laptop can simply request a new lease and stay connected.
• B. 802.1X requires a device to authenticate before the switch port passes traffic, and disabling idle ports removes the open jack altogether. Together they stop unauthorized wired access.
• C. WPA3 protects wireless associations. The auditor connected by cable, so wireless encryption has no effect on this wall jack.
• D. Host-based IDS logging is detective and sits on the servers. The rogue client is still granted network access instead of being blocked at the port.

Correct answer: D — A program copies input into a fixed-length buffer without verifying its size, overwriting adjacent memory including the return address

• A. Checking permissions and then opening the file later is the time-of-check to time-of-use race condition, a timing flaw rather than a memory-bounds flaw.
• B. Concatenating filenames into paths enables directory traversal, an input-validation weakness unrelated to overrunning a memory buffer.
• C. Plaintext secrets readable across processes describe a data-exposure weakness, not corruption of memory beyond a buffer's boundary.
• D. Copying unchecked input into a fixed-size buffer is the defining cause of a buffer overflow. The excess data overwrites neighbouring memory such as the saved return address, letting an attacker redirect execution.

Correct answer: B — Migrate to a slow, salted password hash such as bcrypt or Argon2 and require users to reset their passwords

• A. Encrypting with a key stored beside the application is weak, because anyone who reaches the server can recover the key and decrypt everything. Passwords should be hashed, not reversibly encrypted.
• B. A deliberately slow, salted password hash defeats precomputed tables and makes brute force expensive per account. Forcing resets is needed because the old digests are already compromised.
• C. Unsalted SHA-256 still allows rainbow table and bulk lookup attacks, and the speed of the algorithm favors the attacker. It is only a marginal improvement over MD5.
• D. Truncating digests increases collisions and does not stop offline guessing of the shortened values. It also leaves the same unsalted weakness in place.

Correct answer: A — It can block or terminate a malicious process or connection on the endpoint in real time, not just raise an alert

• A. The defining feature of a HIPS is active prevention: it takes action on the host such as stopping a process or dropping traffic. A HIDS only monitors and reports.
• B. Reading mirrored perimeter traffic describes a network-based sensor, not a host-based product. A HIPS runs on the endpoint itself.
• C. File encryption is a data-protection control and does not detect or block malicious behaviour. Intrusion prevention is behavioural, not cryptographic.
• D. That is an application allow list. A HIPS evaluates behaviour and signatures of running activity rather than gating launches by an approved list.

Correct answer: D — Worm, because it replicates itself across hosts by exploiting a vulnerable network service

• A. Incorrect. A trojan depends on a user running a program that appears legitimate, yet no user interaction occurred in this outbreak.
• B. Incorrect. Spyware aims at covert data collection and does not scan across the network for other victims at high volume.
• C. Incorrect. Bloatware is unwanted software that comes with the standard image, which would not scan port 445 on peer hosts or spread.
• D. Correct. A worm is self-replicating and spreads without user action, here by scanning and exploiting SMB on port 445, which causes the CPU and bandwidth saturation.

Correct answer: D — Run static analysis on the templates in the CI pipeline and require peer-reviewed pull requests, so insecure settings are rejected before deployment.

• A. Incorrect. Removing version control destroys change history and rollback ability. Secrets belong in a vault, not in templates, and scanning after deployment is reactive.
• B. Incorrect. Unrestricted write access removes review and auditability, which are the main security benefits of keeping infrastructure definitions in controlled code.
• C. Incorrect. Manual console edits create configuration drift away from the templates and are detected only after the exposure already exists in production.
• D. Correct. IaC makes configuration reviewable code, so policy-as-code scanners and pull-request approval can stop insecure rules and also give repeatable, auditable deployments.

Correct answer: C — An expanded attack surface of many exposed APIs, requiring an API gateway, service-to-service authentication, and encrypted internal traffic.

• A. Incorrect. A single codebase and all-or-nothing deployment describe a monolith. Microservices are deployed independently and tend to isolate failures.
• B. Incorrect. Independent scaling is a core benefit of microservices. Each service can be replicated according to its own load.
• C. Correct. Every microservice endpoint is a potential entry point, so teams need gateway enforcement, mutual authentication such as mTLS, and authorization between services.
• D. Incorrect. Microservices run as separate processes or containers, not in one shared memory space. That description fits a monolith or a poorly isolated host.

Correct answer: B — In a screened subnet between the external and internal firewalls, with rules limiting traffic into the internal zone

• A. Placing an internet-facing server among workstations gives an attacker a foothold inside the trusted network. A host firewall alone does not provide network-level isolation.
• B. A screened subnet isolates internet-facing systems in their own security zone. If the web server is compromised, the internal firewall still restricts what it can reach.
• C. Removing all filtering exposes the host's entire attack surface to the internet. Eliminating inspection latency is not a valid reason for skipping a boundary control.
• D. The management zone holds the most sensitive administrative systems and should not host a publicly reachable server. Compromise there could give an attacker administrative pivot points.

Correct answer: C — Contract a hot site with duplicate hardware and continuously replicated data so operations resume within minutes of a declared disaster.

• A. Incorrect: a cold site has only utilities and space, so procuring hardware and restoring media takes days or weeks, far beyond a 15-minute recovery time objective.
• B. Incorrect: a warm site has hardware but stale data from the last backup, so recovery takes hours to a day and loses far more than a few seconds of data.
• C. Correct: a hot site is a fully equipped, continuously synchronized duplicate facility. It is the only site type that supports minutes-level recovery with near-zero data loss.
• D. Incorrect: a reciprocal agreement offers no pre-staged data or configuration, so capacity is uncertain and recovery would be slow and unpredictable.

Correct answer: C — Calculate the SHA-256 digest of the downloaded file and compare it with the value the vendor published on its HTTPS site

• A. Encrypting with a local key produces output that depends on that key and says nothing about the original file's integrity. File size alone cannot detect tampering that preserves length.
• B. Sandbox behavior monitoring may reveal malicious activity, but it is not an integrity check. A subtly modified image could behave normally during observation.
• C. Hashing produces a fixed-length digest that changes if even one bit of the file changes. Matching the locally computed SHA-256 against the vendor's published value shows that the file was not modified.
• D. A DLP scanner looks for sensitive data patterns leaving or sitting in the environment. It does not compare a file against a known-good reference value.

Correct answer: C — Detonate it in an isolated sandbox VM with no production network access and record the behavior it produces.

• A. Running unknown malware on a real user workstation risks infection, and monitor-only EDR will not contain it. A production endpoint is not an isolated test environment.
• B. A domain-joined server in the production VLAN can reach internal resources, so malware could spread or steal credentials before a snapshot is restored. A snapshot does not contain network activity.
• C. This is correct because a sandbox isolates execution from production, and analysts can safely record files, registry changes, and network calls. It is the standard way to analyze suspicious code.
• D. A new or targeted sample often has no feed entry, so a missing match proves nothing. Hash lookup does not reveal the behavior the team wants to observe.

Correct answer: A — Record a named individual or team as owner of every asset in the register, accountable for its classification, patching, and eventual decommissioning.

• A. Correct. Ownership gives each asset an accountable party, so unpatched or abandoned systems have someone responsible for remediating or retiring them.
• B. Incorrect. More frequent scanning surfaces findings faster, but with no assigned owner nobody is accountable for acting on those reports.
• C. Incorrect. Consolidating the subscription improves visibility but still leaves no person responsible for each machine's lifecycle or patch status.
• D. Incorrect. Retention periods govern how long data is kept, not who is accountable for the system, and would keep forgotten machines' data around longer.

Correct answer: D — Tune the rule to alert only after several failures from one source within a short window, then recheck false positives

• A. Incorrect. Disabling the rule creates a blind spot for password guessing and credential stuffing; the problem is the threshold, not the detection goal.
• B. Incorrect. Scaling manual triage does not fix the noisy rule and still buries true positives among thousands of meaningless alerts.
• C. Incorrect. Reducing logging removes evidence needed for investigations and compliance, and it does not correct the logic of the alerting rule.
• D. Correct. Alert tuning raises the threshold and adds context so benign typos stop triggering alerts while real brute-force activity still fires, reducing alert fatigue.

Correct answer: D — False negative

• A. A true positive would mean the scanner reported a flaw that really exists, but here it reported nothing at all.
• B. A true negative means no flaw was reported and none exists, which contradicts the successful exploitation of the SMB flaw.
• C. A false positive is a reported finding that turns out not to exist; here the problem is a missing finding, not a bogus one.
• D. A false negative is a real vulnerability that the scanner failed to report, which is exactly what the tester's SMB exploit demonstrated.

Correct answer: A — Fix the payment gateway first, since exposure, asset criticality, and active exploitation raise its real risk

• A. Prioritization combines the base score with environmental variables such as exposure, asset value, and exploit activity, so the internet-facing gateway carries more actual risk.
• B. The base score measures intrinsic severity only; using it alone ignores that the lab server is isolated and holds no sensitive data.
• C. No rule makes a score above 9.0 an automatic first priority; organizations weigh context and risk tolerance when ordering fixes.
• D. The base score does not include a specific asset's exposure or business value; those come from environmental variables, so order does matter.

Correct answer: C — Run automated static analysis and policy tests on every commit in the CI pipeline, and fail the build when a template violates the security baseline.

• A. Incorrect. A monthly review happens after deployment and depends on people noticing risk, so the exposed database would already have been live for weeks.
• B. Incorrect. Manual approval plus a weekly window slows delivery, and it still relies on a reviewer spotting the issue by eye rather than testing it consistently.
• C. Correct. Continuous integration and testing runs the same checks on every change, blocking a failing build before release without adding a manual bottleneck.
• D. Incorrect. An annual penetration test is far too infrequent and detective only; it cannot prevent a flawed template from reaching production.

Correct answers: B, E — Move SNMP polling from v2c to SNMPv3 using the authPriv level so credentials and payloads are authenticated and encrypted.; Replace Telnet with SSH on TCP port 22 for administrative sessions to every router, switch, and firewall in the network.

• A. Incorrect. Moving to a nonstandard port and adding an ACL limits who connects but the session and credentials still travel unencrypted.
• B. Correct. SNMPv3 with authPriv provides authentication and encryption, unlike v2c community strings that travel in plaintext.
• C. Incorrect. TCP provides reliable delivery rather than confidentiality, and community strings would still be sent in cleartext.
• D. Incorrect. Longer strings are still readable on the wire, and leaving Telnet enabled keeps administrator credentials exposed on the internal network.
• E. Correct. SSH encrypts the session and authenticates the server, which removes the cleartext credentials Telnet exposes.

Correct answers: B, D — A smart card inserted into the reader together with a PIN typed at the keypad; A hardware FIDO2 security key touched after the user types the account password

• A. A PIN and a security question answer are both something you know. Two knowledge items are still a single factor, so this is not multifactor.
• B. Correct. The smart card is something you have and the PIN is something you know, so two distinct factor categories are used.
• C. A fingerprint and a retina scan are both something you are. Combining two biometrics stays within a single factor category.
• D. Correct. The security key is something you have and the password is something you know, which gives two distinct factor categories.
• E. A password and a passphrase are both something you know. Entering them on separate screens does not add a different factor category.

Correct answer: A — Identifying, collecting, and producing electronically stored information in response to a legal or regulatory request or a lawsuit.

• A. E-discovery is the legal process of identifying, collecting, and producing electronically stored information for litigation or regulatory requests. It is closely tied to legal hold and preservation.
• B. Finding unmanaged assets and unpatched systems is asset discovery and vulnerability management. It is a preventive security activity, not a legal process.
• C. Looking for undetected adversary behavior in telemetry is threat hunting. It is proactive detection work, not legal production of data.
• D. Reconstructing the timeline to find how the compromise began is root cause analysis. It supports remediation rather than legal production of information.

Correct answer: A — A full packet capture of the session, which can be reassembled into the FTP control and data streams in a protocol analyzer

• A. Correct. Packet captures retain the actual payload, so the FTP USER, PASS, STOR, and RETR commands and transferred files can be reassembled and read when the protocol is unencrypted.
• B. Incorrect. Firewall entries confirm the connection was permitted but record no commands, file names, or credentials from inside the session.
• C. Incorrect. NetFlow only summarizes conversation metadata such as addresses, ports, and byte counts. Tuning its timeouts never adds payload content.
• D. Incorrect. A scan describes a service's weaknesses at scan time and cannot show what data actually moved during last night's transfer.

Correct answer: D — Have the procurement lead disclose the relationship and recuse from evaluating and awarding, with the committee recording the disclosure

• A. Waiting until after signing to record the relationship leaves the selection tainted. A conflict of interest must be handled before the decision, not documented afterward.
• B. An NDA would hide the relationship rather than manage it. Concealing a conflict of interest increases risk and undermines the fairness of the selection.
• C. Removing questionnaire scoring distorts the evaluation and does not address the conflict. The issue is the evaluator's personal interest, not the type of evidence collected.
• D. Disclosure and recusal is correct because it removes the conflicted person from the decision and creates an auditable record. This protects the integrity of the vendor selection process.

Correct answer: B — Send every vendor the same standardized security questionnaire and score the responses against a single set of criteria prepared in advance

• A. Unannounced testing of production systems without agreed rules of engagement is risky and usually unauthorized. It is also impractical to perform across forty vendors at the screening stage.
• B. A standardized questionnaire is correct because identical questions produce comparable answers that can be scored consistently. It is a low-cost screening step before deeper verification.
• C. MSA templates describe legal and commercial terms. They reveal little about how each vendor handles encryption, incident response, or subcontractors.
• D. An SLA covers service performance commitments and is negotiated after selection. Doing it first gathers no information about security controls.

Correct answer: D — A documented exception granting time-bound permission to deviate from the standard, with compensating controls and a review date

• A. Transfer would move the consequences to another party, and nothing in the approval does that. The organization still carries the risk of the unpatched controller.
• B. Avoidance would require retiring or not using the controller. Isolating it only reduces exposure, and the device remains in production use.
• C. An exemption excuses an asset from a requirement outright. This approval is temporary, conditional on compensating controls, and scheduled for review, so it is not permanent.
• D. Correct. An exception is a formally approved, time-limited deviation from a standard that is accepted with compensating controls and revisited at a review date.

Correct answer: C — The VP of Sales is the data owner approving access and classification, and the DBA team acts as custodian

• A. Administrative rights do not confer ownership. Technical staff implement controls, while accountability for the data rests with a business owner such as the VP of Sales.
• B. A CISO oversees the program, but custodian is a hands-on role performing safeguards. A business executive is not a processor, which is an external party handling data for a controller.
• C. The owner is the accountable business executive who decides classification and access. Custodians carry out technical safeguards like backups, patching, and permission changes.
• D. Customers are data subjects and do not approve internal access. Controller is a privacy role about purposes of processing, not a name for database administrators.

Correct answer: C — A partially known environment, because the testers receive limited details and access similar to an informed insider

• A. A known environment gives testers full details such as source code, architecture and privileged credentials. Here administrator credentials and source code are withheld.
• B. An unknown environment gives testers essentially no information. A user account, IP ranges and a diagram are well beyond that.
• C. A partially known environment gives testers some information, such as a low-privilege account and a diagram, to simulate an attacker with limited inside knowledge.
• D. Defensive describes the focus of the exercise, not how much information the testers are given. The amount of disclosed detail is what defines the environment type.

Correct answer: D — A known-environment test, because source code, architecture diagrams and credentials let testers go straight to the logic

• A. An unknown-environment test spends much of the window on discovery and gives less coverage of internal logic. It suits realism goals rather than depth in a short window.
• B. Passive reconnaissance gathers publicly available information only. It cannot reveal flaws in internal application logic.
• C. A physical test targets buildings and access controls. It does not examine the application's internal logic.
• D. A known-environment test gives the testers full information, including source code and credentials, so no time is lost on discovery. This yields the deepest coverage in limited time.

Correct answer: B — The data owner, typically a senior business leader such as the HR director, who is accountable for classifying the data and approving who may use it

• A. Incorrect: the administrator is a custodian who implements controls under the owner's direction. Operating the platform does not confer authority over classification or access decisions.
• B. Correct: the data owner is the accountable role that decides classification, acceptable use, and access. Custodians and processors then implement those decisions.
• C. Incorrect: data subjects hold privacy rights such as access and correction but do not approve internal access. Business accountability rests with the data owner.
• D. Incorrect: a processor acts on the controller's instructions and does not set access policy. Responsibility for those decisions stays with the organization's data owner.

Correct answer: D — Train staff to use the approved password manager with unique generated passphrases, plus MFA on accounts

• A. Forced frequent rotation pushes users toward predictable patterns such as incrementing a number. It does not address reuse and weakens real password strength.
• B. A shared team login removes individual accountability and spreads one credential among many people. It also makes offboarding and auditing harder.
• C. A paper notebook in an unlocked drawer is easily found by anyone with physical access. It trades one weak storage method for another.
• D. A password manager makes unique, long passwords practical, and MFA limits damage when one credential leaks. This directly targets reuse and insecure storage.