Question bank
CompTIA Security+
41 CompTIA Security+ questions with the correct answer and a written explanation, organised across 5 exam domains.
- 41 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
General Security Concepts
5 questions in this domain
- Question 1Single Choice
Which security control type is specifically designed to discourage potential attackers from attempting a violation?
- APreventative
- BDetective
- CDeterrentCorrect answer
- DCorrective
Why this is the answer
Deterrent controls, such as warning banners or surveillance cameras, are designed to discourage individuals from attempting attacks or policy violations.
- Question 2Multiple Select
Which of the following are considered components of the AAA framework?
- AAuthenticationCorrect answer
- BAuthorizationCorrect answer
- CAccountingCorrect answer
- DAvailability
Why this is the answer
The AAA framework consists of Authentication (verifying identity), Authorization (determining access rights), and Accounting (tracking actions).
- Question 3Interactive
Review the following configuration and identify which security principle is being violated.
- AConfidentiality
- BIntegrity
- CAvailability
- DLeast PrivilegeCorrect answer
Why this is the answer
The code shows a user account with 'admin_all' permissions being used for a simple 'read_only' task, violating the principle of least privilege.
- Question 4Single Choice
What is the primary purpose of a hashing algorithm in cryptography?
- AConfidentiality
- BIntegrityCorrect answer
- CNon-repudiation
- DAvailability
Why this is the answer
Hashing is a one-way function used to ensure integrity by verifying that data has not been altered.
- Question 5Multiple Select
Which of the following are examples of asymmetric encryption algorithms?
- AAES
- BRSACorrect answer
- CECCCorrect answer
- D3DES
Why this is the answer
RSA and ECC are asymmetric algorithms, whereas AES and 3DES are symmetric algorithms.
Security Architecture
8 questions in this domain
- Question 6Single Choice
Which security model is based on the principle of 'never trust, always verify'?
- ADefense in Depth
- BZero Trust ArchitectureCorrect answer
- CPerimeter-based Security
- DImplicit Trust Model
Why this is the answer
Zero Trust Architecture (ZTA) is defined by the principle of 'never trust, always verify,' eliminating implicit trust regardless of network location.
- Question 7Multiple Select
Which of the following are components of a Zero Trust Architecture?
- AIdentity Provider (IdP) integrationCorrect answer
- BMicrosegmentationCorrect answer
- CImplicit trust zones
- DPerimeter-only firewalls
Why this is the answer
Zero Trust includes identity provider integration, microsegmentation, device health checks, and least privilege access policies.
- Question 8Interactive
Review the following deployment model configuration and identify the correct ownership type.
- ABYOD
- BCOBOCorrect answer
- CCYOD
- DCOPE
Why this is the answer
COBO (Corporate-Owned, Business-Only) is characterized by organization ownership and strict lockdown for business use only.
- Question 9Single Choice
What is the primary goal of network segmentation?
- ATo increase network speed
- BTo limit lateral movementCorrect answer
- CTo eliminate the need for firewalls
- DTo provide universal access
Why this is the answer
Network segmentation aims to divide networks into zones to limit the ability of an attacker to move laterally if a host is compromised.
- Question 10Multiple Select
Which of the following are considered cloud-specific security tools?
- ACloud Security Posture Management (CSPM)Correct answer
- BCloud Workload Protection Platforms (CWPP)Correct answer
- CHardware Security Modules (HSM)
- DPhysical perimeter fences
Why this is the answer
CSPM and CWPP are specific to cloud security architecture for managing configurations and workloads.
- Question 11Interactive
Examine the testing methodology described in the code and identify the type.
- ASASTCorrect answer
- BDAST
- CFuzzing
- DPenetration Testing
Why this is the answer
SAST (Static Application Security Testing) is a white-box method that analyzes source code without executing the application.
- Question 12Single Choice
Which metric defines the maximum acceptable data loss in time?
- ARTO
- BRPOCorrect answer
- CMTBF
- DSLA
Why this is the answer
Recovery Point Objective (RPO) determines the maximum acceptable data loss measured in time.
- Question 13Multiple Select
Which of the following are types of disaster recovery sites?
- AHot siteCorrect answer
- BWarm siteCorrect answer
- CCold siteCorrect answer
- DLive site
Why this is the answer
Disaster recovery sites are classified as hot, warm, or cold based on their level of readiness and synchronization.
Security Operations
11 questions in this domain
- Question 14Single Choice
Which phase of the incident response lifecycle involves isolating affected systems to prevent the spread of malware?
- APreparation
- BDetection and Analysis
- CContainmentCorrect answer
- DEradication
Why this is the answer
Containment is the phase dedicated to isolating affected systems to prevent the lateral spread of malware or attackers.
- Question 15Multiple Select
Which of the following are considered highly volatile data types in digital forensics?
- ARAMCorrect answer
- BCPU CacheCorrect answer
- CHard Drive
- DUSB Media
Why this is the answer
RAM and CPU cache are highly volatile and can be lost in milliseconds when power is removed, unlike persistent storage like hard drives.
- Question 16Interactive
Review the following sequence of forensic actions and identify which step is missing from the standard acquisition process.
- ACapture RAM
- BCreate Forensic Image
- CVerify Hash IntegrityCorrect answer
- DDocument Chain of Custody
Why this is the answer
After creating an image, a forensic examiner must calculate and verify hashes to ensure the integrity of the copy.
- Question 17Single Choice
What is the primary purpose of a SIEM system in a Security Operations Center?
- AAutomated response execution
- BLog aggregation and correlationCorrect answer
- CEndpoint malware prevention
- DVulnerability scanning
Why this is the answer
SIEM systems perform aggregation, normalization, and correlation to transform raw logs into actionable security intelligence.
- Question 18Multiple Select
Which of the following are key responsibilities of a SOAR platform?
- AExecuting automated playbooksCorrect answer
- BIntegrating disparate security toolsCorrect answer
- CStoring raw log files for compliance
- DPerforming initial asset discovery
Why this is the answer
SOAR platforms focus on orchestration (integrating tools) and automation (executing playbooks) to respond to alerts.
- Question 19Interactive
Based on the provided configuration, which security tool is being described?
- ASIEM
- BEDRCorrect answer
- CHIPS
- DFirewall
Why this is the answer
EDR is characterized by continuous behavioral monitoring and telemetry recording on endpoints to detect advanced threats.
- Question 20Single Choice
What is the main difference between a playbook and a runbook?
- APlaybooks are manual; runbooks are automated
- BPlaybooks are automated; runbooks are manualCorrect answer
- CPlaybooks are for networks; runbooks are for endpoints
- DPlaybooks are for SIEM; runbooks are for SOAR
Why this is the answer
Playbooks are automated, machine-executable workflows, whereas runbooks are manual procedural documents for analysts.
- Question 21Multiple Select
Which of the following are essential components of maintaining a proper chain of custody?
- ATamper-evident packagingCorrect answer
- BChronological documentationCorrect answer
- CImmediate deletion of original files
- DUsing software write blockers only
Why this is the answer
Chain of custody requires chronological records of handling and secure, tamper-evident packaging to ensure evidence integrity.
- Question 22Interactive
Examine the following vulnerability management steps and identify the correct order.
- AScan -> Patch -> VerifyCorrect answer
- BPatch -> Scan -> Verify
- CVerify -> Scan -> Patch
- DScan -> Verify -> Patch
Why this is the answer
The lifecycle involves discovering/scanning, remediating (patching), and then performing a verification scan to ensure the fix worked.
- Question 23Single Choice
What is the primary purpose of using a hardware write blocker during forensics?
- ASpeed up data transfer
- BPrevent any write operations to the driveCorrect answer
- CEncrypt the evidence automatically
- DDelete malicious files automatically
Why this is the answer
Hardware write blockers prevent any write operations at the physical layer, ensuring the original media remains unaltered.
- Question 24Multiple Select
Which of the following are common causes of 'alert fatigue' in a SOC?
- AThresholds set too lowCorrect answer
- BFrequent false positivesCorrect answer
- CEffective alert tuning
- DHigh-quality threat intelligence
Why this is the answer
Alert fatigue is caused by excessive noise, often due to thresholds being set too low or a high rate of false positives.
Security Program Management and Oversight
8 questions in this domain
- Question 25Single Choice
Which risk response strategy involves shifting the financial burden of a potential loss to a third party?
- AMitigation
- BAvoidance
- CTransferenceCorrect answer
- DAcceptance
Why this is the answer
Transference involves shifting the financial consequences of a risk to a third party, such as through insurance.
- Question 26Multiple Select
Which of the following are considered mandatory organizational security documents?
- APoliciesCorrect answer
- BStandardsCorrect answer
- CGuidelines
- DProceduresCorrect answer
Why this is the answer
Policies, standards, and procedures are mandatory. Guidelines are recommended but non-mandatory.
- Question 27Interactive
Match the recovery metric to its correct definition based on the provided logic.
- ARTO = Downtime durationCorrect answer
- BRPO = Data loss amountCorrect answer
- CMTTR = System reliability
- DMTBF = Repair time
Why this is the answer
RTO is the time to restore operations; RPO is the maximum acceptable data loss measured in time.
- Question 28Single Choice
What is the primary purpose of a Business Impact Analysis (BIA)?
- AIdentify vulnerabilities
- BDetermine critical functionsCorrect answer
- CPerform penetration tests
- DWrite security policies
Why this is the answer
BIA evaluates operational and financial consequences to identify critical functions and recovery metrics.
- Question 29Multiple Select
Which factors are used in a quantitative risk assessment?
- ASingle Loss Expectancy (SLE)Correct answer
- BAnnual Rate of Occurrence (ARO)Correct answer
- CExpert intuition
- DSubjective scales
Why this is the answer
Quantitative assessment uses SLE and ARO to calculate ALE. Intuition and scales are qualitative.
- Question 30Interactive
Analyze the risk calculation logic and select the correct formula for ALE.
- AALE = SLE * AROCorrect answer
- BALE = SLE / ARO
- CALE = SLE + ARO
- DALE = ARO - SLE
Why this is the answer
Annualized Loss Expectancy (ALE) is calculated by multiplying Single Loss Expectancy (SLE) by the Annual Rate of Occurrence (ARO).
- Question 31Single Choice
Which document provides step-by-step instructions for executing technical tasks?
- APolicy
- BStandard
- CProcedureCorrect answer
- DGuideline
Why this is the answer
Procedures are detailed, step-by-step instructions for executing technical or administrative tasks.
- Question 32Multiple Select
Which of the following are examples of regulatory compliance?
- AHIPAACorrect answer
- BGDPRCorrect answer
- CPCI-DSS
- DNIST CSF
Why this is the answer
HIPAA and GDPR are regulatory (legally mandated). PCI-DSS and NIST CSF are industry frameworks.
Threats, Vulnerabilities, and Mitigations
9 questions in this domain
- Question 33Single Choice
Which term describes the total sum of all vulnerabilities, entry points, and assets exposed to potential exploitation?
- AAttack vector
- BAttack surfaceCorrect answer
- CThreat actor
- DVulnerability assessment
Why this is the answer
The attack surface represents the total sum of vulnerabilities, entry points, and assets exposed to potential exploitation.
- Question 34Multiple Select
Which of the following are considered types of threat actors?
- ANation-statesCorrect answer
- BInsider threatsCorrect answer
- CAttack vectors
- DMotivations
Why this is the answer
CompTIA categorizes actors like nation-states and insider threats by skill, resources, and intent.
- Question 35Interactive
Analyze the following code snippet and identify the specific application attack being performed.
- ASQL injectionCorrect answer
- BCross-site scripting
- CBuffer overflow
- DDLL hijacking
Why this is the answer
The code shows the manipulation of a backend query through unsanitized input, which is SQL injection.
- Question 36Single Choice
What is the primary difference between a virus and a worm?
- AA worm requires a host file
- BA virus self-propagates without user action
- CA worm self-propagates without user interventionCorrect answer
- DA virus is always more destructive
Why this is the answer
A virus requires a host file and user action, whereas a worm is standalone and self-propagates.
- Question 37Multiple Select
Which of the following are examples of social engineering attacks?
- APhishingCorrect answer
- BVishingCorrect answer
- CSQL injection
- DDDoS
Why this is the answer
Phishing and vishing are social engineering attacks that manipulate human psychology.
- Question 38Interactive
Examine the following configuration and identify the missing security control.
- AInput validationCorrect answer
- BNetwork segmentation
- CLeast privilege
- DPatch management
Why this is the answer
The code accepts raw user input directly into a command, indicating a lack of input validation.
- Question 39Single Choice
Which term describes an attacker setting up a rogue access point with a duplicate SSID?
- AJamming
- BDeauthentication
- CEvil twinCorrect answer
- DIV attack
Why this is the answer
An evil twin is a rogue access point that uses a duplicate SSID to trick users into connecting.
- Question 40Multiple Select
Which of the following are considered administrative controls?
- ASecurity awareness trainingCorrect answer
- BUser trainingCorrect answer
- CFirewall rules
- DEncryption algorithms
Why this is the answer
Training and awareness programs are administrative controls used to mitigate human-centric risks.
- Question 41Interactive
Analyze the following network log and identify the type of attack occurring.
- AARP poisoningCorrect answer
- BDNS poisoning
- CVLAN hopping
- DMAC spoofing
Why this is the answer
The log shows conflicting MAC addresses for the same IP, indicating ARP poisoning.
Frequently asked questions
Everything about the CompTIA Security+ question bank and how to use it.