Question bank
CompTIA SecurityX
42 CompTIA SecurityX questions with the correct answer and a written explanation, organised across 5 exam domains.
- 42 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
General Security Concepts
5 questions in this domain
- Question 1Single Choice
Which security principle ensures that users and processes are granted only the minimum permissions necessary to perform their tasks?
- APrinciple of least privilegeCorrect answer
- BDefense in depth
- CSeparation of duties
- DRisk acceptance
Why this is the answer
Least privilege limits permissions to the minimum required for assigned tasks, reducing the attack surface and limiting damage from compromised identities.
- Question 2Multiple Select
Which options accurately describe elements of a defense-in-depth security architecture within a modern enterprise environment?
- AMultiple heterogeneous security layersCorrect answer
- BRedundant firewalls from the same vendor
- CLayered network, host, and application controlsCorrect answer
- DImplicit trust inside the network
Why this is the answer
Defense-in-depth uses diverse, layered controls so the failure of any one control does not lead to total compromise; single-vendor redundancy and implicit trust are insufficient.
- Question 3Interactive
Review the code block. Which fundamental security concept is illustrated by the access policy shown?
- ALeast privilegeCorrect answer
- BCryptographic non-repudiation
- CSystem availability
- DDefense in depth
Why this is the answer
The policy permits only needed actions on one resource during a change window, reflecting least privilege and just-in-time access.
- Question 4Single Choice
In a Zero Trust architecture, which component evaluates access requests against enterprise policy and makes the decision to grant access?
- APolicy Decision Point (PDP)Correct answer
- BPolicy Enforcement Point (PEP)
- CPolicy Administrator (PA)
- DIdentity Provider (IdP)
Why this is the answer
The PDP evaluates policy and contextual signals to decide whether access is granted, while the PEP enforces the decision.
- Question 5Multiple Select
Which statements correctly align with the core principles of a Zero Trust architecture in an enterprise environment?
- ANever trust, always verifyCorrect answer
- BGrant implicit trust based on network location
- CContinuously validate session and device healthCorrect answer
- DRely primarily on perimeter defenses
Why this is the answer
Zero trust eliminates implicit trust, continuously validates access and device posture, and focuses on identity-driven security rather than perimeter protection.
Security Architecture
8 questions in this domain
- Question 6Single Choice
Which statement best defines network segmentation?
- ADividing infrastructure into smaller isolated domainsCorrect answer
- BApplying software-defined boundaries to workloads
- CReplacing firewalls with identity-based access
- DEncrypting all traffic with mutual TLS
Why this is the answer
Network segmentation divides a broad IT infrastructure into smaller, isolated domains using VLANs, subnets, and firewalls to restrict lateral movement.
- Question 7Multiple Select
Which two technologies are commonly associated with Layer 2 segmentation? (Select all that apply.)
- AVLANsCorrect answer
- BVXLANCorrect answer
- CNext-Generation Firewall (NGFW)
- DTrusted Platform Module (TPM)
Why this is the answer
VLANs segment Layer 2 networks with physical switches, while VXLAN encapsulates Layer 2 frames in Layer 4 UDP packets for virtualization.
- Question 8Interactive
Review the provided network configuration. What type of segmentation does it describe?
- ALayer 2 VLAN segmentationCorrect answer
- BWorkload micro-segmentation
- CSoftware-defined perimeter
- DHypervisor-level filtering
Why this is the answer
The code defines VLANs, which operate at Layer 2 for broad macro-segmentation rather than workload-level micro-segmentation.
- Question 9Single Choice
What does East-West traffic refer to in a data center?
- ATraffic moving laterally within the internal networkCorrect answer
- BTraffic flowing between the data center and external networks
- CTraffic generated by cloud service providers
- DTraffic between management interfaces only
Why this is the answer
East-West traffic moves laterally within the internal network, while North-South traffic flows between the data center and external networks.
- Question 10Multiple Select
Which principles are enforced by micro-segmentation in a Zero Trust Architecture? (Select all that apply.)
- ALeast-privilege access to authorized segmentsCorrect answer
- BContinuous verification of sessionsCorrect answer
- CImplicit trust after authentication
- DAccess based only on physical switch ports
Why this is the answer
ZTA mandates continuous verification, and micro-segmentation enforces least-privilege access only to authorized micro-segments.
- Question 11Interactive
Based on the service model listing, which control is associated with SaaS?
- ACloud Access Security Broker (CASB)Correct answer
- BSecurity groups
- CSecret management
- DHost hardening
Why this is the answer
In the model, SaaS is mapped to CASB, which provides governance, DLP, and shadow IT discovery across cloud services.
- Question 12Single Choice
In a PaaS deployment, who is responsible for managing application code and data?
- ACustomer tenantCorrect answer
- BCloud service provider
- CThird-party auditor
- DNetwork carrier
Why this is the answer
In PaaS, the customer manages application code and data, while the provider manages the operating system, runtime, and infrastructure.
- Question 13Multiple Select
Which practices apply to non-human identity lifecycle management? (Select all that apply.)
- ARotating credentialsCorrect answer
- BMonitoring service accountsCorrect answer
- CUsing static shared passwords
- DIgnoring workload identities
Why this is the answer
Non-human identity lifecycle management includes securing, rotating, and monitoring service accounts, API keys, secrets, and workload identities.
Security Operations
12 questions in this domain
- Question 14Single Choice
What does the incident response lifecycle represent in the SecurityX framework?
- AStrategic framework for detection, containment, eradication, and recoveryCorrect answer
- BTier-one SOC ticket triage process
- CCompliance report of final findings
- DManual antivirus signature updates
Why this is the answer
The SecurityX lifecycle is an enterprise-wide strategic framework covering detection, containment, eradication, and post-incident recovery, not just triage or reporting.
- Question 15Multiple Select
Which activities are included in the SecurityX incident response lifecycle? (Select all that apply.)
- APrecision containment to halt lateral movementCorrect answer
- BForensic preservation and chain of custodyCorrect answer
- CCold log archival for one year
- DContinuous improvement from root cause analysisCorrect answer
Why this is the answer
Precision containment, forensic preservation, and post-incident improvement are explicit lifecycle components; cold log archival is not listed as a lifecycle phase.
- Question 16Interactive
What incident response phase is performed by the actions in the code block?
- AContainment and forensic preservationCorrect answer
- BEradication and system hardening
- CPost-incident continuous improvement
- DThreat intelligence aggregation
Why this is the answer
The actions isolate affected pods while preserving memory and revoking credentials, balancing containment with forensic integrity.
- Question 17Single Choice
What is the main purpose of SOAR in enterprise security operations?
- ACoordinating tools and automating response workflowsCorrect answer
- BReplacing security analysts entirely
- CStoring logs for compliance audits
- DGenerating weekly executive reports
Why this is the answer
SOAR orchestrates multi-tool workflows, automates response actions, reduces MTTC, and supports analyst efforts rather than replacing them.
- Question 18Multiple Select
Which capabilities are part of advanced SIEM and UEBA integration in enterprise monitoring? (Select all that apply.)
- AMachine learning baseline profilingCorrect answer
- BHigh-fidelity telemetry correlationCorrect answer
- CPassive alert triage with default rules
- DThreat intelligence feed enrichmentCorrect answer
Why this is the answer
UEBA, normalized telemetry for correlation, and threat intelligence enrichment are advanced SIEM capabilities; passive triage is the opposite.
- Question 19Interactive
Which security activity is shown in the code block?
- AHypothesis-driven threat huntingCorrect answer
- BCompliance-based log retention
- CSignature-based malware scanning
- DAnnual disaster recovery testing
Why this is the answer
The workflow loads intel-driven hypotheses and investigates baseline deviations, which is core hypothesis-driven threat hunting.
- Question 20Single Choice
What does the order of volatility require in digital forensics?
- ACapture volatile memory before non-volatile storageCorrect answer
- BImage the hard drive before RAM
- CDelete volatile data first
- DCapture network traffic after disk imaging
Why this is the answer
Order of volatility prioritizes ephemeral data like RAM before non-volatile media to avoid losing critical artifacts.
- Question 21Multiple Select
Which practices help preserve forensic evidence integrity? (Select all that apply.)
- AGenerate cryptographic hashes after acquisitionCorrect answer
- BDocument chain of custodyCorrect answer
- CReboot system before imaging
- DUse unverified tools that alter metadata
Why this is the answer
Hashing and chain-of-custody documentation preserve integrity; rebooting can destroy volatile evidence, and unverified tools can alter artifacts.
- Question 22Interactive
What forensic process is represented by the code block?
- AChain of custody managementCorrect answer
- BNetwork packet capture
- CRemovable media sanitization
- DThreat intelligence pivoting
Why this is the answer
Hashing, access logging, secure storage, and signed transfers are all chain-of-custody controls designed to preserve admissibility.
- Question 23Single Choice
What is the purpose of a Business Impact Analysis (BIA) in BCDR planning?
- AIdentify critical functions and quantify outage lossesCorrect answer
- BRestore systems from backup
- CTest crisis communications
- DGenerate hashes for backup media
Why this is the answer
A BIA maps mission-critical functions, dependencies, and the financial and operational impact of extended outages.
- Question 24Multiple Select
Which metrics are used to define disaster recovery objectives? (Select all that apply.)
- ARecovery Time Objective (RTO)Correct answer
- BRecovery Point Objective (RPO)Correct answer
- CMean Time to Detect (MTTD)
- DAnnualized Loss Expectancy (ALE)
Why this is the answer
RTO defines maximum downtime and RPO defines acceptable data loss in time. MTTD and ALE are not BCDR recovery metrics.
- Question 25Interactive
Which BCDR strategy is shown in the code block?
- AGeographic redundancy and replicationCorrect answer
- BCold tape backup restoration
- CSingle-site server repair
- DManual workstation reimaging
Why this is the answer
Automated failover to a secondary region with global load balancing and key synchronization is geographic redundancy.
Security Program Management and Oversight
8 questions in this domain
- Question 26Single Choice
Which statement best defines risk assessment in enterprise security governance?
- AIdentifying, analyzing, and evaluating threats and vulnerabilities against critical business assets and strategic objectivesCorrect answer
- BInstalling security tools to eliminate all identified threats
- CPurchasing cyber insurance to transfer potential losses
- DDocumenting only compliance requirements for annual audits
Why this is the answer
Risk assessment is the structured process of identifying, analyzing, and evaluating threats and vulnerabilities in the context of business assets and objectives.
- Question 27Multiple Select
Which of the following are recognized risk treatment strategies in the Four Ts model? (Select all that apply.)
- ATreat/MitigateCorrect answer
- BTransferCorrect answer
- CTolerate/AcceptCorrect answer
- DDefer/Postpone
Why this is the answer
The Four Ts are Treat/Mitigate, Transfer, Tolerate/Accept, and Terminate/Avoid. Defer/Postpone is not one of the recognized treatment strategies.
- Question 28Interactive
Review the risk register excerpt in the code block. Which essential element is missing from this entry?
- ALifecycle statusCorrect answer
- BRisk owner
- CResidual risk score
- DRisk ID
Why this is the answer
A dynamic risk register must track lifecycle states such as open, in progress, or accepted. The entry is missing that lifecycle status.
- Question 29Single Choice
What is meant by risk appetite in enterprise security?
- AThe broad level of risk the organization is willing to accept in pursuit of strategic goalsCorrect answer
- BThe exact number of security incidents tolerated per month
- CThe total amount of cyber insurance coverage purchased
- DThe maximum time allowed to patch critical vulnerabilities
Why this is the answer
Risk appetite represents the organization's overall willingness to accept risk while pursuing its strategic objectives.
- Question 30Multiple Select
Which of the following elements should be tracked in a risk register? (Select all that apply.)
- ARisk ownerCorrect answer
- BResidual risk scoreCorrect answer
- CThreat vectorCorrect answer
- DEmployee performance rating
Why this is the answer
Risk registers track risk IDs, threat vectors, inherent and residual scores, treatment plans, and risk owners. Employee performance data is unrelated.
- Question 31Interactive
Use the values in the code block to calculate the Annual Loss Expectancy (ALE).
- A$10,000Correct answer
- B$2,500
- C$4,000
- D$100,000
Why this is the answer
ALE is calculated as SLE × ARO. With SLE of $2,500 and ARO of 4, the ALE is $10,000.
- Question 32Single Choice
Which statement best describes residual risk?
- AThe exposure remaining after security controls and treatment plans are appliedCorrect answer
- BThe risk present before any security controls are implemented
- CThe total risk transferred to a third-party vendor
- DThe risk that is completely eliminated by risk avoidance
Why this is the answer
Residual risk is the exposure that remains after mitigation and other treatment strategies are applied.
- Question 33Multiple Select
Which statements correctly differentiate guidelines from standards? (Select all that apply.)
- AGuidelines are discretionary and advisoryCorrect answer
- BStandards define mandatory, quantifiable specificationsCorrect answer
- CStandards are optional recommendations
- DGuidelines must be enforced exactly as written
Why this is the answer
Standards are mandatory quantifiable baselines, while guidelines are flexible and advisory rather than enforced requirements.
Threats, Vulnerabilities, and Mitigations
9 questions in this domain
- Question 34Single Choice
Which term describes a prolonged, stealthy campaign conducted by a persistent adversary to achieve strategic objectives?
- AAdvanced persistent threatCorrect answer
- BScript kiddie
- CHacktivist
- DInsider threat
Why this is the answer
An advanced persistent threat is a prolonged campaign by a sophisticated adversary focused on strategic goals, using stealth and persistence to avoid detection.
- Question 35Multiple Select
Which characteristics are commonly associated with advanced persistent threat actors operating in complex enterprise environments? (Select all that apply.)
- AGeopolitical or strategic motivationsCorrect answer
- BCustom toolsets and tradecraftCorrect answer
- COpportunistic single-stage attacks
- DLong-term stealth and persistenceCorrect answer
Why this is the answer
APTs typically have strategic motivations, custom tools, and operate stealthily for long periods, unlike opportunistic attackers seeking quick financial gain.
- Question 36Interactive
Review the command shown in the provided code block. Which attack technique does it illustrate to the analyst?
- ALiving off the LandCorrect answer
- BSQL injection
- CDLL sideloading
- DMan-in-the-middle
Why this is the answer
Using a trusted Windows binary like certutil to download and execute payloads is a living off the Land technique that evades signature-based defenses.
- Question 37Single Choice
From the perspective of an external attacker, what does an unauthenticated vulnerability scan primarily reveal about a target network?
- APerimeter exposure and visible servicesCorrect answer
- BDeep local misconfigurations
- CRuntime application logic errors
- DSource code quality flaws
Why this is the answer
Unauthenticated scans simulate outsider visibility, identifying exposed services and perimeter weaknesses, while authenticated scans examine internal configuration details.
- Question 38Multiple Select
Which items are typically listed in a software bill of materials for modern enterprise applications? (Select all that apply.)
- AThird-party librariesCorrect answer
- BOpen-source dependenciesCorrect answer
- CEmployee payroll records
- DContainer base imagesCorrect answer
Why this is the answer
An SBOM inventories software components such as libraries, dependencies, and base images, helping teams track known vulnerabilities and supply chain risk.
- Question 39Interactive
The Dockerfile excerpt in the code block represents a potential supply chain risk. Which control should be applied before deployment?
- AContainer image scanningCorrect answer
- BNetwork firewall rules
- CData loss prevention policy
- DPhysical access control
Why this is the answer
Container image scanning checks base images and installed packages for known CVEs, protecting against vulnerable dependencies in the build pipeline.
- Question 40Single Choice
Which security testing technique analyzes application source code for vulnerabilities without executing the application at runtime?
- AStatic application security testingCorrect answer
- BDynamic application security testing
- CRuntime application self-protection
- DPenetration testing
Why this is the answer
SAST analyzes source, bytecode, or binaries without execution, enabling early detection of structural vulnerabilities in the development lifecycle.
- Question 41Multiple Select
Which statements correctly describe the capabilities and limitations of static and dynamic application security testing tools? (Select all that apply.)
- ASAST locates exact lines of vulnerable codeCorrect answer
- BDAST tests running applicationsCorrect answer
- CSAST often produces false positivesCorrect answer
- DDAST identifies source code flaws directly
Why this is the answer
SAST analyzes source and can pinpoint vulnerable lines but has false positives; DAST tests running apps but does not inspect source code directly.
- Question 42Interactive
Examine the web application code shown in the code block. Which vulnerability is most likely present in the endpoint?
- AServer-Side Request ForgeryCorrect answer
- BCross-Site Scripting
- CSQL injection
- DSession fixation
Why this is the answer
Using user input to make a server-side HTTP request allows an attacker to reach internal resources, characteristic of Server-Side Request Forgery.
Frequently asked questions
Everything about the CompTIA SecurityX question bank and how to use it.