CompTIA Security+ Practice Test 1

CompTIA Security+ Practice Test 1

CompTIA Security+ Practice Test

1 / 90

An attacker posing as an IT help desk employee calls an organization’s receptionist and convinces them to reset an executive's password. What type of attack is this?

2 / 90

Your company’s website is suddenly overwhelmed with traffic, making it inaccessible. Further investigation shows a massive number of requests coming from different IP addresses. Which attack is occurring?

3 / 90

Which of the following cryptographic algorithms is asymmetric and used for key exchange?

4 / 90

Which risk response strategy involves shifting the risk to a third party, such as purchasing cybersecurity insurance?

5 / 90

Which wireless encryption protocol is most secure and should be used whenever possible?

6 / 90

Which of the following multi-factor authentication (MFA) combinations provides the strongest security?

7 / 90

An attacker is injecting SQL commands into a web application’s input fields to access the underlying database. Which security control is most effective at preventing this attack?

8 / 90

A high-level executive receives an email that appears to be from the company's IT department, requesting login credentials to "resolve an urgent security issue." What type of attack is this?

9 / 90

A user reports that their system is running unusually slow, and an analysis reveals the presence of a malware variant that modifies system files and spreads through local network shares. Which type of malware is this?

10 / 90

Your network has recently been exposed to malicious software. The incident response team has contained and eradicated the malware. What is the next step in the response process?

11 / 90

A security analyst notices multiple failed login attempts on a company’s web portal from different IP addresses worldwide. What type of attack is most likely occurring?

12 / 90

A company wants to ensure that employees cannot copy sensitive company data to USB drives. What security measure should be implemented?

13 / 90

A cybersecurity team is implementing a security information and event management (SIEM) system. What is the primary purpose of a SIEM?

14 / 90

A user receives an email that appears to be from their bank asking them to update their account details via a provided link. What type of attack is this?

15 / 90

A security administrator needs to enforce multi-factor authentication (MFA) for remote access. Which combination provides the strongest security?

16 / 90

A company uses role-based access control (RBAC). What principle does this model follow?

17 / 90

A network administrator detects unusual outbound traffic from a server, with large amounts of data being sent to an external IP address. What is the most likely explanation?

18 / 90

An organization wants to prevent attackers from discovering the details of their internal network. Which practice can help achieve this?

19 / 90

A company is implementing a disaster recovery plan (DRP). What is the primary goal of a DRP?

20 / 90

A penetration tester successfully gains access to a system by exploiting a vulnerability that was unknown to the software vendor. What type of attack was performed?

21 / 90

A company wants to encrypt sensitive emails so that only the intended recipient can read them. What technology should be used?

22 / 90

A security administrator needs to ensure that files cannot be modified without proper authorization. What security principle does this address?

23 / 90

A security analyst is reviewing logs and notices multiple login attempts from an unknown country outside of business hours. What security measure can prevent unauthorized access in this scenario?

24 / 90

A company wants to reduce the attack surface of its web application. Which action would be most effective?

25 / 90

An attacker intercepts communications between a user and a website, modifying the data in transit. What type of attack is this?

26 / 90

A system administrator is configuring a security policy to enforce password complexity. Which requirement would improve security the most?

27 / 90

A company needs to store sensitive customer data securely in a cloud environment. What is the best practice?

28 / 90

A security engineer wants to prevent SQL injection attacks on a web application. What is the best defense?

29 / 90

A cybersecurity team is implementing an incident response plan. What is the first step in handling a security incident?

30 / 90

A company requires employees to use a fingerprint scan before accessing sensitive company data. What type of authentication is this?

31 / 90

Which type of control is a security awareness training program considered, since it aims to influence human behavior rather than physically or technically enforce a restriction?

32 / 90

Which control type is specifically implemented to satisfy a security requirement when the originally intended control cannot be used, such as using additional monitoring when a patch cannot yet be applied?

33 / 90

Which cryptographic concept refers to a temporary, unique value used only once within a cryptographic communication to prevent replay attacks?

34 / 90

Which cryptographic technique adds random data to a password before hashing it, specifically to defend against precomputed rainbow table attacks?

35 / 90

Which type of certificate is signed by the same entity that created it, rather than being validated by a trusted third-party Certificate Authority?

36 / 90

Which certificate type allows a single certificate to secure a base domain along with any of its first-level subdomains, such as *.example.com?

37 / 90

Which authentication factor category does a hardware token, such as a YubiKey generating one-time codes, belong to?

38 / 90

Which threat actor category is typically motivated by ideological or political beliefs, often targeting organizations to make a public statement rather than for financial gain?

39 / 90

Which threat actor category typically has the greatest access to resources, sophistication, and funding, often conducting long-term, highly targeted espionage campaigns?

40 / 90

Which type of malware disguises itself as legitimate, desirable software to trick a user into installing it, but does not self-replicate like a worm?

41 / 90

Which type of malware self-replicates and spreads across a network without requiring any user interaction or a host file to attach to?

42 / 90

Which social engineering technique involves an attacker following an authorized person through a secured door without providing their own credentials?

43 / 90

Which social engineering attack specifically compromises a website that a target group is known to frequently visit, in order to infect visitors from that specific group?

44 / 90

Which type of vulnerability occurs when an application fails to properly validate user-supplied input length, potentially allowing an attacker to overwrite adjacent memory and execute arbitrary code?

45 / 90

Which web application vulnerability allows an attacker to inject malicious client-side script into content viewed by other users, executing in their browsers?

46 / 90

Which web application vulnerability tricks an authenticated user's browser into unknowingly submitting a malicious request to a site where they are currently logged in, without their knowledge?

47 / 90

Which type of attack involves an attacker exploiting a previously unknown software vulnerability before the vendor has released a patch or is even aware of the flaw?

48 / 90

Which type of attack involves an attacker using a large, precomputed table of hash values to quickly reverse-lookup a hashed password back to its original plaintext value?

49 / 90

Which type of attack involves an attacker using a stolen password hash directly to authenticate to a system, without ever needing to know or crack the actual plaintext password?

50 / 90

Which vulnerability management activity involves attempting to actively exploit identified vulnerabilities in a controlled manner to assess real-world risk and validate that a vulnerability is truly exploitable?

51 / 90

Which network architecture concept divides a network into small, isolated zones with tightly controlled communication paths, limiting an attacker's ability to move laterally after an initial compromise?

52 / 90

Which network zone is designed to host publicly accessible services, such as a web server, while isolating them from the more sensitive internal network?

53 / 90

Which Zero Trust architecture principle states that a user or device should only be granted the minimum access necessary to perform their specific function, and nothing more?

54 / 90

Which cloud deployment model provides infrastructure exclusively dedicated to a single organization, offering greater control but typically at higher cost compared to shared multi-tenant options?

55 / 90

Which cloud deployment model combines both on-premises infrastructure and public cloud resources, allowing workloads to move between the two environments as needed?

56 / 90

Which architectural approach applies multiple, overlapping layers of security controls, so that if one layer fails or is bypassed, additional layers still provide protection?

57 / 90

Which resilience concept describes the maximum acceptable amount of data loss, measured in time, that an organization can tolerate following a disruptive event?

58 / 90

Which resilience concept describes the maximum acceptable duration a system or service can remain unavailable following a disruptive event before causing unacceptable business impact?

59 / 90

Which data protection technique replaces sensitive data elements, such as a credit card number, with a non-sensitive equivalent value that has no exploitable value if intercepted, while preserving a way to map it back to the original?

60 / 90

Which classification of data at rest, in transit, or in use refers to the state where data is actively being processed in a system's memory, such as during a computation?

61 / 90

Which secure design principle involves designing a system so that if a security control fails, the system defaults to a secure, restrictive state rather than an open, permissive one?

62 / 90

Which practice involves reducing a system's attack surface by disabling unnecessary services, closing unused ports, and removing default accounts before deployment?

63 / 90

Which incident response phase involves removing the root cause of an incident from affected systems, such as deleting malware and closing the exploited vulnerability?

64 / 90

Which term refers to observable evidence, such as unusual outbound traffic or unexpected new user accounts, suggesting a system may have been compromised?

65 / 90

Which digital forensics principle requires maintaining a documented record of who handled evidence, when, and what was done with it, to preserve its integrity for potential legal proceedings?

66 / 90

During digital forensics evidence collection, which principle dictates the order in which data should be collected, prioritizing the most volatile (easily lost) data first, such as CPU cache and RAM, before less volatile data like disk storage?

67 / 90

Which security monitoring tool aggregates and correlates log data from many different sources across an organization, enabling centralized analysis and alerting on potential security events?

68 / 90

Which security technology automates repetitive response actions, such as automatically isolating an infected host, based on predefined playbooks triggered by detected security events?

69 / 90

Which access control model assigns permissions to users based on their organizational role, such as 'Accountant' or 'HR Manager,' rather than assigning permissions to each individual user separately?

70 / 90

Which access control model uses labels, such as 'Confidential' or 'Top Secret,' assigned by a central authority, where users cannot change permissions on objects they do not own?

71 / 90

Which authentication protocol is commonly used with 802.1X to authenticate devices before granting them network access, often integrating with a centralized directory service?

72 / 90

Which endpoint security tool goes beyond traditional antivirus by continuously monitoring endpoint activity, detecting suspicious behavior patterns, and enabling detailed investigation and automated response?

73 / 90

Which vulnerability scoring system provides a standardized numerical score, typically from 0 to 10, representing the severity of a given vulnerability to help prioritize remediation efforts?

74 / 90

Which vulnerability management activity involves cataloging and uniquely identifying publicly known vulnerabilities using a standardized identifier, such as CVE-2024-12345?

75 / 90

Which practice involves regularly comparing a system's current configuration against an established, approved secure configuration standard, flagging any unauthorized deviations?

76 / 90

Which log source would a security analyst review first to identify failed authentication attempts against a specific Windows server?

77 / 90

Which backup strategy stores backup copies both onsite and offsite, uses at least two different storage media types, and keeps at least one copy at an offsite location, commonly known by a specific numeric rule?

78 / 90

Which type of backup captures only the data that has changed since the last full backup, resulting in faster restoration than an incremental backup chain but requiring more storage than incremental backups?

79 / 90

Which risk management strategy involves an organization purchasing a cyber insurance policy to shift the financial impact of a potential security incident to a third party?

80 / 90

Which risk management strategy involves an organization deciding not to engage in a particular activity at all because the associated risk is considered too high, rather than accepting or mitigating it?

81 / 90

Which quantitative risk calculation represents the expected monetary loss from a single occurrence of a specific risk event, calculated as asset value multiplied by exposure factor?

82 / 90

Which quantitative risk calculation represents the total expected annual monetary loss from a specific risk, calculated by multiplying the Single Loss Expectancy by the Annualized Rate of Occurrence?

83 / 90

Which document formally identifies a risk that an organization has decided not to remediate, along with the justification and approval for accepting that risk?

84 / 90

Which type of third-party agreement establishes the specific performance metrics and guaranteed service levels a vendor must meet, such as uptime percentage or response time?

85 / 90

Which type of agreement establishes a general, often informal understanding of intent between two parties, without the same level of legal enforceability as a formal contract?

86 / 90

Which type of security awareness activity involves sending a fake phishing email to employees to measure how many click the link, followed by targeted additional training for those who fall for it?

87 / 90

Which governance activity involves developing a structured exercise where key stakeholders talk through their roles and responses to a hypothetical incident scenario, without actually executing any technical response?

88 / 90

Which compliance framework specifically governs the protection of cardholder data for organizations that store, process, or transmit credit card information?

89 / 90

Which regulation grants individuals within the European Union specific rights over their personal data, including the right to be forgotten and requirements for data breach notification?

90 / 90

Which privacy concept refers to collecting and retaining only the personal data that is strictly necessary for a specifically stated purpose, rather than gathering excessive amounts of data?

Your score is

The average score is 76%

0%