Home › Certifications › CompTIA A+ › Core 2 — Security
76 multiple-choice questions and 43 flashcards on Core 2 — Security, about 14% of the CompTIA A+ bank. Every one carries a written rationale.
Core 2 — Security is one of 9 chapters in CoStudy's CompTIA A+ bank, and it holds 76 of the bank's 540 multiple-choice questions — roughly 14% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.
Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.
10 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.
A TOTP authenticator app stops matching the server and every code is rejected, though the same phone worked yesterday. The FIRST thing to check is:
Answer: A — Whether the phone's clock has drifted
A) Correct — TOTP derives the code from a shared secret plus the current time window, so a phone whose clock has drifted produces valid-looking codes for the wrong interval. B) A lockout would reject the login regardless of code and usually produces a distinct lockout message. C) Re-enrolling replaces the seed and would work, but it discards a still-good secret before testing the cheaper and far more common cause. D) App versions rarely break the algorithm, which is a stable open standard rather than a vendor feature.
A privileged access management deployment gives administrators standing membership in a domain admin group. Which change BEST reduces risk?
Answer: B — Issuing elevation just in time for an approved, time-boxed window
B) Correct — just-in-time access removes standing privilege, so a stolen admin credential is useless outside an approved, expiring elevation window. A) Stronger passphrases resist guessing but do nothing about a session token or credential stolen while privilege is active. C) Quarterly review is a detective control that leaves the excess privilege in place between reviews. D) An organizational unit affects policy scoping and delegation, not whether the privilege is always on.
A user receives an email asking them to click a link to verify account credentials. The email's link domain is similar but not identical to the real one. This is:
Answer: B — A phishing attempt using a look-alike domain
A deceptive email with a credential-stealing link on a look-alike domain is phishing; report it and reach the real site directly. Spam is unsolicited bulk mail and not necessarily malicious, whaling targets executives, and smishing arrives by SMS.
Under a zero trust model, a laptop that fails its posture check because patches are months behind should be:
Answer: B — Quarantined for remediation until compliant
B) Correct — zero trust evaluates device health as part of the access decision, so a noncompliant endpoint is quarantined to a remediation path rather than admitted. A) A banner is user education; it leaves the vulnerable device on the network with full reach. C) Strong authentication proves who the user is, not that the device is safe; both signals must pass. D) Re-imaging is disproportionate for missing patches and is a remediation action, not the access decision.
Which Windows feature provides per-file/folder encryption tied to the user's certificate?
Answer: C — Encrypting File System (EFS), keyed to the user cert
EFS encrypts individual files and folders using the user's certificate. BitLocker is volume-level rather than per-file, Defender is antimalware, and Credential Guard isolates LSA secrets. Trick A: volume encryption offered where per-file is asked.
A data center needs to stop an unauthorized person from walking in directly behind an employee who badges through the entry door. The MOST effective control is:
Answer: A — An access control vestibule that admits one person per badge read
A) Correct — a vestibule (mantrap) physically interlocks two doors and releases only after a single authenticated person passes, which is the only listed control that actually prevents tailgating rather than recording or discouraging it. B) Cameras are detective, not preventive; footage identifies the intruder after the fact but never stops the entry. C) A stronger credential defends against cloned badges, a different attack; a tailgater uses no credential at all. D) Policy and awareness reduce willingness to hold doors but rely on the employee complying under social pressure.
A user's browser gained a new toolbar and a changed default search engine after installing a free utility they consented to. This is MOST likely:
Answer: C — A potentially unwanted program
C) Correct — PUPs arrive as bundled extras the user technically approved during setup, degrading the experience rather than establishing covert control. A) Rootkits conceal themselves at a low level; a visible toolbar is the opposite of concealment. B) A Trojan implies deliberately hidden malicious payload and typically remote control, which is not indicated. D) A keylogger records keystrokes silently and would not announce itself by changing the search engine.
Which detail MOST reliably distinguishes spear phishing from ordinary bulk phishing?
Answer: C — It is tailored with specific details about the named recipient
C) Correct — spear phishing is defined by targeting and personalization drawn from research on the individual or their organization. A) Sender spoofing is common to almost all phishing, bulk or targeted. B) Links appear in both kinds; the payload delivery method is not the distinguishing trait. D) Attachments versus links is a tactical choice unrelated to how targeted the message is.
Which statement about degaussing is accurate?
Answer: A — It sanitizes magnetic hard drives and leaves them unusable
A) Correct — a degausser destroys the magnetic domains including the servo tracks the drive needs to operate, so the data is gone and the drive cannot be reused. B) Flash storage holds charge in cells and is unaffected by magnetic fields. C) Destroying the servo information is precisely why a degaussed drive cannot be put back into service. D) Optical media store data as physical pits and are not magnetic.
A secure email gateway rewrites URLs in inbound messages so they resolve through the vendor at click time. The MAIN benefit is:
Answer: D — Links weaponized after delivery are still checked when clicked
D) Correct — time-of-click evaluation catches sites that were benign during the initial scan and turned malicious afterward, which static scanning at delivery cannot do. A) Archiving is a separate compliance function of mail systems. B) Attachment handling and storage efficiency are unrelated to URL rewriting. C) Directory validation of senders happens at the connection or authentication stage, not through link rewriting.
4 cards from the 43 in this chapter.
What is the proper data destruction method for HDDs?
Multi-pass overwrite (DoD 5220 or NIST 800-88), degaussing (for magnetic), or physical destruction (shred/crush). Choose based on data sensitivity.
What is phishing vs. spear phishing vs. whaling?
Phishing: mass-targeted fake emails. Spear phishing: targeted at specific individual (research-driven). Whaling: targeted at executives.
What's the difference between a firewall and an IDS/IPS?
Firewall: enforces allow/deny rules. IDS: detects/alerts on suspicious traffic. IPS: detects AND blocks. NGFWs combine all functions.
What is RBAC?
Role-Based Access Control — permissions assigned to roles; users assigned roles. Easier to manage at scale than per-user permissions.
These are a sample. The full Core 2 — Security chapter runs 119 items with per-chapter progress tracking, on the web and in the iOS app.