CompTIA Security+ practice questions and exam guide

Hash function properties:

1. Reversible, so the original input can always be recovered
2. Random output that differs on every run for the same input
3. Stores the original password itself inside the digest value
4. Encrypts the data so a key holder can decrypt it later
5. One-way, deterministic, fixed-length, collision resistant

Answer: E — One-way, deterministic, fixed-length, collision resistant

Hashes are one-way and deterministic, produce fixed-length output, show the avalanche effect, and resist collisions, which is why they suit password storage with salt, file integrity, and signatures. A and D describe encryption. B contradicts determinism. C misstates storage: the digest is derived from, not a container for, the password.

An HSM (Hardware Security Module) provides:

1. Key generation and use inside tamper-resistant hardware
2. Signature-based malware detection that replaces endpoint AV
3. Layer-7 filtering of inbound web requests as a WAF appliance
4. Enrollment and policy control for managed mobile devices

Answer: A — Key generation and use inside tamper-resistant hardware

A) An HSM generates, stores, and uses keys inside tamper-resistant hardware, commonly under FIPS 140-2 or 140-3 validation, so key material never leaves in the clear. B, C, and D name entirely different product categories.

Which BEST describes the relationship between Zero Trust and network segmentation?

1. Zero Trust removes the need for any network segmentation
2. Zero Trust applies only to workloads in the public cloud
3. Segmentation alone suffices, making Zero Trust unnecessary
4. Zero Trust extends it to identity-aware microsegmentation

Answer: D — Zero Trust extends it to identity-aware microsegmentation

D) Zero Trust treats every request as untrusted and pushes segmentation down to identity-aware microsegments authenticated per request. A) It builds on segmentation rather than replacing it. B) It applies on-premises as well as in cloud. C) Coarse segmentation still permits broad lateral movement once inside.

Which represents the three foundational pillars of information security?

1. Authentication, authorization, and accounting (AAA)
2. Confidentiality, integrity, and availability (CIA)
3. People, process, and technology (operating model)
4. Prevent, detect, and respond (operations cycle)

Answer: B — Confidentiality, integrity, and availability (CIA)

The CIA triad is the canonical model: Confidentiality (access restricted to authorized parties), Integrity (data accurate and untampered), Availability (data reachable when needed). AAA (A) is an access-control framework, not the security objectives. People/process/technology (C) is an operating model. Prevent/detect/respond (D) describes operational functions.

What attack exploits unvalidated web form input for database commands?

1. XSS
2. CSRF
3. SQL Injection
4. Path traversal

Answer: C — SQL Injection

SQL Injection exploits unvalidated input that gets concatenated into database queries, letting an attacker execute arbitrary SQL. Prevented with parameterized queries / prepared statements.

A zero-day vulnerability is:

1. A flaw disclosed and patched by the vendor on the same day
2. A flaw unknown to the vendor for which no vendor patch yet exists
3. An unplanned service outage lasting less than one business day
4. A misconfiguration introduced during a routine deployment change

Answer: B — A flaw unknown to the vendor for which no vendor patch yet exists

B) A zero-day is unknown to the vendor and unpatched, so defenders have no fix available. A) That inverts the meaning; a same-day patch is the opposite case. C) An outage is an availability event, not a vulnerability class. D) Misconfigurations are known and correctable.

A supply chain attack targets:

1. An organization through a trusted third-party vendor, update channel, or software component
2. The direct victim only, via a straight external attack on its internet-facing systems
3. The cloud provider's shared hosting infrastructure rather than the tenants running on it
4. Hardware vendors exclusively, through counterfeit chips inserted during manufacturing

Answer: A — An organization through a trusted third-party vendor, update channel, or software component

(A) Supply chain attacks such as SolarWinds and Kaseya abuse trust relationships and signed updates to reach the real target indirectly. (B) describes a conventional direct attack. (C) names one possible link, not the definition. (D) is too narrow; software and service suppliers are the common vector.

An advanced persistent threat (APT) is best characterized by:

1. Random opportunistic attacks that spread to whatever unpatched hosts happen to respond
2. A well-resourced actor maintaining stealthy, long-duration access against a chosen target
3. Mass email virus campaigns sent indiscriminately to harvested address lists for quick gain
4. Script kiddies running downloaded exploit kits without understanding the underlying flaw

Answer: B — A well-resourced actor maintaining stealthy, long-duration access against a chosen target

(B) An APT is defined by funding, patience, targeting, and stealthy persistence, typically nation-state or organized criminal. (A), (C), and (D) all describe opportunistic commodity threats with no sustained targeting.

A hybrid cloud deployment combines:

1. Two public clouds from different providers
2. On-premises virtualized resources only
3. Two private clouds in separate facilities
4. Public and private resources, orchestrated

Answer: D — Public and private resources, orchestrated

(D) Hybrid pairs public and private estates with integration between them. (A) is multi-cloud; (B) is purely on-premises; (C) is a distributed private cloud.

RAID 10 (1+0) provides:

1. Distributed parity only, with no mirroring
2. Striped mirrors — mirroring plus striping
3. A single disk with no redundancy at all
4. Striping alone, with no fault tolerance

Answer: B — Striped mirrors — mirroring plus striping

(B) RAID 10 stripes across mirrored pairs, giving both speed and redundancy. (A) is RAID 5 or 6; (C) and (D) describe no redundancy at all.

Network segmentation reduces attack impact by:

1. Encrypting traffic between hosts so that captured packets cannot be read by an intruder
2. Adding antivirus agents to every host inside each subnet of the production network
3. Limiting lateral movement, so one compromised segment cannot easily reach the others
4. Patching known vulnerabilities faster than an attacker can weaponize them at scale

Answer: C — Limiting lateral movement, so one compromised segment cannot easily reach the others

(C) Segmentation with VLANs, firewalls, and micro-segmentation shrinks the blast radius by forcing an attacker to cross enforced boundaries. (A) protects confidentiality, not reachability. (B) is endpoint defense. (D) reduces the initial foothold, not lateral spread.

A DMZ vs. a screened subnet — the modern Security+ terminology is that:

1. Screened subnet replaces DMZ for a firewalled edge segment
2. DMZ describes layer 2 while a screened subnet is layer 7
3. A screened subnet carries only internal east-west traffic
4. The DMZ concept no longer exists in network architecture

Answer: A — Screened subnet replaces DMZ for a firewalled edge segment

A) SY0-701 prefers screened subnet for the same isolated segment hosting internet-facing services with firewalls on either side. B) Both terms name network segments, not OSI layers. C) The segment exists to face external traffic. D) The architecture and the older term both persist in industry.

A SIEM (Security Information and Event Management) system:

1. Storing raw log files in a searchable archive without further analysis
2. Replacing perimeter firewalls with a single centralized policy engine
3. Aggregating and correlating logs across the environment to raise alerts
4. Running scheduled penetration tests against internal and external hosts

Answer: C — Aggregating and correlating logs across the environment to raise alerts

(C) A SIEM ingests logs from many sources, correlates them into events, and supports investigation and compliance reporting. (A) is plain log storage without correlation. (B) is a preventive control a SIEM does not replace. (D) is an offensive testing activity.

Which framework maps adversary tactics?

1. ISO 27001, an ISMS certification standard
2. NIST SP 800-53, a security control catalog
3. MITRE ATT&CK, a catalog of adversary TTPs
4. PCI DSS, the payment card security standard

Answer: C — MITRE ATT&CK, a catalog of adversary TTPs

MITRE ATT&CK catalogs adversary tactics, techniques, and procedures across the attack lifecycle and is what SOC teams map detections against. ISO 27001 (A) certifies a management system, NIST SP 800-53 (B) is a control catalog, and PCI DSS (D) is a payment-industry requirement set; none of them model attacker behavior.

Which log source is MOST useful for proving that an account performed a specific privileged action?

1. DHCP lease logs mapping IP addresses to hardware over time periods
2. Privileged session recordings with correlated authentication logs
3. Web-server access logs from the public-facing application tier
4. Email header metadata showing message routing and timestamps

Answer: B — Privileged session recordings with correlated authentication logs

B) PAM session recording bound to time-correlated auth and audit events ties a specific action to a specific identity. A) DHCP only links a lease to a MAC address. C) Web logs miss operating-system administrative activity. D) Email metadata is unrelated to privileged actions.

Which control would BEST detect that a privileged account was used at 3 AM from a country the admin has never traveled to?

1. An annual access review of privileged group membership
2. Full-disk encryption on the administrator's laptop and servers
3. Signature-based anti-virus scanning on the domain controller
4. User and Entity Behavior Analytics tied to identity telemetry

Answer: D — User and Entity Behavior Analytics tied to identity telemetry

D) UEBA baselines each account's normal behavior and flags anomalies such as impossible travel and off-hours privileged use. A) An annual review would surface this months late. B) Encryption protects data at rest, not logon patterns. C) Anti-virus looks for malware, not anomalous identity use.

Patch management priorities should be set by:

1. Random selection of patches as maintenance windows become available
2. Risk: CVSS severity, known exploitation, and asset criticality
3. Alphabetical order by vendor name across the patch backlog queue
4. Release date alone, applying the oldest outstanding patches first

Answer: B — Risk: CVSS severity, known exploitation, and asset criticality

(B) Risk-based prioritization weighs severity, active exploitation such as CISA KEV listings, asset value, and business context. (A) leaves critical exposures open. (C) is arbitrary. (D) ignores whether a flaw is actually being exploited.

In bash, which assigns the value 5 to variable x?

1. x = 5
2. $x = 5
3. let x := 5
4. x=5

Answer: D — x=5

No spaces around =. (A) spaces break it (interpreted as command); (C) is Pascal syntax; (B) misuses $.

NIST 800-63B current guidance on password policy DISCOURAGES:

1. Periodic mandatory rotation without cause
2. Long user-chosen passphrases of 64 characters
3. Checking against breached-password lists
4. Multi-factor authentication for accounts

Answer: A — Periodic mandatory rotation without cause

(A) NIST SP 800-63B advises against forced periodic expiration absent evidence of compromise. (B), (C), and (D) are all recommended by the same guidance — the trap is recalling older policy habits.

A network diagram should be updated:

1. Only when an external audit has been scheduled
2. Whenever the network changes, at change closure
3. Once a year, during the annual budget cycle only
4. Never, since network diagrams are static documents

Answer: B — Whenever the network changes, at change closure

(B) The diagram must reflect current state, so updating it is part of closing a change. (A) and (C) allow documentation drift between reviews; (D) is false — networks change constantly.

Which document type sets MEASURABLE service expectations between provider and customer?

1. NDA, binding both parties to confidentiality obligations
2. SLA, defining uptime, response targets, and remedies
3. MOU, recording a non-binding statement of shared intent
4. AUP, setting the rules governing end-user system use

Answer: B — SLA, defining uptime, response targets, and remedies

B) A service level agreement codifies measurable commitments such as availability and response time, plus penalties for missing them. A) An NDA protects information, not performance. C) An MOU expresses intent without measurable terms. D) An AUP governs user behavior.

GDPR is which type of regulation?

1. U.S. healthcare
2. EU/UK data privacy
3. Payment-card processing
4. Federal contracting

Answer: B — EU/UK data privacy

GDPR (General Data Protection Regulation, 2018) governs personal data of EU/UK residents. Applies extraterritorially to any organization processing such data. Key concepts: data controller/processor, lawful basis, data subject rights (access, erasure, portability), DPO, breach notification within 72 hours.

Separation of duties requires that:

1. Splitting a sensitive task so no one person completes it alone
2. Assigning every step of a critical workflow to one trusted admin
3. Assigning tasks at random among whichever staff are available
4. Skipping approval steps when workload exceeds staffing levels

Answer: A — Splitting a sensitive task so no one person completes it alone

A) Separation of duties divides a sensitive action across people, so fraud requires collusion. B) Concentrating a workflow in one person is the risk being removed. C) Randomization is not a control on authority. D) Skipping approvals weakens the process.

Security awareness training is MOST effective when it is:

1. Delivered once during onboarding and not repeated afterward
2. Fully outsourced to a vendor with no internal review of the content
3. Replaced by stricter password complexity and rotation rules
4. Continuous, role-based, reinforced by simulations, and measured

Answer: D — Continuous, role-based, reinforced by simulations, and measured

D) Behavior change requires repetition, relevance to the role, realistic practice, and metrics such as click and report rates. A) One-time training decays within months. B) Unreviewed vendor content drifts from actual risk. C) Password rules address one narrow behavior.

What is a SaaS security concern?

Data sovereignty, shared responsibility, vendor lock-in, API security, access control, compliance, data loss, insider threats at the provider, and account hijacking.

What is a false positive in security scanning?

A scan result reporting a vulnerability that doesn't actually exist. Wastes time on investigation. Tuning scanners reduces false positives.

What is OCSP?

Online Certificate Status Protocol — real-time certificate validation. More efficient than downloading full CRLs.

What is network function virtualization (NFV)?

Replacing dedicated hardware network appliances (firewalls, load balancers, IDS) with software running on standard servers. Increases flexibility and reduces costs.

What is the NIST Cybersecurity Framework?

Five core functions: Identify, Protect, Detect, Respond, Recover. Voluntary framework for managing cybersecurity risk.

What is job rotation?

Periodically moving employees between different roles to prevent fraud, reduce insider threat, and cross-train staff.