Home › Certifications › CompTIA Security+ › General Security Concepts
42 multiple-choice questions and 57 flashcards on General Security Concepts, about 14% of the CompTIA Security+ bank. Every one carries a written rationale.
General Security Concepts is one of 6 chapters in CoStudy's CompTIA Security+ bank, and it holds 42 of the bank's 300 multiple-choice questions — roughly 14% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.
Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.
10 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.
What is the key practical difference between a hash and an HMAC?
Answer: C — Keyed, so it proves integrity and sender authentication
C) HMAC mixes a shared secret into the hash, so a valid tag proves both integrity and that the sender held the key. A) HMAC is still one-way. B) HMAC uses a symmetric secret, not a key pair. D) Output length matches the underlying hash.
When Alice sends Bob an encrypted email using asymmetric crypto, which key does Alice use to encrypt the message?
Answer: A — Bob's public key
A) Encryption uses the recipient's public key; only Bob's private key can decrypt. B) Alice signs with her private key — that proves authorship but does not provide confidentiality. C) Encrypting with Alice's own public key would let anyone (including herself) decrypt only if they had her private key, which Bob doesn't. D) Alice does not have Bob's private key.
Symmetric encryption uses:
Answer: D — The same shared secret key for both encryption and decryption
D) Symmetric ciphers use one shared secret on both ends; fast, but key distribution is the hard part. A/C) Describe asymmetric cryptography. B) Hashing is keyless and not reversible.
SHA-256 produces:
Answer: D — A 256-bit (32-byte) digest used for integrity checks and signatures
(D) SHA-256 always emits a fixed 256-bit value regardless of input size. (A) is MD5's width. (B) contradicts the fixed-output property of hash functions. (C) is SHA-512.
Which type of control is an audit log?
Answer: B — Detective control
Detective controls identify that an incident has occurred (logs, IDS alerts, SIEM events). Preventive controls stop incidents (firewalls, access controls); corrective controls respond (backups, patches).
AAA in security stands for:
Answer: B — Authentication, Authorization, Accounting — identity, rights, logs
B) AAA is the canonical model implemented by RADIUS and TACACS+: prove identity, grant permissions, record activity. A) These terms are not the framework. C) Availability is a CIA property, not the second A. D) Access is the outcome of authorization, not a separate pillar.
A Certificate Authority (CA) is:
Answer: D — A trusted third party that issues and vouches for digital certificates
(D) A CA is the trust anchor that binds a public key to a verified identity and signs the resulting certificate. (A) confuses regulation with certification. (B) consumes signatures rather than issuing them. (C) describes the client trust store, which relies on CAs.
Zero Trust architecture:
Answer: A — No implicit trust by network location; verify every request
Zero Trust, formalized in NIST SP 800-207, removes trust based on network position and evaluates identity, device posture, context, and least privilege on every request, with micro-segmentation throughout. B, C, and D all grant standing trust based on location or transport, and E denies the distinction from the perimeter model it replaces.
Three categories of security controls:
Answer: B — Administrative, technical, and physical control families
Controls are categorized as administrative (policy, procedure, training), technical or logical (firewalls, encryption, access control), and physical (locks, cameras, guards); their functions are preventive, detective, corrective, deterrent, compensating, and directive. A, C, D, and E each collapse the taxonomy to one type, which defeats layering.
An analyst receives an alert that a SQL injection attempt was logged and the WAF blocked the request. Which control category does the WAF action represent in this case?
Answer: A — Preventive
A) The WAF actively stopped the attack before it reached the database — that is preventive. B) Detective controls only identify and alert (an IDS would be detective). C) Corrective controls fix the state after an incident (restore from backup). D) Compensating controls are alternatives used when a primary control is infeasible.
4 cards from the 57 in this chapter.
Quantum computing impact on cryptography?
Shor's algorithm breaks RSA/ECC. Grover's halves symmetric key strength. Post-quantum crypto (lattice-based, hash-based) being standardized by NIST.
What is a CRL?
Certificate Revocation List — a list of certificates revoked before expiration. Checked during certificate validation.
Symmetric vs. asymmetric encryption?
Symmetric: one shared key, faster (AES). Asymmetric: public/private key pair, solves key distribution (RSA, ECC).
What is an initialization vector (IV)?
A random value used with a key to ensure that encrypting the same data produces different ciphertext. Must be unpredictable. Different from a nonce in some modes.
These are a sample. The full General Security Concepts chapter runs 99 items with per-chapter progress tracking, on the web and in the iOS app.
Open CompTIA Security+ in CoStudy →