Security Operations — Identity, Access and Hardening — CompTIA Security+ practice questions

To recursively delete a directory and contents, use:

1. rm directory
2. del -r directory
3. rmdir directory
4. rm -rf directory

Answer: D — rm -rf directory

-r recurse, -f force. (A) fails on directories; (C) only removes empty dirs; (B) is Windows syntax — dangerous flag trap.

Which shebang line specifies a bash script?

1. #!/bin/bash
2. #/bin/bash
3. #!bash -e
4. //bin/bash

Answer: A — #!/bin/bash

(A) A shebang is #! followed by an absolute interpreter path. (B) drops the ! so the line is only a comment; (C) names the interpreter with no path, which the kernel will not resolve; (D) uses a C-style comment marker, not a shebang.

Which command shows the routing table on Linux?

1. ifconfig
2. netstat -i
3. ip route
4. traceroute

Answer: C — ip route

'ip route' (or 'route -n', legacy). (A) shows interfaces; (B) shows interface stats; (D) traces a path.

To find all files modified in the last 24 hours under /home, use:

1. find /home -mtime -1 -type f
2. find /home -atime -1 -type f
3. find /home -ctime -1 -type f
4. ls -lt --time=mtime /home

Answer: A — find /home -mtime -1 -type f

(A) -mtime selects by content modification time, and -1 means within the last 24 hours. (B) -atime keys on last access, which changes on reads; (C) -ctime keys on inode metadata change; (D) sorts only the top level of /home and does not recurse.

Which provides secure web communication on port 443?

1. HTTP carried over TCP port 80 without encryption
2. HTTPS, which carries HTTP inside a TLS session
3. FTP using TCP ports 20 and 21 for data and control
4. Telnet over TCP port 23 with credentials in the clear

Answer: B — HTTPS, which carries HTTP inside a TLS session

HTTPS wraps HTTP in TLS and listens on TCP 443. HTTP on port 80 (A) is plaintext. FTP (C) uses ports 20/21 and transmits credentials unencrypted unless FTPS is used. Telnet (D) on port 23 sends everything, including passwords, in cleartext.

Which port is associated with RDP (Remote Desktop)?

1. TCP 22
2. TCP 8080
3. TCP 5900
4. TCP 3389

Answer: D — TCP 3389

(D) RDP listens on 3389. (A) 22 is SSH; (C) 5900 is VNC; (B) 8080 is alternate HTTP — a common remote-access port mix-up.

Which PowerShell cmdlet lists running processes?

1. ps
2. Show-Process
3. List-Processes
4. Get-Process

Answer: D — Get-Process

Verb-Noun convention; Get-Process. (A) is a bash/alias (works as alias but not the canonical cmdlet); (C), (B) are invented.

Which command searches recursively for the string 'error' in all .log files under /var/log?

1. grep error /var/log/*.log
2. find /var/log -name error
3. grep -r error /var/log
4. sed 's/error//' /var/log/*.log

Answer: C — grep -r error /var/log

-r recurses into subdirs. (A) only matches top-level *.log (misses subdirs); (B) finds files named 'error'; (D) is stream editor (substitution).

To change file ownership to user 'alice' and group 'devs', use:

1. chown alice file
2. chmod alice:devs file
3. chown alice:devs file
4. chgrp alice:devs file

Answer: C — chown alice:devs file

chown user:group syntax. (A) misses group; (B) confuses chmod (permissions) with chown (ownership); (D) is group-only and wrong syntax.

Which sed command replaces all occurrences of 'foo' with 'bar' in file.txt?

1. sed 's/foo/bar/' file.txt
2. sed 'replace foo bar' file.txt
3. sed -r foo=bar file.txt
4. sed 's/foo/bar/g' file.txt

Answer: D — sed 's/foo/bar/g' file.txt

/g = global (all per line). (A) replaces only first match per line — classic off-by-one missing-flag trap; (C), (B) are invalid syntax.

SAST vs. DAST?

SAST: analyzes source code without running app (white-box, catches early). DAST: tests running app from outside (black-box, finds runtime issues).

What is secure boot?

A firmware feature that verifies the digital signatures of boot loaders and operating system files before loading them. Prevents rootkits and bootkits.

Authentication vs. authorization?

Authentication verifies identity (who you are). Authorization determines permissions (what you can do). Authentication comes first.

What is data loss prevention (DLP)?

Technologies that detect and prevent unauthorized transmission of sensitive data outside the organization. Monitors email, web, endpoints.