50 Free CompTIA Security+ Practice Questions (SY0-701)

Answer: b) Unauthorized disclosure of data

Explanation: Confidentiality ensures that data is not disclosed to unauthorized parties. This is achieved through encryption, access controls, and data classification.

Answer: b) Smart card

Explanation: Something you have factors include physical devices like smart cards, hardware tokens, or mobile phones used for authentication (e.g., receiving an SMS code).

Answer: a) Trust no one inside or outside the network; verify all requests

Explanation: Zero Trust assumes no implicit trust based on network location. Every access request must be authenticated, authorized, and encrypted regardless of origin (internal or external).

Answer: b) Implementing firewalls, antivirus, MFA, and encryption together

Explanation: Defense in depth uses multiple layers of security controls (administrative, technical, physical) so that if one layer fails, others still provide protection.

Answer: b) Symmetric

Explanation: Symmetric encryption uses a single shared key for both encryption and decryption (e.g., AES). Asymmetric uses public/private key pairs (e.g., RSA).

Answer: b) Ensuring data integrity by producing a fixed-size digest

Explanation: Hash functions (SHA-256, MD5) produce a fixed-size digest from input data. Any change in the input produces a different hash, making hashes useful for verifying data integrity.

Answer: b) Fingerprint

Explanation: Biometrics (fingerprint, retina scan, facial recognition, voice recognition) fall under "something you are" authentication factors.

Answer: b) Adding an extra layer of security beyond just a password

Explanation: MFA requires two or more factors from different categories (knowledge, possession, inherence) to authenticate, significantly reducing the risk of credential compromise.

Answer: b) A user cannot deny having performed an action

Explanation: Non-repudiation ensures that someone cannot deny having performed a specific action (like signing a document or sending an email). Digital signatures provide non-repudiation.

Answer: b) Mandatory Access Control (MAC)

Explanation: MAC uses labels assigned to subjects (users) and objects (files) to control access based on security classification (e.g., Top Secret, Secret, Confidential). Users cannot override these rules.

Answer: c) AES-256

Explanation: AES-256 (Advanced Encryption Standard with 256-bit keys) is the industry standard for symmetric encryption. DES and 3DES are deprecated, and RC4 is considered insecure.

Answer: b) Identification is claiming an identity; authentication is proving it

Explanation: Identification is when a user claims an identity (e.g., "I am John"). Authentication is verifying that claim (e.g., providing a password to prove you are John).

Answer: c) Ransomware

Explanation: Ransomware encrypts the victim's files and demands a ransom payment (typically in cryptocurrency) to provide the decryption key.

Answer: a) An attack where the attacker intercepts communication between two parties

Explanation: In a MITM attack, the attacker secretly relays and potentially alters communication between two parties who believe they're directly communicating with each other.

Answer: c) SQL Injection

Explanation: SQL injection occurs when an attacker inserts malicious SQL statements into input fields (like login forms). Mitigated by parameterized queries and input validation.

Answer: b) An attack that overwhelms a target with traffic from multiple sources

Explanation: A Distributed Denial of Service (DDoS) attack floods a target (server, network, application) with traffic from many distributed sources, making it unavailable to legitimate users.

Answer: a) Phishing

Explanation: Phishing often creates urgency or fear (e.g., "Your account has been compromised, click here to reset your password") to trick victims into revealing sensitive information.

Answer: b) Identifying potential security weaknesses without exploiting them

Explanation: Vulnerability scanning automatically checks systems for known vulnerabilities (missing patches, misconfigurations, weak passwords) without causing damage. It's non-intrusive.

Answer: a) Zero-day

Explanation: A zero-day exploit targets a vulnerability that is unknown to the software vendor and has no available patch. These are the most dangerous as there is no defense available.

Answer: a) Viruses require human action to spread; worms self-replicate

Explanation: Viruses need user action (opening a file, running a program) to spread. Worms self-replicate and spread automatically across networks without user interaction.

Answer: a) Injecting malicious scripts into trusted websites

Explanation: XSS attacks inject malicious client-side scripts (usually JavaScript) into web pages viewed by other users. Mitigated by output encoding, CSP headers, and input validation.

Answer: b) Vishing

Explanation: Vishing (voice phishing) uses phone calls to trick victims into revealing sensitive information. Smishing uses SMS/text messages, and whaling targets high-profile executives.

Answer: a) Writing more data to a buffer than it can hold, causing adjacent memory to be overwritten

Explanation: Buffer overflow occurs when a program writes more data to a fixed-size buffer than it can hold. This can overwrite adjacent memory and enable code execution.

Answer: b) Application whitelisting combined with user training and updates

Explanation: Defense against malware requires multiple layers: application whitelisting (only approved software can run), regular patching, security awareness training, and antivirus.

Answer: b) Filtering network traffic based on rules

Explanation: A firewall filters incoming and outgoing network traffic based on predetermined security rules. It can be network-based (hardware) or host-based (software).

Answer: a) IDS detects intrusions; IPS detects and prevents intrusions in real-time

Explanation: IDS (Intrusion Detection System) monitors and alerts on suspicious activity. IPS (Intrusion Prevention System) monitors, alerts, and actively blocks detected threats in real-time.

Answer: b) Logical segmentation (VLAN)

Explanation: VLANs (Virtual Local Area Networks) logically segment networks on the same physical switch, isolating traffic between different zones (e.g., DMZ, internal, guest).

Answer: a) A demilitarized zone — a network segment that exposes external-facing services

Explanation: A DMZ is a network segment that sits between the internet and the internal network, hosting public-facing services (web servers, mail servers) to isolate them from internal resources.

Answer: c) IaaS

Explanation: IaaS provides virtualized computing resources (VMs, storage, networking) where customers manage the OS, middleware, runtime, data, and applications — giving them the most control.

Answer: b) A security tool that sits between cloud users and cloud providers to enforce policies

Explanation: A CASB acts as an intermediary between cloud users and cloud providers, enforcing security policies for data visibility, compliance, threat protection, and access control.

Answer: b) Aggregating and analyzing security logs from multiple sources

Explanation: SIEM (Security Information and Event Management) systems collect, normalize, and analyze logs from multiple sources (firewalls, servers, applications) to detect security incidents.

Answer: a) VPN

Explanation: VPN (Virtual Private Network) creates an encrypted tunnel between two endpoints (client-to-site or site-to-site), protecting data in transit over public networks.

Answer: a) A hardware device for managing encryption keys

Explanation: An HSM is a dedicated hardware device that securely generates, stores, and manages cryptographic keys. HSMs are tamper-resistant and FIPS 140-2/140-3 certified.

Answer: b) Encrypting data in transit and verifying server identity

Explanation: TLS (Transport Layer Security) certificates enable encrypted communication between clients and servers while also verifying the server's identity through certificate authorities (CAs).

Answer: c) Preparation

Explanation: The first phase of the NIST incident response lifecycle is Preparation — having an incident response team, plan, tools, and training ready before an incident occurs.

Answer: b) Collecting, preserving, and analyzing evidence for legal proceedings

Explanation: Digital forensics involves the proper collection, preservation, analysis, and presentation of digital evidence following chain of custody procedures.

Answer: b) Incremental backup

Explanation: Incremental backups copy only data changed since the last backup (full or incremental). They're fast and use minimal storage but require all incremental files for a full restore.

Answer: b) 3 copies, 2 different media types, 1 offsite

Explanation: The 3-2-1 backup rule: keep three copies of data (1 production + 2 backups) on two different storage media types, with one copy stored offsite.

Answer: b) Warm site

Explanation: A warm site has partially configured infrastructure (servers are installed but may need configuration, data restoration). RTO is longer than a hot site but shorter than a cold site.

Answer: b) Maximum acceptable data loss measured in time

Explanation: RPO (Recovery Point Objective) is the maximum acceptable amount of data loss measured in time (e.g., 4 hours). It determines backup frequency (more frequent backups = lower RPO).

Answer: a) Maximum acceptable time to restore operations

Explanation: RTO (Recovery Time Objective) is the maximum acceptable time that a service can be unavailable after a disaster before causing unacceptable business impact.

Answer: b) Implementing least privilege and role-based access control

Explanation: Identity management best practices include individual accounts, least privilege, role-based access control (RBAC), regular access reviews, and strong password/MFA policies.

Answer: a) A scripted response for handling specific security incidents

Explanation: A playbook documents step-by-step procedures for responding to specific security incidents (phishing, malware, ransomware, DDoS), ensuring consistent and effective response.

Answer: b) Detecting security incidents and investigating issues

Explanation: Logging and monitoring enable detection of security incidents, suspicious behavior, and system issues. Effective logging requires centralized aggregation (SIEM) and alerting.

Answer: a) Policies define what (rules); procedures define how (step-by-step)

Explanation: Security policies are high-level statements of management intent (what must be done). Procedures provide detailed step-by-step instructions (how to comply with policies).

Answer: a) Planning how to continue operations during and after a disaster

Explanation: BCP identifies critical business functions and plans how to maintain them during and after a disruptive event. It focuses on keeping the business running.

Answer: a) BCP focuses on continuing business operations; DRP focuses on IT recovery

Explanation: BCP (Business Continuity Plan) addresses how the entire organization continues critical functions. DRP (Disaster Recovery Plan) focuses specifically on restoring IT systems and data.

Answer: c) Transfer

Explanation: Risk transfer shifts the financial impact of a risk to a third party (e.g., cyber insurance). The risk still exists but the financial consequences are transferred.

Answer: b) Identifying, quantifying, and prioritizing vulnerabilities in a system

Explanation: A vulnerability assessment systematically identifies and categorizes security weaknesses in systems, networks, and applications, providing a prioritized list for remediation.

Answer: a) Vulnerability assessment identifies vulnerabilities; penetration test exploits them

Explanation: Vulnerability assessments are automated scans to identify potential vulnerabilities. Penetration testing actively attempts to exploit real vulnerabilities to determine actual risk.