Question 1
A payroll file is silently changed so an employee receives a higher salary. Which security goal is violated?
Unauthorized modification of data violates integrity, which ensures information is accurate and has not been altered.
CompTIA Security+ Practice
Practice 80 original CompTIA Security+ questions covering threats, vulnerabilities, architecture, identity, operations, and governance.
Answer each security question, then check your score. Wrong answers are saved locally for review.
Day streak: 0 days
Saved only on this device
Time left: 00:00
No wrong answers saved yet.
No questions match your filters.
Question 2
An employee receives an email that appears to come from IT and asks for a password due to "urgent account verification." Which attack is this?
Phishing uses deceptive email messages to trick users into revealing credentials or sensitive information.
Question 3
An attacker calls an employee, pretends to be from the help desk, and asks for a verification code. Which attack is this?
Vishing is voice phishing: attackers use phone calls and social engineering to obtain sensitive information.
Question 4
A user receives a text message with a link to a fake package tracking page. Which attack is this?
Smishing is phishing carried out through SMS or text messages.
Question 5
A campaign sends personalized emails to selected employees using their names, roles, and job context. Which attack is this?
Spear phishing targets specific individuals with customized messages. When senior executives are the targets, it is often called whaling.
Question 6
An attacker leaves a USB drive labeled "Salary Data" in a parking lot where employees will find it. Which social engineering technique is this?
Baiting offers something tempting, such as a labeled USB drive, to persuade a victim into an action that compromises security.
Question 7
An attacker follows an employee through a badge-controlled door without using a badge. Which technique is this?
Tailgating occurs when an unauthorized person follows an authorized person into a restricted area without credentials.
Question 8
An attacker watches a user type a PIN at an ATM. Which technique is this?
Shoulder surfing is observing someone enter credentials or other sensitive information, often by looking over their shoulder.
Question 9
A person recovers discarded documents containing account details from a trash bin. Which technique is this?
Dumpster diving is collecting information from discarded media and documents that were not securely destroyed.
Question 10
An attacker compromises a website that employees of a target company visit frequently. Which technique is this?
A watering hole attack infects a trusted site likely to be visited by the target group, then waits for victims to arrive.
Question 11
Malware encrypts files on a workstation and demands payment to restore them. Which type of malware is this?
Ransomware encrypts data or locks systems and demands payment, usually in cryptocurrency, to restore access.
Question 12
Malware appears to be a legitimate utility but installs a backdoor when executed. Which type of malware is this?
A Trojan disguises itself as legitimate software while performing malicious actions in the background.
Question 13
Which malware can spread automatically across networks without requiring user interaction?
Worms self-replicate and propagate across networks automatically, exploiting vulnerabilities or weak configurations.
Question 14
Which malware hides deep inside the operating system to maintain privileged access and evade detection?
A rootkit conceals its presence at the OS or kernel level and provides persistent privileged access to an attacker.
Question 15
A large group of compromised devices is used together to launch DDoS attacks. What is the group called?
A botnet is a network of compromised devices controlled remotely, often used for DDoS, spam, or credential attacks.
Question 16
Which symptoms may indicate malware infection? Select all that apply.
Malware often generates unexpected network activity, creates persistence through scheduled tasks or startup entries, and may encrypt or rename files. Certificate expiration is a normal lifecycle event, not a malware symptom.
Question 17
Which are social engineering techniques? Select all that apply.
Phishing, tailgating, and shoulder surfing manipulate human behavior. SQL injection exploits a database query flaw rather than human trust.
Question 18
An email-based attack that targets a specific person using their name and context is called ___ phishing.
Spear phishing is personalized phishing aimed at a specific individual or small group, often using names and job context to increase credibility.
Question 19
Match each social engineering attack to its channel.
Phishing uses email, vishing uses voice calls, smishing uses SMS, and whaling targets senior executives with email campaigns.
Question 20
Match each malware type to its behavior.
Ransomware encrypts files, worms self-replicate, Trojans disguise themselves, and rootkits hide privileged access.
Question 21
A vulnerability exists in software, no vendor patch is available, and an attacker exploits it the same day it becomes known. What is this called?
A zero-day is a previously unknown vulnerability that is exploited before the vendor has released a fix.
Question 22
Which standardized scoring system measures the severity of a vulnerability?
The Common Vulnerability Scoring System (CVSS) provides a numeric severity score. CVE is the vulnerability identifier system.
Question 23
What is the main difference between a vulnerability scan and a penetration test?
Vulnerability scanning detects known weaknesses non-destructively, while penetration testing attempts to exploit them to validate real-world impact.
Question 24
Why is a patch management process important?
Timely patch management closes known vulnerabilities before attackers can exploit them. It cannot guarantee protection against unknown zero-days.
Question 25
Which control best prevents SQL injection?
Parameterized queries separate SQL logic from user input, preventing attackers from changing the query structure.
Question 26
An attacker injects a script that executes in another user browser. What should the developer apply to prevent this?
Output encoding or escaping neutralizes injected script content, which is the core defense against cross-site scripting (XSS).
Question 27
Writing more data than a buffer can hold is known as what?
A buffer overflow occurs when data exceeds the allocated memory region, which can overwrite adjacent memory and enable code execution.
Question 28
An attacker forces a running process to load a malicious library. Which technique is this?
DLL injection inserts malicious code into a trusted process by making it load an attacker-controlled dynamic library.
Question 29
Which encryption method uses the same key to encrypt and decrypt data?
Symmetric encryption, such as AES, uses one shared secret key for both encryption and decryption.
Question 30
RSA uses which cryptographic model?
RSA is an asymmetric algorithm: one key encrypts or signs, and the paired key decrypts or verifies.
Question 31
Which cryptographic function provides integrity by producing a fixed-size digest?
Hashing, such as SHA-256, produces a fixed-size digest that changes when the input changes, allowing integrity verification.
Question 32
A document is signed with the sender private key. What does the recipient verify using the sender public key?
A digital signature verifies the sender identity and document integrity, and provides non-repudiation. It does not by itself keep content confidential.
Question 33
What is the purpose of a digital certificate in PKI?
A digital certificate is issued by a certificate authority and binds a public key to an identity such as a domain or person.
Question 34
A certificate is compromised before it expires. Which mechanisms allow clients to check its current status?
Certificate revocation lists (CRLs) and the Online Certificate Status Protocol (OCSP) let clients check whether a certificate has been revoked.
Question 35
Sending a secret key by email is unsafe because it travels in ___ text.
Plaintext delivery exposes the key during transit and storage. Secret keys should be exchanged only through approved secure channels and managed with proper key lifecycle controls.
Question 36
Which controls help verify data integrity? Select all that apply.
Hashing, digital signatures, and file integrity monitoring detect unauthorized changes. Port forwarding is a networking function, not an integrity control.
Question 37
Which practices reduce the risk of password cracking? Select all that apply.
Salted hashes slow offline cracking, lockout stops online guessing, and MFA limits the value of stolen passwords. Plaintext storage greatly increases risk.
Question 38
Match each cryptographic concept to its role.
Symmetric encryption uses one shared key, asymmetric encryption uses a key pair, hashing produces a fixed-size digest, and a digital certificate binds a public key to an identity.
Question 39
The protocol that provides real-time certificate status checks is abbreviated ___.
OCSP, the Online Certificate Status Protocol, returns current certificate revocation status without downloading a full CRL.
Question 40
Match each cryptographic technology to its typical use.
AES is symmetric encryption, RSA is asymmetric, SHA-256 is a hash, and digital signatures provide authenticity and non-repudiation.
Question 41
What does multi-factor authentication (MFA) require?
MFA requires at least two factors from different categories, such as knowledge, possession, and inherence.
Question 42
Which authentication factor is "something you have"?
A smart card or hardware token is a possession factor. Passwords and PINs are knowledge factors; fingerprints are inherence factors.
Question 43
Access is granted based on the user job role. Which access control model is this?
RBAC assigns permissions based on organizational roles rather than individual ownership or labels.
Question 44
Users should have only the permissions needed to perform their job. Which principle does this describe?
Least privilege grants the minimum permissions required for a role, limiting the impact of compromise.
Question 45
Which system is designed to protect, rotate, and audit administrative account credentials?
PAM controls privileged accounts with vaulting, session monitoring, rotation, and just-in-time access.
Question 46
What is a key benefit of using a password manager?
Password managers generate and store unique strong passwords, reducing reuse and improving account hygiene.
Question 47
A user signs in once and can access multiple applications without signing in again. Which technology is this?
SSO authenticates the user once and passes identity assertions to multiple applications, often using SAML or OIDC.
Question 48
Which device filters traffic based on a defined set of security rules?
A firewall inspects traffic and enforces allow or deny rules at network boundaries.
Question 49
What distinguishes an intrusion prevention system (IPS) from an intrusion detection system (IDS)?
An IDS detects and alerts on suspicious activity, while an IPS takes active action such as dropping or blocking the traffic.
Question 50
How does network segmentation limit the impact of an attack?
Segmentation contains breaches by restricting communication paths, so a compromised system has limited reach.
Question 51
Which network zone is designed to host public-facing services while protecting the internal network?
A demilitarized zone (DMZ) sits between the internet and the internal network and hosts services that must be reachable externally.
Question 52
Which control inspects web traffic and protects applications from attacks such as XSS and SQL injection?
A WAF filters HTTP/HTTPS requests and blocks common application-layer attacks before they reach the application.
Question 53
What is a VPN primarily used for?
A VPN protects data in transit by encapsulating and encrypting traffic between endpoints over untrusted networks.
Question 54
A security model assumes no user or device is trusted by default, even inside the network. Which model is this?
Zero trust verifies every access request continuously and grants the least privilege needed, regardless of network location.
Question 55
Which technology monitors endpoints and automatically responds to threats using behavioral detection?
EDR collects endpoint telemetry, detects suspicious behavior, and supports automated investigation and response.
Question 56
In the cloud shared responsibility model, which tasks typically remain the customer responsibility? Select all that apply.
Customers are generally responsible for guest OS, IAM, and data protection, while the provider secures the physical data center and underlying infrastructure.
Question 57
Which controls can help prevent lateral movement inside a network? Select all that apply.
Microsegmentation, NAC, and host-based firewalls restrict east-west traffic. Open internal traffic would make lateral movement easier.
Question 58
A security model that verifies every request before granting access is called ___ trust.
Zero trust requires verification for every access request and assumes no implicit trust.
Question 59
A hardware appliance that securely stores cryptographic keys and performs signing operations is called a hardware security ___.
A hardware security module (HSM) protects keys and performs cryptographic operations in tamper-resistant hardware.
Question 60
Match each security control to where it primarily operates.
A firewall protects the network perimeter, EDR protects endpoints, a WAF protects web applications, and an HSM protects cryptographic keys.
Question 61
What should an incident response team do first during an active security incident?
Incident response begins with protecting people and the organization, then moves to containment to limit damage.
Question 62
During an active ransomware outbreak, what is the first containment step?
Isolating infected systems stops ransomware from spreading and preserves the ability to recover and investigate.
Question 63
Why is chain of custody important in digital forensics?
Chain of custody records every transfer of evidence, proving that it was not altered and preserving legal admissibility.
Question 64
What should an investigator do before analyzing a forensic drive?
Imaging the original media with a write blocker preserves the evidence while analysis is performed on the copy.
Question 65
Which system collects and correlates logs from many sources for alerting and analysis?
A security information and event management (SIEM) system aggregates logs, correlates events, and generates alerts.
Question 66
Which log is most useful for detecting unauthorized account access?
Authentication logs record successful and failed login attempts, making them the primary source for access-related detection.
Question 67
What does a data retention policy define?
Retention policies specify storage duration, legal obligations, and destruction requirements for data and logs.
Question 68
Which regulation focuses on personal data protection for individuals in the European Union?
The General Data Protection Regulation (GDPR) governs personal data protection and privacy for EU individuals.
Question 69
Which standard specifically addresses the protection of cardholder data?
The Payment Card Industry Data Security Standard (PCI DSS) applies to organizations that store, process, or transmit cardholder data.
Question 70
How is risk typically calculated?
Risk is generally expressed as the likelihood of a threat exploiting a vulnerability multiplied by the resulting impact.
Question 71
An organization purchases cyber insurance to handle potential financial losses. Which risk strategy is this?
Risk transfer shifts the financial impact to another party, such as an insurance provider.
Question 72
What is the main purpose of a business continuity plan (BCP)?
A BCP maintains essential business operations during disruptions, while a disaster recovery plan restores IT systems and data.
Question 73
Which metric defines the maximum tolerable data loss, measured in time?
RPO measures how much data loss is acceptable, usually expressed as the maximum age of data that must be recoverable.
Question 74
Which metric defines the maximum time allowed to restore operations after a disaster?
RTO is the target time within which systems and operations must be restored after disruption.
Question 75
A team walks through a scenario to review incident procedures without deploying changes. Which exercise is this?
A tabletop exercise is a discussion-based simulation that tests plans, roles, and decision-making without production impact.
Question 76
Which practices support forensic evidence integrity? Select all that apply.
Chain of custody, write blockers, and hashing preserve evidence integrity. Analyzing the original drive risks altering it.
Question 77
Which controls reduce insider threat risk? Select all that apply.
Least privilege, behavior analytics, and DLP detect and limit risky insider activity. Open shared folders increase the risk.
Question 78
The maximum acceptable data loss measured in time is the recovery point ___.
The recovery point objective (RPO) defines the maximum tolerable data loss, measured by the age of the recovered data.
Question 79
The documented sequence of evidence custody is called the chain of ___.
Chain of custody records every person who handled evidence and every transfer, preserving its integrity and admissibility.
Question 80
Match each incident response phase to its main action.
Preparation builds readiness, detection identifies incidents, containment and eradication stop the threat before recovery restores services, and post-incident activity captures lessons learned.