CompTIA Security+ Practice Test
Frequently asked questions
How many CompTIA Security+ practice questions are here?+
A full bank of original CompTIA Security+ practice questions across the official content areas, weighted like the real exam, with explanations. Free, no signup.
What is the CompTIA Security+ exam like?+
About 100 questions. Practice by topic here, then take the full timed mock exam to gauge readiness.
Are these the real exam questions?+
No. Every question is 100% original, written from public primary sources with explanations. We never copy real exam questions or paid prep material.
Can I study in Chinese or Spanish?+
PrepPass practice is in English, 中文 and Español. The official exam is in English — switch the question language to English any time to rehearse the exact terminology you'll see on test day.
Sample practice questions
A few real questions from this free bank, with full explanations. Use the practice tool above for the whole set.
- 1. Threats & Attacks
An attacker sends an email that appears to come from the company CEO, urgently asking the finance team to wire funds to a new vendor. What type of social engineering attack is this?
- a.Business email compromise
- b.Watering hole attack
- c.Tailgating
- d.Vishing
Answer: a
Explanation: Business email compromise (BEC) impersonates a trusted executive or partner to trick employees into transferring money or sensitive data. It relies on authority and urgency rather than malware. Because it uses legitimate-looking email, it often bypasses technical filters and targets human judgment.
- 2. Implementation
Which type of encryption uses the same key to encrypt and decrypt data?
- a.Asymmetric
- b.Hashing
- c.Symmetric
- d.Steganographic
Answer: c
Explanation: Symmetric encryption uses a single shared secret key for both encryption and decryption, such as AES. It is fast and suited to bulk data. The main challenge is securely distributing the shared key.
- 3. Security Operations
Which secure disposal method makes data on a drive unrecoverable by destroying the media physically?
- a.Deletion
- b.Defragmentation
- c.Formatting
- d.Physical destruction
Answer: d
Explanation: Physical destruction, such as shredding or degaussing, renders storage media and its data unrecoverable. Simple formatting or deletion can leave data recoverable. Destruction is preferred for highly sensitive media at end of life.
- 4. Threats & Attacks
A company's confidential files are exposed because a cloud storage bucket was set to allow public access. Which root cause best describes this?
- a.A zero-day vulnerability that no vendor patch could have prevented at the time
- b.A cryptographic weakness in the algorithm protecting the stored data at rest
- c.A security misconfiguration
- d.A supply chain compromise introduced through a tainted third-party dependency
Answer: c
Explanation: Misconfiguration is a leading cause of cloud data exposure, such as leaving storage publicly readable. The technology worked as configured; the settings were wrong. Secure baselines, automated checks, and least privilege prevent it.
- 5. Threats & Attacks
A company discovers that internal server names and employee emails are freely searchable online, aiding attacker reconnaissance. This exposure is an example of:
- a.A race condition exploiting the timing gap between a check and a subsequent use
- b.A zero-day vulnerability with no vendor patch available to remediate it just yet
- c.Information available through open-source intelligence
- d.A downgrade attack forcing negotiation of a weaker cryptographic protocol version
Answer: c
Explanation: Open-source intelligence (OSINT) is information gathered from publicly available sources, which attackers use during reconnaissance. Exposed names and emails ease targeting and phishing. Limiting public exposure and monitoring for leaks reduce the aid to attackers.
- 6. Security Architecture
A remote-access VPN is configured so that only traffic destined for corporate resources goes through the tunnel while general internet browsing goes out directly. This is:
- a.An air gap, which physically isolates the network from all external connections entirely
- b.A split tunnel
- c.A screened subnet, which hosts public-facing servers between two separate firewalls
- d.A full tunnel, which forces absolutely all of the client's traffic through the VPN link
Answer: b
Explanation: A split tunnel routes only corporate-bound traffic through the VPN while other traffic exits locally, improving performance but reducing inspection of general browsing. A full tunnel sends everything through the VPN for maximum control. The choice trades performance against visibility.
- 7. Governance & Compliance
When an employee leaves, the organization follows a checklist to disable accounts, revoke access, and collect equipment. Which governance element defines these steps?
- a.A standard specifying mandatory technical parameters such as the minimum password length
- b.A guideline offering optional, recommended best practices that staff may choose to follow
- c.A high-level policy stating only the organization's general commitment to protecting security
- d.An offboarding procedure
Answer: d
Explanation: An offboarding procedure gives the step-by-step actions for securely separating an employee, such as disabling accounts and recovering assets. Procedures translate policy into concrete, repeatable steps. Prompt offboarding prevents lingering access from becoming a threat.
- 8. Implementation
To stop attackers from feeding forged DNS responses to clients, an organization signs its DNS records so resolvers can cryptographically verify their authenticity. Which extension provides this?
- a.A web application firewall that inspects inbound HTTP requests for injection patterns
- b.A virtual private network that tunnels all client traffic back to the headquarters site
- c.Network address translation, which hides many internal hosts behind one public address
- d.DNSSEC
Answer: d
Explanation: DNSSEC adds digital signatures to DNS records so resolvers can verify responses are authentic and unmodified, defeating cache poisoning and spoofing. It provides origin authentication and integrity but not confidentiality. Signed records are what let a resolver trust an answer.
- 9. Implementation
A wireless network protects user passwords by wrapping the inner authentication inside a TLS tunnel established with only a server-side certificate. Which EAP method is this?
- a.EAP-TLS, which requires both the client and the server to present valid certificates
- b.PEAP
- c.EAP-MD5, which sends only a weak challenge-response with no protective outer tunnel
- d.PSK authentication, in which all clients share one identical static passphrase value
Answer: b
Explanation: Protected EAP (PEAP) builds a TLS tunnel using only a server certificate and then runs the inner authentication protected inside it. This shields credentials without requiring client certificates. Server-side certificate plus a protected inner method is the PEAP pattern.
- 10. Security Operations
A client hires testers and gives them no internal knowledge, network diagrams, or credentials, forcing them to discover everything as an outside attacker would. This engagement is:
- a.A white-box test, in which the testers are given full internal documentation and access
- b.A black-box (unknown environment) test
- c.A tabletop exercise, in which responders verbally discuss a hypothetical incident scenario
- d.A credentialed vulnerability scan run using valid login accounts on each of the target hosts
Answer: b
Explanation: In a black-box or unknown-environment test, testers receive no inside information and must discover the environment like a real external attacker. This realistically simulates an outsider but takes longer. Zero prior knowledge is what defines the black-box approach.
Own the complete CompTIA Security+ (SY0-701) guide — PDF + EPUB, $14.99 →