CompTIA Security+ — All Questions

An executive needs to send email that is both encrypted and digitally signed using certificate-based keys. Which standard provides this for email messages?

• a.DKIM signing
• b.DMARC
• c.SPF
• d.S/MIME✓

S/MIME uses certificates and key pairs to encrypt and digitally sign individual email messages, giving confidentiality, integrity, and authentication at the message level. SPF, DKIM, and DMARC authenticate the sending domain but do not encrypt the message body. Per-message signing and encryption are what S/MIME adds.

A team discovers two different files produce the same MD5 digest, letting an attacker substitute a malicious file undetected. What weakness does this demonstrate?

• a.A hash collision in a broken algorithm✓
• b.A downgrade attack forcing an older and weaker TLS protocol version
• c.A replay attack
• d.A brute-force attack

A hash collision occurs when two different inputs produce the same digest, and MD5 and SHA-1 are broken because collisions can be engineered. This lets an attacker swap a benign file for a malicious one with a matching hash. Using collision-resistant algorithms like SHA-256 prevents it.

Two users choose the identical password, yet their stored hashes differ because a unique random value was added to each before hashing. What is that per-password value?

• a.A salt✓
• b.A pepper
• c.A nonce
• d.An IV

A salt is a unique random value added to each password before hashing, so identical passwords yield different hashes and precomputed rainbow tables fail. A pepper, by contrast, is a single secret applied to all passwords. Per-password uniqueness is what distinguishes a salt.

TLS encrypts the bulk session with a fast symmetric key but uses the server's public key only to protect that symmetric key during setup. Combining both this way is known as:

• a.Steganography
• b.Hybrid encryption using a digital envelope✓
• c.An HMAC over the encrypted stream
• d.Key escrow, which deposits session keys with a third-party custodian

Hybrid encryption uses fast symmetric encryption for the data and slower asymmetric encryption only to protect the symmetric key, a pattern called a digital envelope. This captures the speed of symmetric crypto and the key-distribution ease of asymmetric crypto. TLS relies on exactly this combination.

To stop attackers from feeding forged DNS responses to clients, an organization signs its DNS records so resolvers can cryptographically verify their authenticity. Which extension provides this?

• a.A web application firewall
• b.A VPN
• c.Network address translation
• d.DNSSEC✓

DNSSEC adds digital signatures to DNS records so resolvers can verify responses are authentic and unmodified, defeating cache poisoning and spoofing. It provides origin authentication and integrity but not confidentiality. Signed records are what let a resolver trust an answer.

A site-to-site VPN must both encrypt payloads and authenticate them between two gateways, protecting the entire original IP packets. Which IPsec component and mode apply?

• a.The TLS record protocol
• b.GRE alone
• c.ESP in tunnel mode✓
• d.AH in transport mode

Encapsulating Security Payload (ESP) provides both encryption and authentication, and tunnel mode wraps the entire original IP packet, which suits gateway-to-gateway VPNs. AH authenticates but does not encrypt, and transport mode leaves original headers exposed. ESP plus tunnel mode meets both requirements.

A security review flags that servers still accept SSL 3.0 and TLS 1.0, enabling downgrade attacks. What is the recommended remediation?

• a.Enable every available protocol version so the widest possible range of clients can connect
• b.Replace the certificates with self-signed ones to sidestep protocol version negotiation
• c.Disable obsolete protocols and require TLS 1.2 or 1.3✓
• d.Rely only on the certificate's validity and ignore which protocol version was negotiated

Downgrade attacks force use of older, weaker protocols, so disabling SSL and early TLS and requiring TLS 1.2 or 1.3 removes the vulnerable options. Certificate validity is unrelated to the negotiated protocol version. Eliminating weak versions is what closes the downgrade path.

Network monitoring currently uses a version of SNMP that sends community strings in cleartext. Which version adds authentication and encryption for management traffic?

• a.Syslog over UDP
• b.SNMPv1
• c.SNMPv3✓
• d.NetFlow

SNMPv3 adds authentication and encryption, protecting management credentials and data that earlier versions sent in cleartext. Versions 1 and 2c rely on community strings exposed to sniffing. Upgrading to v3 secures the management plane.

A VoIP deployment must keep call audio confidential and protected from tampering in transit. Which protocol secures the media stream?

• a.SMTP over TLS
• b.SIP
• c.SNMP
• d.SRTP✓

Secure Real-time Transport Protocol (SRTP) encrypts and authenticates the audio and video media stream in VoIP, protecting call content. SIP handles signaling and needs its own protection, such as SIP over TLS. Securing the media, not just signaling, is SRTP's role.

A domain owner wants receiving servers to reject spoofed mail claiming to come from their domain and to receive reports on abuse. Which policy layer builds on SPF and DKIM to enforce this?

• a.OCSP
• b.S/MIME
• c.DMARC✓
• d.TLS

DMARC builds on SPF and DKIM, telling receivers how to handle messages that fail alignment and providing aggregate reports on abuse. It is what turns sender authentication into an enforceable, reportable policy. SPF and DKIM verify; DMARC decides and reports.

During an investigation, analysts find event times inconsistent across servers, making correlation impossible. Securing and synchronizing which service fixes this?

• a.Network Time Protocol✓
• b.Domain Name System
• c.Simple Mail Transfer Protocol
• d.Dynamic Host Configuration Protocol

Network Time Protocol (NTP) synchronizes clocks so log timestamps agree across systems, which is essential for correlating events during investigations. It should be secured because forged time can hide or misorder activity. Accurate, trusted time is the foundation of usable logs.

A firewall administrator prefers a secure file-transfer protocol that uses a single connection over one port, simplifying firewall rules. Which fits better than FTPS?

• a.TFTP
• b.SFTP over SSH✓
• c.HTTP
• d.Plain FTP, which negotiates a separate dynamic data port

SFTP runs over a single SSH connection on one port, so firewall rules are simple, unlike FTPS which uses separate control and dynamic data ports. Both are secure, but SFTP is friendlier to firewalls. Single-connection design is the practical advantage here.

To keep users' DNS lookups private from on-path observers on public Wi-Fi, a browser encrypts queries inside HTTPS. This technique is called:

• a.Split-horizon DNS
• b.Recursive resolution
• c.DNS over HTTPS✓
• d.A sinkhole

DNS over HTTPS (DoH) tunnels DNS queries inside HTTPS so on-path observers cannot see or tamper with lookups, improving privacy. DNS over TLS achieves similar protection on a dedicated port. Encrypting the query channel is what defeats passive DNS snooping.

Before a laptop plugged into a conference-room network jack gets access, a switch forces it to authenticate to a RADIUS server. Which standard enforces this port-based control?

• a.IEEE 802.1X✓
• b.WPA3, the current security standard for wireless client access
• c.NAT
• d.STP

IEEE 802.1X provides port-based network access control, requiring devices to authenticate through an authenticator to a RADIUS server before the port passes traffic. It works on both wired and wireless links. Authenticating at the port before granting access is its defining function.

A wireless network requires both the client and the server to present certificates, eliminating passwords entirely for the strongest mutual authentication. Which EAP method is this?

• a.PSK
• b.EAP-MD5, which offers only a weak one-way password hash
• c.EAP-TLS✓
• d.PEAP

EAP-TLS requires certificates on both the client and the server, providing mutual authentication without passwords, which makes it the strongest common EAP method. Managing client certificates is the operational cost. Mutual certificate authentication is what sets it apart from tunnel-only methods.

A hotel Wi-Fi redirects newly connected guests to a web page requiring them to accept terms before internet access is granted. What is this mechanism?

• a.A guest PSK
• b.A RADIUS federation trust
• c.An evil twin access point
• d.A captive portal✓

A captive portal intercepts new connections and forces users to a web page to authenticate or accept terms before granting access. It is common on guest and public networks. The forced redirect before access is the identifying behavior.

A remote laptop must filter inbound and outbound connections based on rules even when it is off the corporate network. Which control operates directly on that endpoint?

• a.A load balancer
• b.A network intrusion prevention system
• c.A screened subnet
• d.A host-based firewall✓

A host-based firewall runs on the endpoint itself, filtering traffic wherever the device is, including off the corporate network. Network firewalls protect only while traffic passes through them. Traveling with the device is the host firewall's advantage.

An endpoint agent not only detects malicious behavior on the host but actively blocks the offending process in real time. Which best describes it?

• a.A data loss prevention agent
• b.A host-based intrusion prevention system✓
• c.A host-based intrusion detection system, which only logs and alerts
• d.A SIEM platform

A host-based intrusion prevention system (HIPS) both detects and actively blocks malicious activity on the host, unlike a HIDS that only alerts. The distinction is the ability to stop, not merely observe. Inline prevention on the endpoint is the key trait.

To stop unknown executables from running, an administrator configures endpoints so only explicitly approved applications can launch and everything else is blocked. This is:

• a.Antivirus signature scanning
• b.Blocklisting
• c.Application allowlisting✓
• d.Sandboxing

Application allowlisting permits only approved programs to run and denies everything else, which stops unknown and zero-day executables by default. Blocklisting is the weaker inverse, blocking only known-bad items. Default-deny for applications is the strength of allowlisting.

A laptop is stolen while powered off, but the thief cannot read any data because the entire drive, including the operating system, was encrypted and unlocks only with the user's key. Which protection was in place?

• a.Full-disk encryption✓
• b.A host firewall
• c.Antivirus software
• d.A screen-lock timeout

Full-disk encryption renders the entire drive unreadable without the key, protecting data at rest if a powered-off device is stolen. A screen lock or firewall would not stop someone removing the drive. Encrypting the whole volume is what defeats offline data theft.

To ensure a device loads only firmware and bootloaders signed by trusted keys, blocking bootkits that load before the OS, an administrator enables which UEFI feature?

• a.Full-disk encryption
• b.A firewall
• c.Application allowlisting
• d.Secure Boot✓

Secure Boot verifies signatures on firmware and bootloaders so only trusted code runs during startup, blocking bootkits and rootkits that load before the OS. Disk encryption protects data but not the boot chain. Signature checking at boot is Secure Boot's purpose.

A company must enforce passcodes, push required apps, and remotely wipe hundreds of employee smartphones from one console. Which system provides this centralized control?

• a.A VPN client
• b.A host-based intrusion detection system
• c.Mobile device management✓
• d.A data loss prevention gateway

Mobile device management (MDM) centrally enforces policies, deploys apps, and can remotely lock or wipe enrolled devices. It gives administrators consistent control over a fleet of phones and tablets. Central lifecycle management is what defines MDM.

On employee-owned phones, a company isolates corporate email and files inside a managed, encrypted workspace separate from personal apps, so only that workspace can be wiped. This approach is:

• a.Geofencing
• b.Containerization✓
• c.Full-disk encryption
• d.A shared PSK

Containerization separates corporate data into a managed, encrypted workspace on a personal device, allowing selective wipe without touching personal content. This balances BYOD flexibility with corporate control. Isolating work data from personal data is its core benefit.

A logistics app automatically locks certain features whenever a company tablet leaves the warehouse's GPS boundary. Which control uses location this way?

• a.Geotagging
• b.Remote wipe
• c.Full-disk encryption
• d.Geofencing✓

Geofencing defines a virtual geographic boundary and changes device behavior based on whether the device is inside or outside it. Here it disables features off-site to reduce risk. Acting on GPS-defined location is the defining trait of geofencing.

An employee reports their corporate phone lost in a taxi. Which MDM action best prevents data exposure by erasing the device's contents immediately?

• a.Rotating the office wireless pre-shared key
• b.Forcing a password change on the user's cloud email account
• c.Remote wipe✓
• d.Geofencing

Remote wipe erases the device's data from the management console, preventing exposure if it cannot be recovered. It is the direct response to a lost or stolen managed device. Immediate data erasure is what protects the information.

An MDM policy blocks devices whose operating system protections have been bypassed to gain unrestricted privileges, since such devices can evade security controls. What condition is being detected?

• a.A longer screen-lock timeout interval
• b.An older but still vendor-supported operating system version
• c.Public Wi-Fi use
• d.Jailbreaking or rooting✓

Jailbreaking or rooting removes the OS's built-in security restrictions, letting apps run with full privileges and bypass controls. MDM detects and blocks such devices because they can no longer be trusted to enforce policy. The removal of platform protections is the risk being caught.

Thousands of internet-connected cameras were conscripted into a botnet because they all shipped with the same factory username and password. Which hardening step would most directly have prevented this?

• a.Exposing each camera's web interface directly to the internet
• b.Placing every camera on one flat network segment
• c.Changing the default credentials✓
• d.Enabling UPnP port forwarding

Default credentials are publicly documented, so leaving them lets attackers log in en masse, which is how large IoT botnets form. Changing them to unique strong passwords closes that trivial entry path. Removing known defaults is the single most impactful step here.

A medical infusion pump runs a real-time embedded OS that the vendor rarely patches and cannot run endpoint agents. Which compensating control best reduces its risk?

• a.Isolating it on a segmented network with strict access controls✓
• b.Installing a full endpoint detection and response agent directly onto the infusion pump
• c.Enabling full-disk encryption on the pump's very limited internal flash storage chip
• d.Requiring users to run frequent authenticated credentialed vulnerability scans against it

Embedded and legacy medical devices often cannot be patched or run agents, so network isolation and tight access control are the practical compensating controls. Segmentation limits what can reach the device and what it can reach. When you cannot fix the device, you constrain its exposure.

An industrial plant connects its operational technology control network to the corporate IT network for reporting, raising concern about attacks crossing over. Which architecture best limits this exposure?

• a.Directly bridging both networks so engineers can freely manage control systems from any desk
• b.An industrial DMZ segmenting OT from IT with controlled data flows✓
• c.Disabling all logging on the control systems to conserve their very limited processing power
• d.Assigning every industrial controller a public IP address for convenient remote vendor access

An industrial DMZ places a controlled buffer between OT and IT, brokering only necessary data flows and preventing direct access to control systems. This contains threats that reach IT from spreading into OT. Segmentation with a mediated boundary is the recommended pattern.

An IoT vendor wants to push firmware updates over the air while ensuring devices reject any update not produced by the vendor. Which mechanism should the device enforce?

• a.Allowing updates from any server on the local network to speed up the deployment
• b.Disabling updates entirely so the firmware can never be tampered with by anyone remotely
• c.Verifying a digital signature on the firmware before installing✓
• d.Accepting any update that is delivered over an encrypted TLS channel automatically

Requiring a valid digital signature ensures the firmware truly came from the vendor and was not altered before the device installs it. An encrypted channel protects transit but does not prove authorship. Signature verification is what authenticates the update's source and integrity.

Beyond ports and IP addresses, a firewall must identify and block specific applications like peer-to-peer file sharing and inspect encrypted traffic. Which firewall type provides this?

• a.A next-generation firewall✓
• b.A router ACL
• c.A stateful firewall
• d.A packet-filtering firewall

A next-generation firewall adds application awareness, deep packet inspection, and often TLS inspection and integrated intrusion prevention. This lets it identify and control specific apps rather than just ports. Application-layer visibility is what defines an NGFW.

A public web application keeps getting hit with SQL injection and cross-site scripting attempts. Which control specifically inspects HTTP requests to filter these application-layer attacks?

• a.A network intrusion detection sensor
• b.A web application firewall✓
• c.A load balancer
• d.A network firewall

A web application firewall inspects HTTP/HTTPS requests and filters application-layer attacks like SQL injection and cross-site scripting. Network firewalls operate lower in the stack and miss these payloads. Understanding web request content is what makes a WAF effective here.

To hide backend web servers and terminate TLS for inbound client requests, an organization places a device in front of its servers that accepts connections on their behalf. Which device is this?

• a.A reverse proxy✓
• b.A jump server
• c.A network intrusion detection sensor
• d.A forward proxy

A reverse proxy sits in front of servers, accepting client connections, hiding backend details, and often terminating TLS and load balancing. A forward proxy, by contrast, fronts clients making outbound requests. Serving on behalf of the servers is what makes it reverse.

Before granting network access, a system checks that a connecting device has current antivirus, required patches, and disk encryption, quarantining it if not. Which technology enforces this?

• a.A load balancer
• b.A screened subnet that hosts internet-facing services away from internal systems
• c.A reverse proxy
• d.Network access control✓

Network access control (NAC) checks device posture, such as patches, antivirus, and encryption, before admitting a device, quarantining or remediating non-compliant ones. This keeps unhealthy endpoints off the network. Posture assessment at admission is the NAC function.

To stop someone from unplugging a printer and connecting a rogue laptop or hub to a switch port, an administrator limits which and how many MAC addresses a port accepts. This is:

• a.Network address translation
• b.QoS marking
• c.Spanning Tree Protocol
• d.Port security✓

Port security restricts which MAC addresses, and how many, a switch port allows, blocking unauthorized devices or hubs plugged into the port. Violations can shut down or restrict the port. Controlling access at the physical switch port is its purpose.

Without buying more switches, a network team wants to logically separate finance and guest traffic on the same physical infrastructure. Which technology accomplishes this?

• a.Port forwarding
• b.VLANs✓
• c.Link aggregation
• d.NAT

Virtual LANs (VLANs) logically segment one physical switch infrastructure into separate broadcast domains, isolating traffic like finance from guest. This limits reach and contains issues without extra hardware. Logical separation on shared switches is the VLAN advantage.

So administrators can still reach and recover network devices even when the production data path is down or compromised, they use a physically separate management channel. This is:

• a.Out-of-band management✓
• b.A screened subnet
• c.In-band management, which shares the very links that carry production traffic
• d.A reverse proxy

Out-of-band management uses a dedicated, separate channel to reach devices independent of the production network, so admins retain access during outages or attacks. In-band management fails when the data path fails. Independence from the production path is the security benefit.

To block users from reaching known malicious or phishing domains, a company routes all lookups through a service that refuses to resolve blacklisted names. This control is:

• a.A VPN
• b.A load balancer
• c.Network address translation
• d.DNS filtering✓

DNS filtering, sometimes called protective DNS, refuses to resolve known malicious or unwanted domains, stopping connections before they start. It is a lightweight, broad control against phishing and malware callbacks. Blocking at name resolution is what makes it effective early.

Inbound mail should be scanned for malware, phishing links, and spam before reaching user inboxes, and outbound mail checked for data leakage. Which appliance performs this?

• a.An IDS sensor
• b.A WAF
• c.A network access control server
• d.A secure email gateway✓

A secure email gateway filters inbound and outbound mail for malware, phishing, spam, and data leakage before messages reach users or leave the organization. It is a focused control at the email boundary. Inspecting mail specifically is what distinguishes it from general network tools.

A wireless upgrade replaces the pre-shared key handshake with one resistant to offline dictionary attacks even when a weak passphrase is used. Which standard introduces this via SAE?

• a.WPA3✓
• b.Open authentication
• c.WPA2-Personal
• d.WEP

WPA3 replaces the PSK handshake with Simultaneous Authentication of Equals (SAE), which resists offline dictionary attacks even against weak passphrases. WPA2's four-way handshake could be captured and cracked offline. SAE's resistance to offline guessing is the major improvement.

Rather than sharing one Wi-Fi passphrase company-wide, an organization wants each employee to authenticate with their own credentials against a RADIUS server. Which wireless mode is required?

• a.WPA2/WPA3-Enterprise with 802.1X✓
• b.WPA2-Personal with one shared pre-shared key
• c.WEP with a static shared key
• d.An open guest network

Enterprise wireless mode uses 802.1X with a RADIUS server so each user authenticates individually, enabling per-user credentials, accounting, and revocation. Personal mode shares one key among all devices. Individual authentication is the reason Enterprise is required here.

At a coffee shop, an attacker broadcasts a Wi-Fi network using the same name as the legitimate one to lure clients into connecting through them. This attack is a(n):

• a.Jamming
• b.WPS brute-force attack
• c.Evil twin✓
• d.Deauthentication flood

An evil twin is a rogue access point that mimics a legitimate network's name to trick clients into connecting, enabling interception of their traffic. It relies on users trusting a familiar SSID. Impersonating the real network is the defining tactic.

A router feature meant to simplify setup lets clients join with an eight-digit PIN, but the PIN is brute-forceable in hours. Security guidance is to disable which feature?

• a.The 5 GHz radio band
• b.MAC address filtering
• c.SSID broadcasting
• d.Wi-Fi Protected Setup✓

Wi-Fi Protected Setup (WPS) uses an eight-digit PIN that is vulnerable to brute force because it is validated in two halves, so it should be disabled. Its convenience comes at a serious security cost. Turning WPS off removes this easily exploited weakness.

An attacker repeatedly sends spoofed management frames that kick clients off a wireless network, often to force reconnection to a rogue access point. This is a:

• a.Rainbow table attack
• b.SQL injection attack
• c.Deauthentication attack✓
• d.Cross-site scripting attack

A deauthentication attack forges management frames to disconnect wireless clients, which can cause denial of service or push victims onto an evil twin. Protected Management Frames mitigate it. Spoofing disconnect frames is the mechanism of the attack.

Before deploying access points in a new office, engineers map signal strength and interference to place APs and set power levels appropriately. This process is a:

• a.Business impact analysis
• b.Penetration test
• c.Wireless site survey✓
• d.Vulnerability scan

A wireless site survey measures signal coverage, interference, and capacity to plan access point placement and power settings. Good surveys prevent dead zones and rogue-AP opportunities from weak coverage. Mapping the RF environment is the purpose of the survey.

An administrator relies on allowing only known hardware addresses onto the Wi-Fi, but an attacker still gets on. Why is MAC filtering weak on its own?

• a.Because it requires every client to complete a certificate-based mutual handshake first
• b.Because it forces all of the devices on the network to share a single static pre-shared key
• c.Because MAC addresses can be sniffed and spoofed by an attacker✓
• d.Because MAC filtering encrypts the wireless traffic with an outdated and easily broken cipher

MAC addresses travel in cleartext and can be captured and spoofed, so an attacker can clone an allowed address to bypass filtering. It provides no real authentication or encryption. Being trivially forgeable is why MAC filtering is only a weak add-on.

A wireless network protects user passwords by wrapping the inner authentication inside a TLS tunnel established with only a server-side certificate. Which EAP method is this?

• a.EAP-TLS
• b.PEAP✓
• c.EAP-MD5
• d.PSK

Protected EAP (PEAP) builds a TLS tunnel using only a server certificate and then runs the inner authentication protected inside it. This shields credentials without requiring client certificates. Server-side certificate plus a protected inner method is the PEAP pattern.

A retail store offers customer Wi-Fi but must ensure guests cannot reach point-of-sale systems or each other. Which combination best achieves this?

• a.Placing the guests and the POS terminals together on one shared VLAN for simpler management
• b.Disabling all encryption on the guest network to reduce the processing overhead placed on the access points
• c.A separate guest VLAN with client isolation and firewall rules blocking internal access✓
• d.Publishing the POS network passphrase to guests so that support requests are easier to handle

A separate guest VLAN with client isolation stops guests from reaching each other, and firewall rules block access to internal systems like the POS. This layered segmentation protects cardholder systems from untrusted users. Isolating and restricting guest traffic is the correct design.

To defend against deauthentication and disassociation spoofing, a modern wireless standard cryptographically protects management frames. This feature is:

• a.SSID hiding
• b.Protected Management Frames✓
• c.MAC filtering, which restricts access to a preset list of hardware addresses
• d.Band steering

Protected Management Frames (802.11w) authenticate and protect management frames so attackers cannot forge deauthentication or disassociation messages. This directly counters common wireless denial-of-service tricks. Cryptographically protecting management frames is the defense.

In a zero-trust data center, an architect enforces security policies between individual workloads so even east-west traffic inside the same subnet is inspected and controlled. This granular approach is:

• a.Microsegmentation✓
• b.A flat network
• c.Perimeter security
• d.Port forwarding

Microsegmentation applies fine-grained policies between individual workloads, controlling east-west traffic that traditional perimeter firewalls never see. This limits lateral movement after a breach. Enforcing policy workload-to-workload is the zero-trust idea it implements.