CompTIA Security+ — All Questions

Attackers exploit a flaw in widely used software before the vendor is even aware of it, so no patch exists. What is this called?

• a.A zero-day vulnerability✓
• b.An end-of-life condition
• c.A misconfiguration
• d.A supply chain compromise

A zero-day is a previously unknown vulnerability with no available patch, giving defenders zero days to prepare. Attackers value it because existing defenses may not detect the exploit. Segmentation and behavioral detection provide compensating protection.

An attacker captures a valid session token from unencrypted traffic and reuses it to access the victim's authenticated account. This is a:

• a.Buffer overflow
• b.Distributed denial-of-service attack
• c.SQL injection
• d.Session replay attack✓

A replay attack captures a valid credential or token and resubmits it to gain unauthorized access. Unencrypted sessions and predictable tokens make it possible. Encryption, nonces, and short-lived tokens defeat replay.

An attacker overwhelms a switch's address table with thousands of fake MAC addresses, causing it to broadcast traffic to all ports. Which attack is this?

• a.Evil twin
• b.MAC flooding✓
• c.DNS poisoning
• d.A reflected amplification attack

MAC flooding fills a switch's content addressable memory with bogus addresses, forcing it to fail open and broadcast frames, which the attacker can then sniff. It exploits limited table size. Port security limiting learned MACs prevents it.

A penetration test flags that an application still protects passwords using unsalted MD5. Why is this a vulnerability?

• a.MD5 encrypts data so strongly that recovering forgotten passwords becomes impossible
• b.MD5 requires specialized hardware security modules that most servers do not include
• c.MD5 is cryptographically broken and, unsalted, is highly vulnerable to fast cracking✓
• d.MD5 is far too slow, which noticeably degrades the application's login performance

MD5 is a deprecated hash with known collision weaknesses, and without salting it is quickly cracked using precomputed tables. Password storage should use slow, salted algorithms like bcrypt or Argon2. Using broken cryptography is a recognized vulnerability.

A recently fired administrator uses retained credentials to sabotage systems out of anger. What is the primary motivation?

• a.Revenge✓
• b.Espionage
• c.Ethical
• d.Financial gain

Revenge motivates a disgruntled individual to cause harm, often after a perceived wrong such as termination. Prompt deprovisioning of access on offboarding is the key control. Motivation helps predict insider risk.

An analyst finds that a server's security logs stop for a two-hour window that coincides with suspicious file changes. Which indicator does the gap represent?

• a.Excessive resource consumption from an unauthorized cryptocurrency mining process
• b.Missing logs suggesting an attacker cleared traces of their activity✓
• c.A blocked-content event where the web filter denied access to a prohibited site
• d.Impossible travel between two logins occurring in an implausibly short timeframe

Missing or gapped logs are a red flag that an attacker may have deleted records to hide activity. The gap aligning with suspicious changes strengthens that inference. Centralized, tamper-resistant logging preserves evidence.

A device is compromised through an unauthenticated Bluetooth pairing exploit while in a crowded public space. Which category of attack vector is this?

• a.A message-based vector
• b.A default-credential vector
• c.A supply chain vector
• d.An unsecure network vector✓

Unsecure network vectors include wired, wireless, and Bluetooth connections that lack proper protection. Open or weakly secured Bluetooth can allow unauthorized pairing and exploitation. Disabling unused radios and requiring authentication reduce exposure.

An attacker convincingly poses as a specific senior manager and pressures IT to reset that manager's password. Which technique is central to this attack?

• a.Tailgating
• b.Impersonation✓
• c.Dumpster diving
• d.Shoulder surfing

Impersonation involves pretending to be a specific, often authoritative person to manipulate a target into acting. The claimed identity and urgency pressure the help desk to comply. Strong identity verification procedures defeat it.

Opening a spreadsheet enables its embedded macros, which then infect the user's template so every new file carries the malicious code. Which malware type is this?

• a.A worm
• b.A rootkit
• c.A macro virus✓
• d.A denial-of-service tool

A macro virus embeds in documents and executes through the application's macro feature, often spreading via shared templates and files. It requires the user to enable or run the macro. Disabling macros by default and user caution mitigate it.

A trusted software vendor's update mechanism is subverted so that a signed update secretly installs a backdoor on all customers. Which risk does this exemplify?

• a.A brute-force attack that guessed the update server's administrative password
• b.A cross-site scripting flaw in the vendor's public customer support web portal
• c.A misconfiguration where an administrator mistakenly exposed an internal service
• d.A supply chain attack through a compromised software update✓

Subverting a vendor's build or update process to distribute malicious code is a supply chain attack that abuses established trust. A single tainted update can reach many organizations at once. Code signing integrity and vendor assurance help defend against it.

Attackers gain access to a company's domain registrar account and change its DNS records to point the website and email to their own servers. This is:

• a.Hash collision
• b.A deauthentication attack
• c.Domain hijacking✓
• d.MAC flooding

Domain hijacking takes control of a domain's registration or DNS configuration, letting attackers redirect web and email traffic. It often follows a registrar account compromise. Registrar locks and strong account security prevent it.

A batch of network devices is found to contain an unauthorized chip added during manufacturing that could exfiltrate data. Which vulnerability category is this?

• a.An end-of-life condition
• b.A hardware supply chain compromise✓
• c.A zero-day OS flaw
• d.A software misconfiguration applied by the receiving organization after delivery

Hardware supply chain compromises insert malicious components during manufacturing or distribution before the product reaches the buyer. Such implants are hard to detect and abuse deep trust. Trusted suppliers and hardware inspection reduce the risk.

Which set of characteristics is the strongest indicator that an email is a phishing attempt?

• a.A calendar invite from a coworker whose address matches the corporate directory
• b.A digitally signed message from a known colleague sent during normal business hours
• c.An internal newsletter with no links, delivered on its regular weekly schedule again
• d.Urgent tone, a mismatched sender domain, and a link to an unfamiliar login page✓

Classic phishing indicators include manufactured urgency, sender addresses that do not match the claimed organization, and links to unexpected credential pages. Recognizing these cues lets users avoid the lure. Reporting suspicious mail improves defenses.

After remediation, responders discover the attacker left a hidden service that allows them to return later without authenticating normally. What is this called?

• a.A logic bomb
• b.A backdoor✓
• c.A rogue access point
• d.Adware

A backdoor provides covert, persistent access that bypasses normal authentication, letting an attacker return at will. It is often installed to survive initial remediation. Thorough eradication and integrity monitoring are needed to remove it.

An intrusion shows an attacker maintaining stealthy access for over a year, moving slowly and avoiding detection while collecting sensitive data. This dwell pattern is most characteristic of:

• a.A hacktivist
• b.An unskilled attacker
• c.An advanced persistent threat✓
• d.An opportunistic criminal seeking a quick payout

Advanced persistent threats, often nation-state actors, prioritize long-term stealthy access and patient data collection. Extended dwell time with low-and-slow tactics is a defining trait. Detecting them requires behavioral analytics and threat hunting.

An attacker posts flyers with QR codes that lead to a credential-harvesting site disguised as a parking payment portal. Which emerging technique is this?

• a.Vishing conducted over the phone using a spoofed caller identity and a pretext
• b.Quishing, which is phishing delivered through a malicious QR code✓
• c.Tailgating into a restricted area behind an employee holding a valid access badge
• d.A logic bomb embedded in the parking system to execute on a future trigger date

Quishing uses QR codes to direct victims to malicious sites, exploiting trust and the fact that the destination is hidden until scanned. It sidesteps some link filters. Previewing the URL and using caution with public QR codes helps.

An organization worries that staff installing apps from outside the official store could introduce malware. Which practice raises this specific risk?

• a.Sideloading applications from unofficial or unverified sources✓
• b.Enrolling all devices in mobile device management for centralized policy control
• c.Enforcing screen locks with a strong passcode and a short inactivity timeout
• d.Requiring full-disk encryption on every mobile device that stores any company data

Sideloading installs apps from sources outside the vetted official store, bypassing the platform's app review. This raises the chance of installing malicious or trojanized software. Restricting installation sources through MDM reduces the risk.

To slow attackers who steal a password database, developers deliberately use a hashing scheme that is computationally expensive per guess. What is this defensive technique called?

• a.Key stretching✓
• b.Certificate pinning
• c.Tokenization
• d.Steganography

Key stretching applies a deliberately slow, resource-intensive function so each password guess costs more, blunting brute-force and dictionary attacks. Algorithms like bcrypt, scrypt, and PBKDF2 implement it. Combined with salting, it strengthens stored credentials.

A company discovers that internal server names and employee emails are freely searchable online, aiding attacker reconnaissance. This exposure is an example of:

• a.A race condition exploiting the timing gap between a check and a subsequent use
• b.A zero-day vulnerability with no vendor patch available to remediate it just yet
• c.Information available through open-source intelligence✓
• d.A downgrade attack forcing negotiation of a weaker cryptographic protocol version

Open-source intelligence (OSINT) is information gathered from publicly available sources, which attackers use during reconnaissance. Exposed names and emails ease targeting and phishing. Limiting public exposure and monitoring for leaks reduce the aid to attackers.

A phishing email succeeds largely because it claims an account will be closed within one hour unless the recipient acts immediately. Which social engineering principle is being exploited?

• a.Authority
• b.Urgency✓
• c.Trust
• d.Social proof

Urgency pressures victims to act quickly before thinking critically, a core social engineering principle. Artificial deadlines short-circuit careful verification. Training users to slow down and verify defeats manufactured urgency.

In a zero trust architecture, which component makes the access decision by evaluating policy against a request's context?

• a.The workload's data plane
• b.A perimeter firewall
• c.The policy engine in the control plane✓
• d.The end user's device, which self-certifies that it should be trusted

In zero trust, the control plane's policy engine evaluates identity, device posture, and context to decide whether to grant access. The data plane then enforces that decision on traffic. Separating decision from enforcement is central to the model.

Which zero trust component actually allows or blocks the connection once the policy decision is made?

• a.The policy administrator, which relays decisions and configures the session
• b.The policy engine
• c.The certificate authority
• d.The policy enforcement point✓

The policy enforcement point (PEP) sits in the data path and enforces the allow-or-deny decision produced by the policy engine and administrator. It is where access is physically granted or blocked. This division keeps decision logic separate from enforcement.

A zero trust design continuously re-evaluates trust and narrows what each authenticated session can reach. Which paired concepts describe this?

• a.Implicit trust zones combined with a single one-time login valid for the whole day
• b.Adaptive identity and threat scope reduction✓
• c.Perimeter-only defense combined with unrestricted lateral movement once already inside
• d.Flat network design combined with permanent, static access rights for all of the users

Adaptive identity adjusts trust based on real-time context, while threat scope reduction limits the blast radius of any single session. Together they minimize what a compromised session can do. Both are core zero trust concepts.

A customer assumes the cloud provider will encrypt their stored data, but a breach reveals the customer was responsible for that setting. Which document clarifies these boundaries?

• a.A service level agreement
• b.The cloud responsibility matrix✓
• c.A memorandum of understanding between two partner organizations
• d.A business impact analysis

The responsibility matrix documents which security duties belong to the provider versus the customer across the stack. Misreading it is a frequent cause of cloud breaches. Reviewing it prevents assumptions about who secures what.

A DevOps team defines its entire cloud network and firewall configuration in version-controlled template files that can be redeployed identically. What is this practice?

• a.Shadow IT
• b.Infrastructure as code✓
• c.Data sovereignty, which governs the jurisdiction whose laws apply
• d.A honeynet

Infrastructure as code (IaC) provisions and manages infrastructure through machine-readable definition files rather than manual configuration. It brings consistency, versioning, and repeatability, reducing configuration drift. Reviewing the code catches misconfigurations before deployment.

An architecture decomposes an application into many small, independently deployed services communicating over the network. Which security consideration grows most with this microservices approach?

• a.The removal of all logging requirements because each service is small and simple to run
• b.The complete elimination of any need for authentication between the internal services
• c.A larger attack surface from many exposed service interfaces requiring protection✓
• d.A guarantee that a compromise of one service can never affect any other service at all

Microservices multiply the number of network-exposed interfaces, enlarging the attack surface and the need for service-to-service authentication and monitoring. Each API must be secured. Consistent access control and observability across services are essential.

Over time, an organization accumulates hundreds of forgotten, unpatched virtual machines that no one actively manages. Which risk does this describe?

• a.Data sovereignty
• b.VM sprawl✓
• c.VM escape
• d.A screened subnet

VM sprawl is the uncontrolled growth of virtual machines beyond what can be tracked and maintained. Forgotten, unpatched VMs become vulnerable entry points. Lifecycle management and inventory controls keep sprawl in check.

Where should an organization place its public-facing web server so a compromise does not directly expose the internal network?

• a.In a screened subnet between the internet and the internal network✓
• b.Outside all firewalls with a public address and no filtering of inbound connections
• c.On the same segment as the domain controllers to simplify authentication traffic flow
• d.Directly on the internal LAN alongside employee workstations for easier management

A screened subnet isolates internet-facing servers so that compromising one does not grant direct access to the internal network. Firewalls control traffic on both sides of the zone. Proper device placement limits the blast radius of a public host breach.

Administrators must reach servers in a sensitive segment only through one hardened, heavily logged host. What is this host called?

• a.A load balancer
• b.A honeypot
• c.A reverse proxy
• d.A jump server✓

A jump server (bastion host) is a hardened intermediary through which administrators access protected segments. Centralizing and logging admin access there reduces exposure and aids monitoring. It must itself be tightly secured as a gateway.

A security appliance is configured so that if it stops functioning, all traffic is blocked rather than allowed through. This design choice is called:

• a.Port mirroring
• b.Fail-open
• c.Fail-closed✓
• d.Load balancing

A fail-closed (fail-secure) design denies traffic when the control fails, favoring security over availability. Fail-open does the opposite, allowing traffic to preserve availability. The choice depends on whether security or uptime is the priority.

A network sensor is deployed to receive a copy of traffic through a mirror port so it can observe without sitting in the traffic path. This deployment is:

• a.A fail-closed configuration
• b.An inline mode that can block malicious packets in the forwarding path
• c.A passive tap or monitor mode✓
• d.A proxy configuration

A tap or monitor (passive) deployment receives copied traffic and can observe or alert but cannot block, since it is not in the forwarding path. Inline devices, by contrast, can drop traffic. Passive placement avoids becoming a point of failure.

To protect a web application from SQL injection and cross-site scripting, which control inspects HTTP requests at the application layer?

• a.A web application firewall✓
• b.A load balancer
• c.A packet-filtering firewall
• d.A network tap

A web application firewall (WAF) inspects HTTP and HTTPS traffic at the application layer to block attacks like injection and cross-site scripting. It understands web request structure that a basic firewall does not. It complements, rather than replaces, network firewalls.

Which device combines stateful firewalling with integrated intrusion prevention, deep packet inspection, and application awareness in one platform?

• a.A passive network tap
• b.A next-generation firewall✓
• c.A layer 2 switch
• d.A stateless access control list applied on a router interface

A next-generation firewall (NGFW) integrates traditional firewalling with deep packet inspection, application awareness, and intrusion prevention. This consolidated visibility enables policy based on applications and content, not just ports. It is a common perimeter and segmentation control.

A site-to-site VPN must authenticate and encrypt IP traffic between two office networks at the network layer. Which protocol suite is designed for this?

• a.SNMPv1
• b.HTTP
• c.SMTP
• d.IPSec✓

IPSec secures IP communications by authenticating and encrypting packets at the network layer, making it well suited to site-to-site VPNs. It provides confidentiality, integrity, and authentication. It commonly uses IKE to negotiate keys and security associations.

An organization wants to converge networking and security, delivering firewall, secure web gateway, and zero trust access from the cloud to remote sites and users. Which model fits?

• a.Secure access service edge✓
• b.A single on-premises perimeter firewall
• c.A screened subnet
• d.An air-gapped network

Secure access service edge (SASE) converges networking and security functions into a cloud-delivered service close to users and sites. It combines capabilities like SD-WAN, secure web gateway, and zero trust access. This suits distributed workforces better than backhauling traffic.

Sensitive records are encrypted on disk but are decrypted into memory while an application processes them. Which data state is hardest to protect in this moment?

• a.Data at rest
• b.Data in use✓
• c.Data in transit
• d.Cold data

Data in use is the most challenging state to protect because the information must be decrypted in memory to be processed. Techniques like confidential computing and strict memory protections address it. At rest and in transit are more readily secured with encryption.

A support tool must display only the last four digits of a customer's card number while hiding the rest with asterisks. Which technique is this?

• a.Data masking✓
• b.Hashing
• c.Steganography
• d.Full-disk encryption

Data masking obscures parts of a value, showing only what is needed, such as the last four digits, while hiding the rest. It reduces exposure in interfaces and reports. Unlike tokenization, the original is not replaced with a separate stored token.

An organization labels information as public, internal, confidential, or restricted to drive how each is handled and protected. What is this practice called?

• a.Data remanence
• b.Tokenization
• c.Data classification✓
• d.Data sovereignty, which fixes the governing jurisdiction

Data classification assigns sensitivity levels so that handling, access, and protection can be applied proportionally. Higher classifications warrant stronger controls. Clear labels make policy enforcement and compliance consistent.

A multinational must ensure certain citizens' personal data is stored only on servers physically located within their home country. Which concept governs this requirement?

• a.Data sovereignty✓
• b.High availability
• c.Load balancing
• d.Data masking

Data sovereignty means data is subject to the laws of the country where it is stored, which can mandate keeping it within specific borders. Geographic storage decisions must satisfy these legal requirements. Provider region controls help enforce it.

Two database servers are configured so that if the active one fails, the standby immediately takes over with the same data. Which resilience concept is this?

• a.High-availability clustering with failover✓
• b.Data classification
• c.Load balancing
• d.Network segmentation, which isolates zones to contain the spread of an attack

High-availability clustering pairs systems so a standby assumes operation if the active node fails, minimizing downtime. Failover is the automatic transfer of service. This differs from load balancing, whose primary aim is distributing load.

A recovery facility has hardware and network connectivity in place but needs current data restored and some configuration before it can run operations. Which site type is this?

• a.A hot site
• b.A cold site
• c.A warm site✓
• d.A mobile site delivered on a trailer and positioned wherever it is temporarily needed

A warm site has equipment and connectivity but requires restoring data and some setup before taking over, balancing cost and recovery speed. A hot site is faster but pricier, and a cold site is cheaper but slower. The choice reflects the RTO.

To survive a regional disaster such as a hurricane, an organization replicates its data and systems to a facility hundreds of miles away. Which principle is applied?

• a.Geographic dispersion✓
• b.Least privilege
• c.Network segmentation used to contain lateral movement inside one data center
• d.Tokenization

Geographic dispersion places recovery capabilities far enough away that a single regional event cannot affect both sites. This protects against disasters that would take out a local backup. Distance must balance latency against risk isolation.

A company keeps encrypted backup copies at a separate location so a fire at the primary site cannot destroy every copy. Which two backup considerations are being applied?

• a.Load balancing and clustering to keep the production systems continuously available
• b.Snapshot frequency and journaling to capture every individual database transaction
• c.Onsite storage and plaintext retention for the fastest possible restore performance
• d.Offsite storage and encryption of the backups✓

Storing backups offsite protects against site-wide disasters, and encrypting them protects confidentiality if the media is lost or stolen. Both are key backup considerations. The 3-2-1 approach also emphasizes multiple copies and media types.

To validate disaster recovery without disrupting production, a team brings up the recovery systems and processes real transactions on them alongside the live systems. Which test is this?

• a.A full-interruption test that shuts production down to force a live failover
• b.A tabletop exercise
• c.A vulnerability scan
• d.A parallel processing test✓

A parallel test runs recovery systems alongside production to confirm they work without taking production offline. It provides strong assurance with limited risk. A full-interruption test is more realistic but disruptive.

During a brief power flicker, which device provides immediate battery power to keep servers running until a longer-term source engages?

• a.A surge protector
• b.A standby generator
• c.A power distribution unit, which only allocates power already being supplied
• d.An uninterruptible power supply✓

An uninterruptible power supply (UPS) delivers instantaneous battery power during outages or fluctuations, bridging the gap until a generator starts. It also conditions power against spikes and sags. UPS plus generator gives both immediate and sustained backup.

Before deploying new laptops, an organization applies a documented standard configuration that disables unneeded services and enforces security settings. What is this standard called?

• a.A secure baseline✓
• b.A screened subnet
• c.A honeypot
• d.A recovery point objective

A secure baseline is a documented, standard secure configuration applied consistently to systems before deployment. It reduces attack surface and drift by starting every device from a known-good state. Benchmarks like CIS guide baseline creation.

Which environment typically prioritizes availability and safety over frequent patching, requiring careful segmentation because downtime can halt physical processes?

• a.A public cloud web application that scales elastically behind a managed load balancer
• b.A standard corporate email server that can be patched and rebooted on a weekly cycle
• c.A developer's laptop used for writing and testing application source code locally each day
• d.Industrial control systems and SCADA networks✓

ICS and SCADA systems control physical processes where downtime affects safety and operations, so patching windows are constrained. Strong network segmentation and strict access control compensate. Their legacy nature makes isolation essential.

A medical infusion pump runs a real-time operating system with limited memory and cannot easily accept traditional antivirus software. Which category and challenge does this represent?

• a.A virtual machine that can be snapshotted and rolled back at any convenient time needed
• b.A cloud-native container that can be redeployed instantly from an immutable base image
• c.A general-purpose server that can run any standard endpoint protection agent very easily
• d.An embedded system whose constraints limit traditional security controls✓

Embedded systems and their real-time operating systems have limited resources and long lifecycles, making conventional controls like antivirus impractical. Compensating controls such as segmentation and strict network filtering protect them. Vendor patching is often slow or unavailable.

A traditional network trusts any device once it is inside the corporate perimeter. Which weakness does zero trust specifically aim to remove?

• a.The presence of redundant components that keep services available during a failure
• b.The use of encryption for data transmitted across the untrusted public internet backbone
• c.The requirement that users authenticate at least once before accessing any resource
• d.Implicit trust granted based solely on network location✓

Zero trust eliminates implicit trust based on network location, since an attacker inside the perimeter would otherwise move freely. Instead it verifies every request by identity and context. This limits lateral movement after an initial breach.

In a public cloud, multiple customers share the same underlying physical hardware. Which security property must the provider guarantee between them?

• a.That all customers can freely read each other's data to ease collaboration
• b.That every customer manages the provider's physical data center access
• c.Strong logical isolation between tenants✓
• d.That all tenants share one key

Multitenancy means customers share infrastructure, so the provider must enforce strong logical isolation so one tenant cannot access another's data or workloads. A failure in isolation, such as VM escape, is a serious risk. Tenant boundaries are a core cloud security concern.