CompTIA Security+ — All Questions

A cloud team defines servers and firewall rules in version-controlled templates so every deployment is identical and reviewable. Which security benefit does infrastructure as code most directly provide?

• a.It guarantees that the deployed systems will never need to be patched after being provisioned
• b.It removes the requirement to monitor or log any activity occurring on the deployed resources
• c.It enforces consistent, auditable configurations and reduces configuration drift✓
• d.It encrypts all of the data at rest automatically without requiring any key management effort

Infrastructure as code produces repeatable, reviewable deployments so environments are consistent and drift is reduced, and changes are tracked in version control. Misconfigurations can be caught in review before deployment. Consistency and auditability are its core security value.

To stop developers from accidentally creating a publicly readable storage bucket, a cloud platform automatically blocks or flags such configurations at deployment. This automated preventive control is a:

• a.A honeypot
• b.A hot site
• c.Guardrail (policy-as-code)✓
• d.Annual security awareness training

A guardrail, often implemented as policy-as-code, automatically prevents or flags risky configurations like public buckets before they take effect. It bakes security policy into the deployment pipeline. Automated enforcement of policy at deploy time is what defines it.

A build pipeline automatically scans source code for vulnerabilities before each release is deployed. Testing the code without executing it, by examining the source directly, is called:

• a.Dynamic application security testing
• b.Penetration testing
• c.Static application security testing✓
• d.Fuzz testing of the running app

Static application security testing (SAST) analyzes source code without running it, catching flaws early in development. Dynamic testing, by contrast, requires a running application. Examining code at rest is what makes SAST static.

A security tool interacts with a deployed web application, sending crafted inputs to observe how the live system responds and reveal runtime flaws. This testing method is:

• a.Static analysis
• b.A software bill of materials listing every third-party component and version
• c.A tabletop exercise
• d.Dynamic application security testing✓

Dynamic application security testing (DAST) exercises a running application with crafted inputs to find runtime and configuration flaws that only appear during execution. It complements static analysis, which sees code but not runtime behavior. Testing the live app is the DAST approach.

After a widely-used logging library was found vulnerable, security teams scrambled to learn where it was embedded. Which artifact would have let them instantly identify affected software?

• a.A business impact analysis
• b.A data retention schedule
• c.A certificate revocation list
• d.A software bill of materials✓

A software bill of materials (SBOM) inventories every component in software, so teams can instantly find where a vulnerable library is used. Without it, locating affected systems is slow and error-prone. Component transparency is exactly what an SBOM provides.

During a breach, confusion arises over who declares an incident, who talks to regulators, and who leads technical containment. Which document should have defined these responsibilities in advance?

• a.An incident response plan✓
• b.A memorandum of understanding
• c.A service level agreement
• d.An acceptable use policy

An incident response plan defines roles, responsibilities, and procedures before an incident, so responders act decisively rather than improvising. Predefined ownership of decisions and communications prevents chaos. Preparing these roles in advance is the plan's purpose.

Regulations require notifying affected individuals within a set window after a data breach is confirmed. Which part of incident preparation ensures this happens correctly and on time?

• a.A disaster recovery hot site
• b.A network segmentation design
• c.A vulnerability scanning schedule that runs authenticated scans each quarter
• d.A predefined communication and notification plan✓

A communication and notification plan predefines who must be told, how, and by when, so legal and regulatory deadlines are met during the stress of an incident. Improvising notifications risks missed deadlines and penalties. Planned communications ensure timely, correct disclosure.

Two weeks after resolving a ransomware incident, the team meets to document what worked, what failed, and how to prevent recurrence. Which incident response phase is this?

• a.Eradication
• b.Lessons learned✓
• c.Preparation, in which tools, training, and playbooks are readied in advance
• d.Containment

The lessons learned phase reviews the incident after recovery to improve future response and close the gaps that were exposed. It feeds back into preparation, making the process cyclical. Turning experience into improvement is the point of this phase.

On discovering an actively compromised workstation still communicating with a command-and-control server, the responder's immediate priority is to:

• a.Notify every customer publicly before the actual scope of the compromise is even confirmed
• b.Immediately rebuild the workstation from scratch before capturing any forensic evidence
• c.Wait and passively observe the attacker for several more weeks before taking any action
• d.Isolate the host from the network to stop the attacker's communication✓

Containment through isolation immediately cuts the attacker's command-and-control channel and stops further damage or spread. Rebuilding first would destroy evidence, and public notice before scope is known is premature. Halting active harm is the first responder priority.

After recovering from repeated incidents caused by the same unpatched service, management insists the team identify and fix the underlying reason, not just the symptoms. This analysis is called:

• a.Chain of custody
• b.Root cause analysis✓
• c.A penetration test
• d.A business impact analysis

Root cause analysis finds the underlying reason an incident occurred so the fix prevents recurrence rather than treating symptoms. Repeated incidents signal an unaddressed root cause. Eliminating the source is what distinguishes it from a quick patch.

A threat report lists specific malicious file hashes, IP addresses, and domains associated with an active campaign so defenders can search their environment. These artifacts are called:

• a.Recovery point objectives
• b.Indicators of compromise✓
• c.Rules of engagement
• d.Service level objectives

Indicators of compromise (IOCs) are observable artifacts like hashes, IPs, and domains tied to malicious activity, used to hunt for and detect intrusions. Defenders match them against logs and endpoints. Concrete evidence of specific threats is what IOCs provide.

Rather than waiting for alerts, analysts proactively form a hypothesis about how an attacker might operate and search logs for evidence of it. This proactive practice is:

• a.Vulnerability scanning
• b.Signature-based detection
• c.Threat hunting✓
• d.Red teaming

Threat hunting is proactive, hypothesis-driven searching for adversaries that automated tools have not flagged. It assumes a breach may already exist and looks for subtle evidence. Actively seeking hidden threats is what separates it from passive alerting.

A SOC maps observed adversary behaviors to a standardized knowledge base of tactics and techniques to understand its coverage gaps. Which framework are they using?

• a.MITRE ATT&CK✓
• b.PCI DSS
• c.OWASP
• d.The NIST Cybersecurity Framework

MITRE ATT&CK is a knowledge base of real-world adversary tactics and techniques used to map detections and find coverage gaps. It gives teams a common language for attacker behavior. Behavior-based mapping is what makes it useful for measuring defensive coverage.

An analyst gathers freely available information about a threat actor from public reports, forums, and social media to enrich an investigation. This intelligence source is:

• a.Open-source intelligence✓
• b.Classified government intelligence
• c.Internal app logs
• d.A proprietary paid feed

Open-source intelligence (OSINT) is gathered from publicly available sources such as reports, forums, and social media. It is low-cost and broad but must be validated for reliability. Sourcing from public information is what makes it OSINT.

Anticipating litigation, counsel directs IT to suspend the routine deletion of certain emails and files so potential evidence is preserved. This directive is a:

• a.An SLA
• b.Data retention schedule
• c.Non-disclosure agreement
• d.Legal hold✓

A legal hold suspends normal data destruction to preserve information that may be relevant to litigation or investigation. Deleting data under hold can lead to spoliation penalties. Preserving potential evidence against routine deletion is its purpose.

To ensure any analyst handles a malware alert the same proven way, the SOC documents step-by-step response procedures for that specific scenario. This document is a:

• a.An incident response playbook✓
• b.A business continuity plan
• c.A memorandum of understanding
• d.A risk register

An incident response playbook gives step-by-step procedures for a specific scenario so responses are consistent and repeatable regardless of who responds. It reduces improvisation under pressure. Scenario-specific, repeatable steps are what define a playbook.

During evidence collection on a live system, a forensic analyst captures the contents of RAM and running network connections before imaging the hard drive. Which principle drives this sequence?

• a.Chain of custody
• b.Dual control
• c.Order of volatility✓
• d.The recovery time objective

Order of volatility dictates collecting the most transient evidence first, such as memory and active connections, before more persistent data like disks. Volatile data disappears when power or state changes. Preserving fleeting evidence first is the principle at work.

Before analyzing a seized hard drive, an examiner connects it through a device that allows reading but physically prevents any writes to the original media. This device is a:

• a.A honeypot
• b.A write blocker✓
• c.A hardware security module
• d.A load balancer

A write blocker permits reading the original evidence media while preventing any writes, preserving its integrity so findings remain admissible. Any modification could taint the evidence and the investigation. Read-only access to the original is exactly what it guarantees.

Rather than copying visible files, a forensic tool creates an exact bit-for-bit duplicate of an entire drive, including deleted-file remnants and slack space. This copy is a:

• a.A differential backup
• b.A forensic image✓
• c.A snapshot
• d.A logical backup

A forensic image is a bit-for-bit copy capturing everything on the drive, including deleted data and slack space that ordinary backups omit. Analysts work from the image to protect the original. Complete, exact duplication is what makes it forensically sound.

Investigators recover a photo and examine its embedded creation time, GPS coordinates, and device model to establish where and when it originated. This embedded data is called:

• a.A digital signature
• b.Steganographic content
• c.A hash
• d.Metadata✓

Metadata is data about the file, such as timestamps, GPS coordinates, and device details, which can be crucial evidence. It reveals context the visible content does not. Extracting and interpreting embedded metadata is a standard forensic technique.

To understand an attack's sequence, an analyst combines timestamps from firewall, authentication, and endpoint logs into a single chronological reconstruction. Building this is called creating a:

• a.A BIA
• b.A penetration testing report
• c.A forensic timeline✓
• d.A software bill of materials

A forensic timeline merges timestamped events from many sources into one chronology, revealing the attacker's sequence of actions. It depends on synchronized clocks to be accurate. Ordering events across systems is what the timeline delivers.

A defense attorney challenges digital evidence, arguing it may have been altered after collection. Which combination best supports its admissibility in court?

• a.Storing the evidence on a shared drive that is freely accessible to the whole response team
• b.Analyzing the original drive directly and relying on the analyst's memory of the exact steps
• c.Deleting the intermediate copies quickly to avoid confusion over which copy is authoritative
• d.An unbroken chain of custody plus matching hashes of the original and the image✓

An unbroken chain of custody documents every handler, and matching hashes prove the image is identical to the original and unaltered. Together they demonstrate integrity for the court. Documented handling plus verifiable integrity is what supports admissibility.

Before signing with a cloud vendor, a company insists on contract language permitting it to review the vendor's security controls periodically. This provision is a:

• a.An RPO target
• b.Memorandum of understanding
• c.Right-to-audit clause✓
• d.An SLA uptime clause

A right-to-audit clause gives the customer the contractual ability to assess a vendor's security controls, which is vital when outsourcing sensitive functions. Without it, the customer cannot verify the vendor's claims. Securing that inspection right is the clause's purpose.

A vulnerability scan run with valid login credentials on target hosts finds far more issues than one run without. Why does the credentialed scan reveal more?

• a.Because it only checks the network perimeter and deliberately ignores internal host details
• b.Because it actively exploits each weakness it finds in order to confirm that it is realistic
• c.Because it runs considerably faster and therefore has enough time to test far more systems across the entire network
• d.Because it can inspect installed software, patches, and configurations from inside✓

A credentialed scan logs in and inspects installed software, patch levels, and configurations from the inside, revealing far more than an external view. Non-credentialed scans see only what is exposed on the network. Authenticated inside access is why it finds more.

A scan returns hundreds of findings, so the team prioritizes remediation using a standardized 0-10 severity score reflecting exploitability and impact. This scoring system is:

• a.CVSS✓
• b.CVE
• c.OSINT
• d.SIEM

The Common Vulnerability Scoring System (CVSS) rates severity on a 0-10 scale from factors like exploitability and impact, helping teams prioritize. A CVE only names a vulnerability; CVSS scores its seriousness. A standardized severity number is what CVSS contributes.

When discussing a specific flaw, engineers reference a standardized identifier assigned to each publicly known vulnerability so everyone means the same issue. This identifier is a:

• a.A CVE✓
• b.CVSS
• c.A false positive
• d.An indicator of compromise

A Common Vulnerabilities and Exposures (CVE) identifier gives each publicly known vulnerability a unique reference so tools and teams communicate unambiguously. It names the flaw, while CVSS scores its severity. A shared, unique name is what a CVE provides.

A scanner reports a critical vulnerability, but manual testing shows the affected feature is not even installed. Before spending effort patching, the analyst should:

• a.Immediately schedule emergency downtime and patch every single server across all of production
• b.Disable the vulnerability scanner permanently so that it stops generating any further reports
• c.Validate the finding to confirm whether it is a false positive✓
• d.Report the finding to executives as a confirmed breach requiring immediate customer notification

Validating a finding confirms whether it is real or a false positive before resources are spent remediating. Scanners can misreport based on version banners or inapplicable checks. Verifying before acting prevents wasted effort and false alarms.

A legacy application cannot be patched for a known vulnerability without breaking it, so the team adds strict network filtering and monitoring around it instead. This alternative is a:

• a.A compensating control✓
• b.A residual risk
• c.An acceptable use policy
• d.A false positive

A compensating control provides protection by alternative means when the primary fix, such as a patch, cannot be applied. Filtering and monitoring reduce the risk around the unpatched app. Substituting an equivalent safeguard is the essence of a compensating control.

A client hires testers and gives them no internal knowledge, network diagrams, or credentials, forcing them to discover everything as an outside attacker would. This engagement is:

• a.A white-box test
• b.A black-box (unknown environment) test✓
• c.A tabletop exercise
• d.A credentialed vulnerability scan run with valid logins on each target host

In a black-box or unknown-environment test, testers receive no inside information and must discover the environment like a real external attacker. This realistically simulates an outsider but takes longer. Zero prior knowledge is what defines the black-box approach.

A company invites independent researchers to find and report vulnerabilities in its products in exchange for rewards, under defined rules. This program is a:

• a.A penetration test
• b.A red team exercise run by the organization's own internal security staff
• c.A tabletop exercise
• d.A bug bounty program✓

A bug bounty program crowdsources vulnerability discovery from independent researchers who are rewarded for valid, responsibly disclosed findings. It scales testing beyond a single firm under clear rules. Paying external researchers for reported flaws is what defines it.

An organization wants to automate checking systems against security benchmarks using standardized, machine-readable content. Which protocol suite enables this automation?

• a.NetFlow
• b.SCAP✓
• c.Syslog
• d.SNMP

The Security Content Automation Protocol (SCAP) provides standardized, machine-readable content so tools can automatically assess systems against benchmarks and report compliance. This makes configuration and vulnerability checks repeatable and consistent. Automating standardized assessment is SCAP's role.

To harden new servers consistently, an admin applies a widely-recognized set of vendor-neutral configuration recommendations. These published hardening standards are known as:

• a.A certificate revocation list
• b.CIS Benchmarks✓
• c.An RTO
• d.A memorandum of understanding

CIS Benchmarks are consensus-based, vendor-neutral configuration guides that provide consistent secure baselines for operating systems and applications. Applying them reduces misconfiguration across a fleet. Recognized, repeatable hardening guidance is what they offer.

Monitoring flags that a production server's settings no longer match the approved secure template, indicating unauthorized changes over time. This deviation is called:

• a.A denial-of-service condition
• b.Configuration drift✓
• c.A zero-day
• d.A false positive

Configuration drift is the gradual divergence of a system from its approved baseline due to ad hoc changes over time. It reintroduces risk and inconsistency that hardening removed. Detecting and correcting drift keeps systems aligned to their secure template.

In a Windows domain, administrators enforce password rules, disable removable storage, and set firewall settings on thousands of machines from one place. Which mechanism applies these centrally?

• a.A host-based intrusion detection system
• b.A bastion
• c.A hardware security module
• d.Group Policy✓

Group Policy centrally enforces security settings across all domain-joined machines from a single point, ensuring consistent hardening at scale. Managing thousands of endpoints individually would be error-prone. Central, consistent policy enforcement is what Group Policy delivers.

A newly deployed web server is found listening on Telnet, FTP, and several other unused ports. Which hardening action most reduces its attack surface?

• a.Disabling the unnecessary services and closing their ports✓
• b.Installing additional monitoring agents while leaving all of the open ports still running
• c.Adding more RAM and CPU so the server can comfortably handle the extra listening services
• d.Assigning the server a public IP address so that administrators can reach it remotely

Disabling unneeded services and closing their ports removes entry points, directly shrinking the attack surface. Every running service is a potential vulnerability to exploit. Least functionality, running only what is needed, is the core hardening principle here.

A penetration tester gains admin access to a network switch simply by trying the manufacturer's documented username and password. Which hardening step was skipped?

• a.Scheduling a recurring credentialed vulnerability scan against the switch every month
• b.Changing the default administrative credentials✓
• c.Enabling full-disk encryption on the switch's internal configuration storage memory
• d.Placing the switch behind a web application firewall to inspect inbound HTTP requests

Default credentials are publicly documented, so failing to change them leaves a trivial path to full control. Changing them to strong, unique values is a basic hardening step. Removing known factory logins closes this obvious entry point.

To balance security with stability, an organization tests vendor updates and deploys them on a predictable monthly schedule, with emergency out-of-band patches for critical flaws. This disciplined approach is:

• a.Never patching the systems at all
• b.A structured patch management cadence✓
• c.Relying on antivirus alone
• d.Applying every update instantly, untested

A structured patch management cadence tests and deploys updates on a predictable schedule while allowing emergency patches for critical issues. This balances security with operational stability. Disciplined, tested, scheduled patching is the recommended practice.

A security tool automatically detonates suspicious email attachments in an isolated disposable environment to observe their behavior before delivery. This technique is:

• a.Sandboxing✓
• b.Full-disk encryption
• c.Blocklisting
• d.Hashing

Sandboxing runs suspicious files in an isolated, disposable environment to observe behavior without risking real systems, catching threats signatures miss. Malicious actions reveal themselves safely inside the sandbox. Behavioral analysis in isolation is what defines the technique.

Reviewing authentication logs, an analyst notices hundreds of failed logins for many accounts from one IP, followed by a single success. What does this pattern most likely indicate?

• a.A misconfigured time server causing the log timestamps to appear out of sequence
• b.A password-spraying or brute-force attack that ultimately succeeded✓
• c.A scheduled backup job authenticating with its own valid dedicated service account
• d.A normal user who simply forgot and slowly re-entered their own correct password once

Many failures across accounts from one source followed by a success is the signature of password spraying or brute forcing that eventually worked. Normal users do not generate hundreds of failures across many accounts. Recognizing this pattern enables early detection of credential attacks.

A compliance mandate requires that security logs be kept for at least one year for potential investigations. Which policy governs how long logs are stored before deletion?

• a.An AUP clause
• b.An RTO target
• c.A service level agreement
• d.A log retention policy✓

A log retention policy specifies how long logs are kept before deletion, balancing investigative and compliance needs against storage cost. Retaining logs too briefly can destroy evidence needed later. Defining storage duration is exactly what this policy governs.

During a risk workshop, someone confuses terms. A hurricane is the potential danger, an unbolted roof is the weakness, and the chance of damage combining both is the:

• a.Loss
• b.Risk✓
• c.The vulnerability
• d.The threat

Risk is the likelihood and impact of a threat exploiting a vulnerability, combining the two. The hurricane is the threat and the unbolted roof is the vulnerability. Distinguishing these terms is fundamental to accurate risk assessment.

By uninstalling unused software, closing ports, and disabling default accounts, an administrator shrinks the number of ways an attacker could get in. This overall reduction is described as minimizing the:

• a.Residual risk
• b.The recovery point objective
• c.Attack surface✓
• d.The false positive rate

The attack surface is the sum of all points where an attacker could attempt entry, and hardening reduces it by removing services, ports, and accounts. A smaller attack surface means fewer opportunities to exploit. Minimizing exposure is the goal of hardening.

A vendor integrates endpoint, email, network, and cloud telemetry into one platform that correlates detections across all of them for unified response. This extended approach is called:

• a.DLP
• b.SIEM
• c.EDR
• d.XDR✓

Extended detection and response (XDR) unifies telemetry from endpoints, email, network, and cloud, correlating across them for broader detection and coordinated response. EDR is limited to endpoints. Cross-domain correlation and response is what distinguishes XDR.

Defenders plant fake credentials and decoy files that no legitimate user should ever touch, so any access to them immediately signals an intruder. These tripwires are called:

• a.Compensating controls
• b.Honeytokens✓
• c.False positives
• d.IOCs

Honeytokens are decoy credentials or files that legitimate users never use, so any interaction is a high-confidence sign of intrusion. They generate very low false positives because there is no legitimate reason to touch them. Serving as tripwires for attackers is their purpose.

The SOC receives an alert that an employee attempted to upload a spreadsheet full of Social Security numbers to a personal cloud drive, and the transfer was blocked. Which control generated this?

• a.A network intrusion prevention system
• b.Data loss prevention✓
• c.A security orchestration platform
• d.A WAF

Data loss prevention inspects content and blocks sensitive data, like Social Security numbers, from leaving through channels such as personal cloud uploads. It enforces policy on data in motion. Recognizing and stopping sensitive data exfiltration is the DLP function.

A team continuously scans their cloud accounts for misconfigurations like open storage buckets, over-permissive roles, and disabled logging, alerting on drift from policy. This tooling is:

• a.A hardware security module
• b.Cloud security posture management✓
• c.A traditional network firewall that filters by source and destination address
• d.An intrusion detection sensor

Cloud security posture management (CSPM) continuously assesses cloud configurations against best practices, flagging risky settings like public buckets or excessive permissions. Misconfiguration is a leading cause of cloud breaches. Ongoing configuration assurance is what CSPM provides.

Before allowing container images into production, a pipeline scans them for vulnerable packages and embedded secrets and blocks images that fail policy. This practice most directly addresses risk in the:

• a.Container image supply chain✓
• b.Email authentication
• c.Wireless network authentication process
• d.Physical access control

Scanning images for vulnerable components and leaked secrets before deployment secures the container supply chain, where a bad base image can spread risk widely. Blocking non-compliant images prevents known flaws from reaching production. Vetting what enters the pipeline is the point.

After deploying automated playbooks, a SOC reports the average time from alert to containment dropped from hours to minutes. Which operational metric improved?

• a.The RPO
• b.The FAR
• c.The annualized loss expectancy
• d.Mean time to respond✓

Mean time to respond measures how quickly the team acts on and contains an incident after detection, and automation drives it down. Faster response limits attacker dwell time and damage. Reducing this metric is a core goal of security automation.

Facing more alerts than staff can handle, a SOC manager wants analysts to work the most dangerous alerts first. Which practice organizes work this way?

• a.Forwarding every alert to executives
• b.Risk-based alert triage and prioritization✓
• c.Working alerts in the order they arrive
• d.Auto-closing alerts not reviewed within five minutes

Risk-based triage ranks alerts by potential impact and likelihood so limited analyst time goes to the most serious threats first. Working in arrival order or auto-closing risks missing critical events. Prioritizing by risk is what makes finite resources effective.

When an alert fires, the SOC platform automatically adds context such as the source IP's reputation, geolocation, and past activity to help analysts decide faster. This automated context-adding is called:

• a.Triage
• b.Enrichment✓
• c.Log rotation
• d.Sandboxing

Enrichment automatically augments an alert with context like reputation, geolocation, and history so analysts can judge it quickly and accurately. It reduces manual lookups and speeds decisions. Adding decision-supporting context to raw alerts is what enrichment does.