CompTIA Security+ — All Questions

Which method conceals the very existence of a secret message by hiding it inside an ordinary-looking image file?

• a.Hashing
• b.Symmetric encryption
• c.Tokenization
• d.Steganography✓

Steganography hides data within another medium, such as an image, so the message's existence is concealed rather than merely scrambled. Encryption protects content but reveals that something is protected. Steganography aims for secrecy of existence itself.

An organization routes all outbound web traffic through a device that filters URLs, inspects content, and enforces acceptable use before requests reach the internet. What is this?

• a.A load balancer
• b.A jump server
• c.A forward proxy or secure web gateway✓
• d.A reverse proxy that fronts inbound client requests to internal servers

A forward proxy or secure web gateway mediates outbound requests, applying URL filtering, content inspection, and policy enforcement. It centralizes control and visibility over user web access. This differs from a reverse proxy, which fronts inbound server traffic.

In software-defined networking, the intelligence that decides how traffic is forwarded is separated from the devices that move the packets. What are these two layers called?

• a.The presentation layer and the session layer
• b.The control plane and the data plane✓
• c.The application layer and the physical cabling layer
• d.The perimeter and internal zones

Software-defined networking separates the control plane, which makes forwarding decisions, from the data plane, which forwards packets. Centralizing control enables programmable, agile network management. Securing the controller is critical since it governs the whole network.

To avoid a single vendor vulnerability taking down everything, an organization deliberately runs critical workloads across two different cloud providers. Which resilience strategy is this?

• a.Implicit trust, which automatically grants access to anything inside the perimeter zone
• b.Data masking, which hides portions of sensitive fields shown within an interface view
• c.Platform diversity through a multi-cloud approach✓
• d.Vertical scaling, which adds more resources to a single existing server instance in place

Platform diversity and multi-cloud avoid a monoculture where one vendor flaw or outage affects all systems. Spreading workloads increases resilience against provider-specific failures. It adds complexity that must be managed carefully.

A security team wants visibility into traffic at key points without blocking it, feeding copies to their monitoring platform. Which device role accomplishes this?

• a.A jump server that administrators must pass through to reach the protected systems
• b.An inline next-generation firewall that actively drops any traffic it deems malicious
• c.A passive sensor collecting traffic through a tap or span port✓
• d.A load balancer that distributes inbound requests across a pool of many web servers

Passive sensors receive copied traffic via a tap or span port, giving visibility without sitting in the forwarding path. They can alert but not block, avoiding becoming a chokepoint. Placement at chokepoints maximizes monitoring coverage.

Access to a sensitive finance folder is limited strictly to members of the finance team, and no one else can open it. Which data protection method is applied?

• a.Geographic dispersion
• b.Full-disk encryption applied to every laptop regardless of the user's role
• c.Load balancing
• d.Permission restrictions✓

Permission restrictions limit who can access data based on need, enforcing least privilege at the file or resource level. Only authorized roles can open the sensitive folder. This access control is a fundamental data protection method.

An online retailer analyzes expected holiday traffic to ensure it has enough compute, storage, and bandwidth to stay available under peak load. This process is:

• a.Capacity planning✓
• b.A pen test
• c.A gap analysis
• d.A tabletop exercise

Capacity planning forecasts demand for people, technology, and infrastructure so resources can meet peak load without failing. Under-provisioning risks outages, an availability concern. It is a key part of resilience and continuity planning.

A hardened server runs only the single service it was built to provide, with all other software, ports, and accounts removed. Which principle does this reflect?

• a.Reducing the attack surface through least functionality✓
• b.Implementing implicit trust for all devices located inside the network perimeter zone
• c.Applying load balancing to distribute incoming requests across many identical servers
• d.Increasing redundancy by duplicating every component on the same physical host machine

Least functionality reduces the attack surface by removing unneeded services, ports, software, and accounts. A single-purpose hardened host offers attackers fewer footholds. It complements least privilege by hardening the system itself.

A remote-access VPN is configured so that only traffic destined for corporate resources goes through the tunnel while general internet browsing goes out directly. This is:

• a.An air gap
• b.A split tunnel✓
• c.A screened subnet
• d.A full tunnel

A split tunnel routes only corporate-bound traffic through the VPN while other traffic exits locally, improving performance but reducing inspection of general browsing. A full tunnel sends everything through the VPN for maximum control. The choice trades performance against visibility.

A company embeds a third-party analytics library into its web app, and a flaw in that library exposes user data. Which architectural risk does this highlight?

• a.Fail-open behavior, in which a failed control allows traffic through by default
• b.Data sovereignty, concerning which jurisdiction's laws govern where the data is stored
• c.Third-party dependency risk in the software supply chain✓
• d.Geographic dispersion, concerning how far apart the recovery sites are located

Incorporating third-party code or services inherits their vulnerabilities, a software supply chain risk. A flaw in a dependency becomes a flaw in the application. Vetting components, monitoring advisories, and maintaining an SBOM manage this exposure.

A server uses multiple disks configured so that if one drive fails, no data is lost and the system keeps running. Which technology provides this disk-level redundancy?

• a.Load balancing
• b.Network segmentation
• c.A weekly snapshot stored on the same failing disk array as the data
• d.RAID with a fault-tolerant configuration✓

Redundant array of independent disks (RAID) with a fault-tolerant level, such as RAID 1 or 5, tolerates a drive failure without losing data or availability. It provides hardware-level resilience for storage. RAID is not a backup, since it does not protect against deletion or corruption.

A stolen laptop's drive is encrypted, so the thief cannot read any of its files without the key. Which control protected the data?

• a.Data masking
• b.Full-disk encryption protecting data at rest✓
• c.A firewall rule
• d.TLS, which secures data in transit but does nothing for files stored on disk

Full-disk encryption protects data at rest, rendering the drive's contents unreadable without the key even if the device is stolen. It defends confidentiality when physical control is lost. TLS, by contrast, protects data in transit, not at rest.

An audit finds Telnet, FTP, and HTTP still in use for management. Which set of replacements provides encrypted equivalents?

• a.SSH for Telnet, SFTP for FTP, and HTTPS for HTTP✓
• b.Telnet with SNMPv1, FTP with TFTP, and HTTP left unchanged for compatibility reasons
• c.Telnet with rlogin, FTP with plain FTP on another port, and HTTP with HTTP proxying
• d.SSH for HTTP, FTPS for SSH, and Telnet retained for legacy device administration

Insecure plaintext protocols should be replaced with encrypted equivalents: SSH for Telnet, SFTP or FTPS for FTP, and HTTPS for HTTP. These protect credentials and data in transit. Disabling the legacy services entirely completes the hardening.

When primary automated systems fail, staff follow documented manual procedures to keep critical business functions going. What does this reflect?

• a.A penetration test
• b.Network segmentation
• c.A recovery point objective specifying the maximum acceptable amount of data loss
• d.Continuity of operations planning✓

Continuity of operations planning ensures essential functions continue during disruptions, including manual alternatives when automated systems are unavailable. It keeps the business running while recovery proceeds. Documented procedures and trained staff make it work.

In the zero trust control plane, which component establishes and configures the session between a subject and a resource once access is approved?

• a.The policy administrator✓
• b.The data plane
• c.The PEP
• d.The certificate revocation list

The policy administrator executes the policy engine's decision by establishing or tearing down the connection and issuing session credentials. It acts as the bridge between the decision and the enforcement point. Together they form the zero trust control plane.

An organization wants to enforce encryption, remote wipe, and app policies on employee-owned phones that access corporate email. Which technology enables this?

• a.A load balancer
• b.Mobile device management✓
• c.A screened subnet that isolates public web servers from the internal zone
• d.A honeypot

Mobile device management (MDM) enforces security policies such as encryption, remote wipe, and app control on enrolled devices, including personally owned ones in BYOD models. It extends organizational control to mobile endpoints. Policy separation protects corporate data on personal phones.

Administrators use a separate dedicated management network, isolated from production traffic, to configure critical devices. Why is this preferred?

• a.It increases the attack surface by exposing management interfaces to all normal users
• b.It keeps management access available and protected even if the production network is compromised✓
• c.It automatically encrypts all production application traffic without any configuration
• d.It removes the need to authenticate administrators when they connect to the devices

Out-of-band management uses a separate network for administrative access, so managing devices remains possible even if the production network is compromised or unavailable. It also isolates sensitive management interfaces from general users. This reduces both risk and dependency.

An investment firm cannot tolerate more than a few minutes of downtime, so it maintains a fully staffed, fully equipped duplicate facility with live-replicated data. Which site type is this?

• a.Cold site
• b.Warm site
• c.A hot site✓
• d.Mobile recovery unit

A hot site is fully provisioned with equipment, current data, and often staff, allowing near-immediate takeover. It offers the fastest recovery at the highest cost. It suits organizations with very low tolerance for downtime.

Where in a secure architecture should end-of-life storage media be handled so that residual data cannot be recovered by outsiders?

• a.Left in place indefinitely because encryption alone guarantees permanent destruction
• b.Sold or donated immediately after a quick file deletion to maximize the salvage value
• c.Returned to general storage shelves once the files appear deleted in the interface view
• d.Sanitized or physically destroyed under a documented media disposal process✓

Media at end of life must be sanitized or destroyed through a documented process to prevent recovery of residual data. Simple deletion or formatting can leave data recoverable. Certificates of destruction provide auditable assurance.

Under zero trust, after a user authenticates, their device's security posture changes to non-compliant mid-session. What should ideally happen?

• a.Nothing, because access granted at login remains valid for the entire session by design
• b.All logging stops to conserve resources once the initial authentication has succeeded
• c.Access is re-evaluated and can be restricted based on the changed posture✓
• d.The user gains additional privileges automatically as a reward for staying connected

Zero trust continuously evaluates trust, so a change in device posture during a session can trigger reduced access or re-authentication. Trust is never permanent or based on a single login. This adaptive, ongoing verification limits risk from changing conditions.

To block users from resolving known malicious domains before any connection is made, an organization deploys protective DNS filtering. Which benefit does this provide?

• a.It stops connections to known-malicious domains at the name-resolution stage✓
• b.It encrypts all stored data at rest on the endpoints without needing any local agent
• c.It replaces the need for endpoint protection and network firewalls entirely for good
• d.It guarantees that no zero-day exploit can ever affect the protected endpoints again

Protective DNS filtering blocks resolution of known-malicious domains, stopping many threats such as phishing and command-and-control before a connection is established. It is a lightweight, broad control. It complements, but does not replace, other layered defenses.

A popular web service distributes incoming requests across a pool of identical servers so no single server is overwhelmed and one failing server does not take the site down. Which technology is this?

• a.A tabletop
• b.Data labeling
• c.Full-disk encryption
• d.Load balancing✓

Load balancing spreads client requests across multiple servers, improving performance and availability while allowing a failed node to be bypassed. It supports both scaling and resilience. Health checks let the balancer route around unhealthy servers.

When selecting where to position a new intrusion prevention system, which factor most directly determines whether it can actively block attacks?

• a.Whether it is deployed inline in the traffic path rather than passively receiving copies✓
• b.The brand of the switch that happens to connect the device to the rest of the network
• c.The color-coding scheme used on the physical network cables in the data center racks
• d.The number of unrelated administrative user accounts defined on the appliance itself

An IPS must be inline, sitting directly in the traffic path, to actively block malicious packets; a passive tap deployment can only detect and alert. Device placement therefore determines its capability. This inline-versus-passive decision is a core architecture consideration.