CompTIA Security+ — All Questions

To ensure only authenticated devices can use a wired switch port before gaining network access, which standard should be implemented?

• a.HTTPS, which encrypts web traffic but does not authenticate a device onto a port
• b.DHCP address assignment
• c.Network address translation
• d.IEEE 802.1X port-based network access control✓

IEEE 802.1X provides port-based network access control, requiring a device to authenticate, often via EAP and a RADIUS server, before the port forwards traffic. This blocks unauthorized devices at the edge. It is a foundational network access control.

A virtualization admin wants to capture a point-in-time state of a VM so it can be instantly rolled back if a patch fails. Which capability provides this?

• a.Network segmentation
• b.Snapshots✓
• c.Geographic dispersion
• d.RAID

A snapshot records a virtual machine's state at a point in time, enabling quick rollback if a change causes problems. It is ideal before risky updates. Snapshots are not a substitute for full backups but complement recovery workflows.

Which method conceals the very existence of a secret message by hiding it inside an ordinary-looking image file?

• a.Hashing
• b.Symmetric encryption
• c.Tokenization
• d.Steganography✓

Steganography hides data within another medium, such as an image, so the message's existence is concealed rather than merely scrambled. Encryption protects content but reveals that something is protected. Steganography aims for secrecy of existence itself.

An organization routes all outbound web traffic through a device that filters URLs, inspects content, and enforces acceptable use before requests reach the internet. What is this?

• a.A load balancer
• b.A jump server
• c.A forward proxy or secure web gateway✓
• d.A reverse proxy that fronts inbound client requests to internal servers

A forward proxy or secure web gateway mediates outbound requests, applying URL filtering, content inspection, and policy enforcement. It centralizes control and visibility over user web access. This differs from a reverse proxy, which fronts inbound server traffic.

In software-defined networking, the intelligence that decides how traffic is forwarded is separated from the devices that move the packets. What are these two layers called?

• a.The presentation layer and the session layer
• b.The control plane and the data plane✓
• c.The application layer and the physical cabling layer
• d.The perimeter and internal zones

Software-defined networking separates the control plane, which makes forwarding decisions, from the data plane, which forwards packets. Centralizing control enables programmable, agile network management. Securing the controller is critical since it governs the whole network.

To avoid a single vendor vulnerability taking down everything, an organization deliberately runs critical workloads across two different cloud providers. Which resilience strategy is this?

• a.Implicit trust, which automatically grants access to anything inside the perimeter zone
• b.Data masking, which hides portions of sensitive fields shown within an interface view
• c.Platform diversity through a multi-cloud approach✓
• d.Vertical scaling, which adds more resources to a single existing server instance in place

Platform diversity and multi-cloud avoid a monoculture where one vendor flaw or outage affects all systems. Spreading workloads increases resilience against provider-specific failures. It adds complexity that must be managed carefully.

A security team wants visibility into traffic at key points without blocking it, feeding copies to their monitoring platform. Which device role accomplishes this?

• a.A jump server that administrators must pass through to reach the protected systems
• b.An inline next-generation firewall that actively drops any traffic it deems malicious
• c.A passive sensor collecting traffic through a tap or span port✓
• d.A load balancer that distributes inbound requests across a pool of many web servers

Passive sensors receive copied traffic via a tap or span port, giving visibility without sitting in the forwarding path. They can alert but not block, avoiding becoming a chokepoint. Placement at chokepoints maximizes monitoring coverage.

Access to a sensitive finance folder is limited strictly to members of the finance team, and no one else can open it. Which data protection method is applied?

• a.Geographic dispersion
• b.Full-disk encryption applied to every laptop regardless of the user's role
• c.Load balancing
• d.Permission restrictions✓

Permission restrictions limit who can access data based on need, enforcing least privilege at the file or resource level. Only authorized roles can open the sensitive folder. This access control is a fundamental data protection method.

An online retailer analyzes expected holiday traffic to ensure it has enough compute, storage, and bandwidth to stay available under peak load. This process is:

• a.Capacity planning✓
• b.A pen test
• c.A gap analysis
• d.A tabletop exercise

Capacity planning forecasts demand for people, technology, and infrastructure so resources can meet peak load without failing. Under-provisioning risks outages, an availability concern. It is a key part of resilience and continuity planning.

A hardened server runs only the single service it was built to provide, with all other software, ports, and accounts removed. Which principle does this reflect?

• a.Reducing the attack surface through least functionality✓
• b.Implementing implicit trust for all devices located inside the network perimeter zone
• c.Applying load balancing to distribute incoming requests across many identical servers
• d.Increasing redundancy by duplicating every component on the same physical host machine

Least functionality reduces the attack surface by removing unneeded services, ports, software, and accounts. A single-purpose hardened host offers attackers fewer footholds. It complements least privilege by hardening the system itself.

A remote-access VPN is configured so that only traffic destined for corporate resources goes through the tunnel while general internet browsing goes out directly. This is:

• a.An air gap
• b.A split tunnel✓
• c.A screened subnet
• d.A full tunnel

A split tunnel routes only corporate-bound traffic through the VPN while other traffic exits locally, improving performance but reducing inspection of general browsing. A full tunnel sends everything through the VPN for maximum control. The choice trades performance against visibility.

A company embeds a third-party analytics library into its web app, and a flaw in that library exposes user data. Which architectural risk does this highlight?

• a.Fail-open behavior, in which a failed control allows traffic through by default
• b.Data sovereignty, concerning which jurisdiction's laws govern where the data is stored
• c.Third-party dependency risk in the software supply chain✓
• d.Geographic dispersion, concerning how far apart the recovery sites are located

Incorporating third-party code or services inherits their vulnerabilities, a software supply chain risk. A flaw in a dependency becomes a flaw in the application. Vetting components, monitoring advisories, and maintaining an SBOM manage this exposure.

A server uses multiple disks configured so that if one drive fails, no data is lost and the system keeps running. Which technology provides this disk-level redundancy?

• a.Load balancing
• b.Network segmentation
• c.A weekly snapshot stored on the same failing disk array as the data
• d.RAID with a fault-tolerant configuration✓

Redundant array of independent disks (RAID) with a fault-tolerant level, such as RAID 1 or 5, tolerates a drive failure without losing data or availability. It provides hardware-level resilience for storage. RAID is not a backup, since it does not protect against deletion or corruption.

A stolen laptop's drive is encrypted, so the thief cannot read any of its files without the key. Which control protected the data?

• a.Data masking
• b.Full-disk encryption protecting data at rest✓
• c.A firewall rule
• d.TLS, which secures data in transit but does nothing for files stored on disk

Full-disk encryption protects data at rest, rendering the drive's contents unreadable without the key even if the device is stolen. It defends confidentiality when physical control is lost. TLS, by contrast, protects data in transit, not at rest.

An audit finds Telnet, FTP, and HTTP still in use for management. Which set of replacements provides encrypted equivalents?

• a.SSH for Telnet, SFTP for FTP, and HTTPS for HTTP✓
• b.Telnet with SNMPv1, FTP with TFTP, and HTTP left unchanged for compatibility reasons
• c.Telnet with rlogin, FTP with plain FTP on another port, and HTTP with HTTP proxying
• d.SSH for HTTP, FTPS for SSH, and Telnet retained for legacy device administration

Insecure plaintext protocols should be replaced with encrypted equivalents: SSH for Telnet, SFTP or FTPS for FTP, and HTTPS for HTTP. These protect credentials and data in transit. Disabling the legacy services entirely completes the hardening.

When primary automated systems fail, staff follow documented manual procedures to keep critical business functions going. What does this reflect?

• a.A penetration test
• b.Network segmentation
• c.A recovery point objective specifying the maximum acceptable amount of data loss
• d.Continuity of operations planning✓

Continuity of operations planning ensures essential functions continue during disruptions, including manual alternatives when automated systems are unavailable. It keeps the business running while recovery proceeds. Documented procedures and trained staff make it work.

In the zero trust control plane, which component establishes and configures the session between a subject and a resource once access is approved?

• a.The policy administrator✓
• b.The data plane
• c.The PEP
• d.The certificate revocation list

The policy administrator executes the policy engine's decision by establishing or tearing down the connection and issuing session credentials. It acts as the bridge between the decision and the enforcement point. Together they form the zero trust control plane.

An organization wants to enforce encryption, remote wipe, and app policies on employee-owned phones that access corporate email. Which technology enables this?

• a.A load balancer
• b.Mobile device management✓
• c.A screened subnet that isolates public web servers from the internal zone
• d.A honeypot

Mobile device management (MDM) enforces security policies such as encryption, remote wipe, and app control on enrolled devices, including personally owned ones in BYOD models. It extends organizational control to mobile endpoints. Policy separation protects corporate data on personal phones.

Administrators use a separate dedicated management network, isolated from production traffic, to configure critical devices. Why is this preferred?

• a.It increases the attack surface by exposing management interfaces to all normal users
• b.It keeps management access available and protected even if the production network is compromised✓
• c.It automatically encrypts all production application traffic without any configuration
• d.It removes the need to authenticate administrators when they connect to the devices

Out-of-band management uses a separate network for administrative access, so managing devices remains possible even if the production network is compromised or unavailable. It also isolates sensitive management interfaces from general users. This reduces both risk and dependency.

An investment firm cannot tolerate more than a few minutes of downtime, so it maintains a fully staffed, fully equipped duplicate facility with live-replicated data. Which site type is this?

• a.Cold site
• b.Warm site
• c.A hot site✓
• d.Mobile recovery unit

A hot site is fully provisioned with equipment, current data, and often staff, allowing near-immediate takeover. It offers the fastest recovery at the highest cost. It suits organizations with very low tolerance for downtime.

Where in a secure architecture should end-of-life storage media be handled so that residual data cannot be recovered by outsiders?

• a.Left in place indefinitely because encryption alone guarantees permanent destruction
• b.Sold or donated immediately after a quick file deletion to maximize the salvage value
• c.Returned to general storage shelves once the files appear deleted in the interface view
• d.Sanitized or physically destroyed under a documented media disposal process✓

Media at end of life must be sanitized or destroyed through a documented process to prevent recovery of residual data. Simple deletion or formatting can leave data recoverable. Certificates of destruction provide auditable assurance.

Under zero trust, after a user authenticates, their device's security posture changes to non-compliant mid-session. What should ideally happen?

• a.Nothing, because access granted at login remains valid for the entire session by design
• b.All logging stops to conserve resources once the initial authentication has succeeded
• c.Access is re-evaluated and can be restricted based on the changed posture✓
• d.The user gains additional privileges automatically as a reward for staying connected

Zero trust continuously evaluates trust, so a change in device posture during a session can trigger reduced access or re-authentication. Trust is never permanent or based on a single login. This adaptive, ongoing verification limits risk from changing conditions.

To block users from resolving known malicious domains before any connection is made, an organization deploys protective DNS filtering. Which benefit does this provide?

• a.It stops connections to known-malicious domains at the name-resolution stage✓
• b.It encrypts all stored data at rest on the endpoints without needing any local agent
• c.It replaces the need for endpoint protection and network firewalls entirely for good
• d.It guarantees that no zero-day exploit can ever affect the protected endpoints again

Protective DNS filtering blocks resolution of known-malicious domains, stopping many threats such as phishing and command-and-control before a connection is established. It is a lightweight, broad control. It complements, but does not replace, other layered defenses.

A popular web service distributes incoming requests across a pool of identical servers so no single server is overwhelmed and one failing server does not take the site down. Which technology is this?

• a.A tabletop
• b.Data labeling
• c.Full-disk encryption
• d.Load balancing✓

Load balancing spreads client requests across multiple servers, improving performance and availability while allowing a failed node to be bypassed. It supports both scaling and resilience. Health checks let the balancer route around unhealthy servers.

When selecting where to position a new intrusion prevention system, which factor most directly determines whether it can actively block attacks?

• a.Whether it is deployed inline in the traffic path rather than passively receiving copies✓
• b.The brand of the switch that happens to connect the device to the rest of the network
• c.The color-coding scheme used on the physical network cables in the data center racks
• d.The number of unrelated administrative user accounts defined on the appliance itself

An IPS must be inline, sitting directly in the traffic path, to actively block malicious packets; a passive tap deployment can only detect and alert. Device placement therefore determines its capability. This inline-versus-passive decision is a core architecture consideration.

An asset worth $200,000 would lose 25% of its value in a particular incident. What is the single loss expectancy?

• a.$150,000
• b.$50,000✓
• c.$25,000
• d.$200,000

Single loss expectancy equals asset value multiplied by the exposure factor, here $200,000 times 0.25, which is $50,000. It estimates the loss from one occurrence of the risk. SLE feeds into the annualized loss expectancy calculation.

If a single loss expectancy is $10,000 and the event is expected to occur twice per year, what is the annualized loss expectancy?

• a.$10,000
• b.$12,000
• c.$5,000
• d.$20,000✓

Annualized loss expectancy equals single loss expectancy times the annualized rate of occurrence, here $10,000 times 2, which is $20,000. It expresses expected yearly loss to justify control spending. Spending more than the ALE on mitigation is generally not cost-effective.

A board formally states the broad amount and type of risk the organization is willing to pursue to meet its objectives. Which term describes this statement?

• a.Residual risk
• b.Annualized loss expectancy, which quantifies the expected yearly cost of a specific risk
• c.Risk appetite✓
• d.Risk tolerance

Risk appetite is the overall level and type of risk an organization is willing to accept in pursuit of its goals, set at the strategic level. Risk tolerance is the acceptable deviation for a specific risk. Appetite guides how aggressively the organization operates.

Which document catalogs identified risks along with their likelihood, impact, owner, and mitigation status so they can be tracked over time?

• a.An NDA
• b.An acceptable use policy
• c.A risk register✓
• d.A service level agreement

A risk register is the central record of identified risks, capturing likelihood, impact, ownership, and treatment status. It supports ongoing tracking and reporting to leadership. Keeping it current is essential to risk governance.

An organization integrates automated tools that constantly evaluate its risk posture as conditions change, rather than assessing only once a year. Which assessment type is this?

• a.An ad hoc assessment
• b.A recurring annual assessment
• c.A continuous assessment✓
• d.A one-time assessment

A continuous risk assessment constantly monitors the environment so emerging risks are identified in near real time. It contrasts with point-in-time approaches like annual or ad hoc assessments. Continuous insight supports faster, better-informed decisions.

After identifying a phishing risk, a company deploys email filtering and trains staff to reduce the likelihood and impact. Which risk management strategy is this?

• a.Risk avoidance
• b.Risk mitigation✓
• c.Risk acceptance
• d.Risk transference

Risk mitigation applies controls to reduce a risk's likelihood or impact, such as filtering and awareness training against phishing. The risk is lowered but not eliminated. It is the most common strategy for risks the business must live with.

A legacy system cannot meet the encryption standard, so leadership formally documents and approves a temporary deviation with compensating controls. What is this called?

• a.A residual risk calculation quantifying what remains after all the controls are applied
• b.A policy exception with a documented exemption✓
• c.A business impact analysis identifying critical processes and their disruption effects
• d.A service level agreement defining measurable performance commitments from a vendor

A policy exception (exemption) formally authorizes a documented deviation from a standard, usually time-limited and paired with compensating controls. It keeps deviations visible and accountable rather than hidden. Regular review ensures exceptions do not become permanent gaps.

A one-page document states, at a high level, that the organization is committed to protecting the confidentiality of customer data. Which governance artifact is this?

• a.An SOP
• b.A guideline
• c.A policy✓
• d.A standard

A policy is a high-level statement of management intent and direction, such as a commitment to protect customer data. Standards specify mandatory requirements, procedures give step-by-step instructions, and guidelines are advisory. Together they form the governance hierarchy.

Before modifying a production firewall, an organization requires the change to be requested, reviewed, approved, tested, and documented with a rollback plan. Which process governs this?

• a.Change management✓
• b.A business impact analysis
• c.Incident response
• d.Pen testing

Change management controls how modifications are proposed, reviewed, approved, tested, and documented, including rollback plans. It reduces the risk of outages and security gaps from unmanaged changes. Backout plans allow safe recovery if a change fails.

Under GDPR, a company decides why and how personal data is processed, while a vendor merely processes that data on the company's instructions. What is the company's role?

• a.The supervisory authority
• b.The data subject
• c.The data processor
• d.The data controller✓

Under GDPR, the data controller determines the purposes and means of processing personal data, bearing primary accountability. The processor acts on the controller's instructions. Distinguishing the roles clarifies legal responsibilities and liability.

A customer in the EU formally requests that a company erase all personal data it holds about them. Which GDPR right is being exercised?

• a.The right to erasure, also known as the right to be forgotten✓
• b.The right to rectification, which lets a person correct inaccurate personal data held
• c.The right of access, which lets a person obtain a copy of the data held about them
• d.The right to portability, which lets a person receive their data in a reusable format

The right to erasure, or right to be forgotten, lets individuals request deletion of their personal data under certain conditions. Organizations must have processes to honor valid requests. It is one of several data subject rights GDPR grants.

A retailer wants to shrink the systems subject to payment card security requirements. Which approach most directly reduces PCI DSS scope?

• a.Increasing the frequency of general security awareness training for all staff members
• b.Encrypting all employee laptops that never store or process any cardholder data at all
• c.Purchasing cyber-insurance to transfer the financial impact of a potential data breach
• d.Segmenting the cardholder data environment and tokenizing stored card numbers✓

Segmenting the cardholder data environment and replacing stored card numbers with tokens removes systems from PCI DSS scope, since fewer components touch actual card data. This lowers compliance cost and risk. Scope reduction is a core PCI DSS strategy.

A hospital must implement administrative, physical, and technical safeguards to protect patient health information. Which regulation imposes these categories of safeguards?

• a.GDPR
• b.HIPAA✓
• c.PCI DSS
• d.SOX

HIPAA's Security Rule requires administrative, physical, and technical safeguards to protect electronic protected health information. It applies to covered entities and their business associates. Violations can bring significant civil and criminal penalties.

Which US law was enacted primarily to ensure the accuracy and integrity of public companies' financial reporting and internal controls?

• a.The Gramm-Leach-Bliley Act
• b.The Sarbanes-Oxley Act✓
• c.The EU GDPR
• d.The HIPAA Privacy Rule

The Sarbanes-Oxley Act (SOX) mandates controls and executive accountability over financial reporting for public companies. IT controls supporting the integrity of financial data fall in its scope. It arose from major corporate accounting scandals.

Which of the following is a direct consequence an organization may face for failing to meet a mandatory regulatory requirement?

• a.A guaranteed increase in customer trust regardless of the underlying nature of the violation
• b.Regulatory fines and potential loss of operating license✓
• c.The removal of any obligation to notify affected individuals about a reported data breach
• d.An automatic and permanent immunity from all future audits and regulatory examinations

Non-compliance can lead to fines, sanctions, loss of license, contractual penalties, and reputational damage. These consequences make compliance a business priority, not just a legal formality. The specific penalties depend on the regulation and severity.

An organization hires an independent accredited firm to formally examine and attest to its security controls for customers. Which type of assessment is this?

• a.An internal self-assessment performed by the organization's own staff
• b.A tabletop exercise
• c.A vulnerability scan
• d.An external independent third-party audit✓

An external audit by an independent third party provides objective assurance and attestation that others, such as customers or regulators, can trust. Internal audits and self-assessments are valuable but lack that independence. Independence strengthens credibility of the findings.

After examining a service provider's controls, an independent auditor issues a formal signed statement about their effectiveness for the reporting period. This formal statement is called:

• a.An attestation✓
• b.An MOU
• c.An SOW
• d.A business impact analysis

Attestation is an auditor's formal declaration about the state or effectiveness of controls, such as in a SOC 2 report. It gives third parties confidence without their needing to audit directly. It is a common form of external assurance.

Two independent companies form a partnership and sign a document defining how they will share profits, responsibilities, and liabilities in the venture. Which agreement is this?

• a.A non-disclosure agreement
• b.A service level agreement
• c.A memorandum of understanding expressing a non-binding intent to cooperate
• d.A business partnership agreement✓

A business partnership agreement (BPA) defines the terms between partners, including responsibilities, profit sharing, and liabilities. It differs from an SLA, which sets performance metrics, and an NDA, which protects confidentiality. Choosing the right agreement clarifies obligations.

A company wants contractual authority to inspect a critical vendor's security controls at any time during the relationship. Which provision should be included in the contract?

• a.A non-disclosure clause
• b.A data retention clause
• c.A right-to-audit clause✓
• d.A service level agreement clause

A right-to-audit clause grants the customer contractual authority to assess the vendor's controls, providing ongoing assurance. Without it, the customer may have no leverage to verify security. It is a key element of third-party risk management.

Before onboarding a new software supplier, a company reviews the supplier's security questionnaire, financial stability, and history of breaches. This process is best described as:

• a.A tabletop exercise
• b.A penetration test
• c.A business impact analysis
• d.Vendor due diligence✓

Vendor due diligence evaluates a prospective third party's security, financial health, and track record before engagement. It informs whether the vendor's risk is acceptable. Ongoing monitoring continues the assessment throughout the relationship.

A policy specifies that customer transaction records are kept for exactly seven years and then securely destroyed. Which governance concept does this implement?

• a.A data retention policy✓
• b.A right-to-audit clause granting authority to inspect a vendor's controls
• c.Data masking
• d.Data classification

A data retention policy defines how long different data types are kept and when they are disposed of, balancing legal, business, and privacy needs. Keeping data too long increases risk and liability. Secure destruction at end of retention completes the lifecycle.

Which governance structure is typically responsible for setting overall risk direction and holding management accountable for the security program?

• a.External attackers, whose activity indirectly shapes the organization's technical controls
• b.Individual end users, who each independently define the organization's security strategy
• c.The board of directors and executive governance committee✓
• d.The help desk team, which handles day-to-day user support tickets and password resets

Boards and executive committees provide governance oversight, setting risk appetite and holding management accountable for the security program. Governance is a leadership responsibility, not solely a technical one. Clear structures ensure security aligns with business objectives.

A client provides testers with no prior information about the target environment, requiring them to discover everything as a real outside attacker would. Which engagement type is this?

• a.A partially known (gray-box) test
• b.A tabletop exercise
• c.An unknown environment (black-box) test✓
• d.A known environment (white-box) test, in which testers receive full internal documentation

An unknown environment, or black-box, penetration test gives the testers no internal knowledge, simulating an external attacker's perspective. Known (white-box) tests share full information, and partially known (gray-box) tests share some. The choice shapes realism and efficiency.

During continuity planning, a team determines that a payroll system must be restored within four hours and can lose at most one hour of data. Which two metrics are these?

• a.Recovery time objective and recovery point objective✓
• b.Single loss expectancy and annualized rate of occurrence, both used in quantitative analysis
• c.Risk appetite and risk tolerance, both describing how much risk the organization will accept
• d.Mean time between failures and mean time to repair, both describing hardware reliability

The recovery time objective (RTO) is the maximum acceptable time to restore a service, and the recovery point objective (RPO) is the maximum tolerable data loss. Here RTO is four hours and RPO is one hour. Both come from the business impact analysis.

Who is ultimately accountable for classifying a dataset and deciding who may access it, even though IT staff physically maintain the storage?

• a.The end user
• b.The custodian
• c.The data processor
• d.The data owner✓

The data owner is accountable for a dataset, including its classification and access decisions, even when custodians handle day-to-day storage and protection. Ownership assigns responsibility for the data's proper handling. Custodians and stewards execute the owner's decisions.