CompTIA Security+ — All Questions

During an investigation, analysts find event times inconsistent across servers, making correlation impossible. Securing and synchronizing which service fixes this?

• a.Network Time Protocol✓
• b.Domain Name System
• c.Simple Mail Transfer Protocol
• d.Dynamic Host Configuration Protocol

Network Time Protocol (NTP) synchronizes clocks so log timestamps agree across systems, which is essential for correlating events during investigations. It should be secured because forged time can hide or misorder activity. Accurate, trusted time is the foundation of usable logs.

A firewall administrator prefers a secure file-transfer protocol that uses a single connection over one port, simplifying firewall rules. Which fits better than FTPS?

• a.TFTP
• b.SFTP over SSH✓
• c.HTTP
• d.Plain FTP, which negotiates a separate dynamic data port

SFTP runs over a single SSH connection on one port, so firewall rules are simple, unlike FTPS which uses separate control and dynamic data ports. Both are secure, but SFTP is friendlier to firewalls. Single-connection design is the practical advantage here.

To keep users' DNS lookups private from on-path observers on public Wi-Fi, a browser encrypts queries inside HTTPS. This technique is called:

• a.Split-horizon DNS
• b.Recursive resolution
• c.DNS over HTTPS✓
• d.A sinkhole

DNS over HTTPS (DoH) tunnels DNS queries inside HTTPS so on-path observers cannot see or tamper with lookups, improving privacy. DNS over TLS achieves similar protection on a dedicated port. Encrypting the query channel is what defeats passive DNS snooping.

Before a laptop plugged into a conference-room network jack gets access, a switch forces it to authenticate to a RADIUS server. Which standard enforces this port-based control?

• a.IEEE 802.1X✓
• b.WPA3, the current security standard for wireless client access
• c.NAT
• d.STP

IEEE 802.1X provides port-based network access control, requiring devices to authenticate through an authenticator to a RADIUS server before the port passes traffic. It works on both wired and wireless links. Authenticating at the port before granting access is its defining function.

A wireless network requires both the client and the server to present certificates, eliminating passwords entirely for the strongest mutual authentication. Which EAP method is this?

• a.PSK
• b.EAP-MD5, which offers only a weak one-way password hash
• c.EAP-TLS✓
• d.PEAP

EAP-TLS requires certificates on both the client and the server, providing mutual authentication without passwords, which makes it the strongest common EAP method. Managing client certificates is the operational cost. Mutual certificate authentication is what sets it apart from tunnel-only methods.

A hotel Wi-Fi redirects newly connected guests to a web page requiring them to accept terms before internet access is granted. What is this mechanism?

• a.A guest PSK
• b.A RADIUS federation trust
• c.An evil twin access point
• d.A captive portal✓

A captive portal intercepts new connections and forces users to a web page to authenticate or accept terms before granting access. It is common on guest and public networks. The forced redirect before access is the identifying behavior.

A remote laptop must filter inbound and outbound connections based on rules even when it is off the corporate network. Which control operates directly on that endpoint?

• a.A load balancer
• b.A network intrusion prevention system
• c.A screened subnet
• d.A host-based firewall✓

A host-based firewall runs on the endpoint itself, filtering traffic wherever the device is, including off the corporate network. Network firewalls protect only while traffic passes through them. Traveling with the device is the host firewall's advantage.

An endpoint agent not only detects malicious behavior on the host but actively blocks the offending process in real time. Which best describes it?

• a.A data loss prevention agent
• b.A host-based intrusion prevention system✓
• c.A host-based intrusion detection system, which only logs and alerts
• d.A SIEM platform

A host-based intrusion prevention system (HIPS) both detects and actively blocks malicious activity on the host, unlike a HIDS that only alerts. The distinction is the ability to stop, not merely observe. Inline prevention on the endpoint is the key trait.

To stop unknown executables from running, an administrator configures endpoints so only explicitly approved applications can launch and everything else is blocked. This is:

• a.Antivirus signature scanning
• b.Blocklisting
• c.Application allowlisting✓
• d.Sandboxing

Application allowlisting permits only approved programs to run and denies everything else, which stops unknown and zero-day executables by default. Blocklisting is the weaker inverse, blocking only known-bad items. Default-deny for applications is the strength of allowlisting.

A laptop is stolen while powered off, but the thief cannot read any data because the entire drive, including the operating system, was encrypted and unlocks only with the user's key. Which protection was in place?

• a.Full-disk encryption✓
• b.A host firewall
• c.Antivirus software
• d.A screen-lock timeout

Full-disk encryption renders the entire drive unreadable without the key, protecting data at rest if a powered-off device is stolen. A screen lock or firewall would not stop someone removing the drive. Encrypting the whole volume is what defeats offline data theft.

To ensure a device loads only firmware and bootloaders signed by trusted keys, blocking bootkits that load before the OS, an administrator enables which UEFI feature?

• a.Full-disk encryption
• b.A firewall
• c.Application allowlisting
• d.Secure Boot✓

Secure Boot verifies signatures on firmware and bootloaders so only trusted code runs during startup, blocking bootkits and rootkits that load before the OS. Disk encryption protects data but not the boot chain. Signature checking at boot is Secure Boot's purpose.

A company must enforce passcodes, push required apps, and remotely wipe hundreds of employee smartphones from one console. Which system provides this centralized control?

• a.A VPN client
• b.A host-based intrusion detection system
• c.Mobile device management✓
• d.A data loss prevention gateway

Mobile device management (MDM) centrally enforces policies, deploys apps, and can remotely lock or wipe enrolled devices. It gives administrators consistent control over a fleet of phones and tablets. Central lifecycle management is what defines MDM.

On employee-owned phones, a company isolates corporate email and files inside a managed, encrypted workspace separate from personal apps, so only that workspace can be wiped. This approach is:

• a.Geofencing
• b.Containerization✓
• c.Full-disk encryption
• d.A shared PSK

Containerization separates corporate data into a managed, encrypted workspace on a personal device, allowing selective wipe without touching personal content. This balances BYOD flexibility with corporate control. Isolating work data from personal data is its core benefit.

A logistics app automatically locks certain features whenever a company tablet leaves the warehouse's GPS boundary. Which control uses location this way?

• a.Geotagging
• b.Remote wipe
• c.Full-disk encryption
• d.Geofencing✓

Geofencing defines a virtual geographic boundary and changes device behavior based on whether the device is inside or outside it. Here it disables features off-site to reduce risk. Acting on GPS-defined location is the defining trait of geofencing.

An employee reports their corporate phone lost in a taxi. Which MDM action best prevents data exposure by erasing the device's contents immediately?

• a.Rotating the office wireless pre-shared key
• b.Forcing a password change on the user's cloud email account
• c.Remote wipe✓
• d.Geofencing

Remote wipe erases the device's data from the management console, preventing exposure if it cannot be recovered. It is the direct response to a lost or stolen managed device. Immediate data erasure is what protects the information.

An MDM policy blocks devices whose operating system protections have been bypassed to gain unrestricted privileges, since such devices can evade security controls. What condition is being detected?

• a.A longer screen-lock timeout interval
• b.An older but still vendor-supported operating system version
• c.Public Wi-Fi use
• d.Jailbreaking or rooting✓

Jailbreaking or rooting removes the OS's built-in security restrictions, letting apps run with full privileges and bypass controls. MDM detects and blocks such devices because they can no longer be trusted to enforce policy. The removal of platform protections is the risk being caught.

Thousands of internet-connected cameras were conscripted into a botnet because they all shipped with the same factory username and password. Which hardening step would most directly have prevented this?

• a.Exposing each camera's web interface directly to the internet
• b.Placing every camera on one flat network segment
• c.Changing the default credentials✓
• d.Enabling UPnP port forwarding

Default credentials are publicly documented, so leaving them lets attackers log in en masse, which is how large IoT botnets form. Changing them to unique strong passwords closes that trivial entry path. Removing known defaults is the single most impactful step here.

A medical infusion pump runs a real-time embedded OS that the vendor rarely patches and cannot run endpoint agents. Which compensating control best reduces its risk?

• a.Isolating it on a segmented network with strict access controls✓
• b.Installing a full endpoint detection and response agent directly onto the infusion pump
• c.Enabling full-disk encryption on the pump's very limited internal flash storage chip
• d.Requiring users to run frequent authenticated credentialed vulnerability scans against it

Embedded and legacy medical devices often cannot be patched or run agents, so network isolation and tight access control are the practical compensating controls. Segmentation limits what can reach the device and what it can reach. When you cannot fix the device, you constrain its exposure.

An industrial plant connects its operational technology control network to the corporate IT network for reporting, raising concern about attacks crossing over. Which architecture best limits this exposure?

• a.Directly bridging both networks so engineers can freely manage control systems from any desk
• b.An industrial DMZ segmenting OT from IT with controlled data flows✓
• c.Disabling all logging on the control systems to conserve their very limited processing power
• d.Assigning every industrial controller a public IP address for convenient remote vendor access

An industrial DMZ places a controlled buffer between OT and IT, brokering only necessary data flows and preventing direct access to control systems. This contains threats that reach IT from spreading into OT. Segmentation with a mediated boundary is the recommended pattern.

An IoT vendor wants to push firmware updates over the air while ensuring devices reject any update not produced by the vendor. Which mechanism should the device enforce?

• a.Allowing updates from any server on the local network to speed up the deployment
• b.Disabling updates entirely so the firmware can never be tampered with by anyone remotely
• c.Verifying a digital signature on the firmware before installing✓
• d.Accepting any update that is delivered over an encrypted TLS channel automatically

Requiring a valid digital signature ensures the firmware truly came from the vendor and was not altered before the device installs it. An encrypted channel protects transit but does not prove authorship. Signature verification is what authenticates the update's source and integrity.

Beyond ports and IP addresses, a firewall must identify and block specific applications like peer-to-peer file sharing and inspect encrypted traffic. Which firewall type provides this?

• a.A next-generation firewall✓
• b.A router ACL
• c.A stateful firewall
• d.A packet-filtering firewall

A next-generation firewall adds application awareness, deep packet inspection, and often TLS inspection and integrated intrusion prevention. This lets it identify and control specific apps rather than just ports. Application-layer visibility is what defines an NGFW.

A public web application keeps getting hit with SQL injection and cross-site scripting attempts. Which control specifically inspects HTTP requests to filter these application-layer attacks?

• a.A network intrusion detection sensor
• b.A web application firewall✓
• c.A load balancer
• d.A network firewall

A web application firewall inspects HTTP/HTTPS requests and filters application-layer attacks like SQL injection and cross-site scripting. Network firewalls operate lower in the stack and miss these payloads. Understanding web request content is what makes a WAF effective here.

To hide backend web servers and terminate TLS for inbound client requests, an organization places a device in front of its servers that accepts connections on their behalf. Which device is this?

• a.A reverse proxy✓
• b.A jump server
• c.A network intrusion detection sensor
• d.A forward proxy

A reverse proxy sits in front of servers, accepting client connections, hiding backend details, and often terminating TLS and load balancing. A forward proxy, by contrast, fronts clients making outbound requests. Serving on behalf of the servers is what makes it reverse.

Before granting network access, a system checks that a connecting device has current antivirus, required patches, and disk encryption, quarantining it if not. Which technology enforces this?

• a.A load balancer
• b.A screened subnet that hosts internet-facing services away from internal systems
• c.A reverse proxy
• d.Network access control✓

Network access control (NAC) checks device posture, such as patches, antivirus, and encryption, before admitting a device, quarantining or remediating non-compliant ones. This keeps unhealthy endpoints off the network. Posture assessment at admission is the NAC function.

To stop someone from unplugging a printer and connecting a rogue laptop or hub to a switch port, an administrator limits which and how many MAC addresses a port accepts. This is:

• a.Network address translation
• b.QoS marking
• c.Spanning Tree Protocol
• d.Port security✓

Port security restricts which MAC addresses, and how many, a switch port allows, blocking unauthorized devices or hubs plugged into the port. Violations can shut down or restrict the port. Controlling access at the physical switch port is its purpose.

Without buying more switches, a network team wants to logically separate finance and guest traffic on the same physical infrastructure. Which technology accomplishes this?

• a.Port forwarding
• b.VLANs✓
• c.Link aggregation
• d.NAT

Virtual LANs (VLANs) logically segment one physical switch infrastructure into separate broadcast domains, isolating traffic like finance from guest. This limits reach and contains issues without extra hardware. Logical separation on shared switches is the VLAN advantage.

So administrators can still reach and recover network devices even when the production data path is down or compromised, they use a physically separate management channel. This is:

• a.Out-of-band management✓
• b.A screened subnet
• c.In-band management, which shares the very links that carry production traffic
• d.A reverse proxy

Out-of-band management uses a dedicated, separate channel to reach devices independent of the production network, so admins retain access during outages or attacks. In-band management fails when the data path fails. Independence from the production path is the security benefit.

To block users from reaching known malicious or phishing domains, a company routes all lookups through a service that refuses to resolve blacklisted names. This control is:

• a.A VPN
• b.A load balancer
• c.Network address translation
• d.DNS filtering✓

DNS filtering, sometimes called protective DNS, refuses to resolve known malicious or unwanted domains, stopping connections before they start. It is a lightweight, broad control against phishing and malware callbacks. Blocking at name resolution is what makes it effective early.

Inbound mail should be scanned for malware, phishing links, and spam before reaching user inboxes, and outbound mail checked for data leakage. Which appliance performs this?

• a.An IDS sensor
• b.A WAF
• c.A network access control server
• d.A secure email gateway✓

A secure email gateway filters inbound and outbound mail for malware, phishing, spam, and data leakage before messages reach users or leave the organization. It is a focused control at the email boundary. Inspecting mail specifically is what distinguishes it from general network tools.

A wireless upgrade replaces the pre-shared key handshake with one resistant to offline dictionary attacks even when a weak passphrase is used. Which standard introduces this via SAE?

• a.WPA3✓
• b.Open authentication
• c.WPA2-Personal
• d.WEP

WPA3 replaces the PSK handshake with Simultaneous Authentication of Equals (SAE), which resists offline dictionary attacks even against weak passphrases. WPA2's four-way handshake could be captured and cracked offline. SAE's resistance to offline guessing is the major improvement.

Rather than sharing one Wi-Fi passphrase company-wide, an organization wants each employee to authenticate with their own credentials against a RADIUS server. Which wireless mode is required?

• a.WPA2/WPA3-Enterprise with 802.1X✓
• b.WPA2-Personal with one shared pre-shared key
• c.WEP with a static shared key
• d.An open guest network

Enterprise wireless mode uses 802.1X with a RADIUS server so each user authenticates individually, enabling per-user credentials, accounting, and revocation. Personal mode shares one key among all devices. Individual authentication is the reason Enterprise is required here.

At a coffee shop, an attacker broadcasts a Wi-Fi network using the same name as the legitimate one to lure clients into connecting through them. This attack is a(n):

• a.Jamming
• b.WPS brute-force attack
• c.Evil twin✓
• d.Deauthentication flood

An evil twin is a rogue access point that mimics a legitimate network's name to trick clients into connecting, enabling interception of their traffic. It relies on users trusting a familiar SSID. Impersonating the real network is the defining tactic.

A router feature meant to simplify setup lets clients join with an eight-digit PIN, but the PIN is brute-forceable in hours. Security guidance is to disable which feature?

• a.The 5 GHz radio band
• b.MAC address filtering
• c.SSID broadcasting
• d.Wi-Fi Protected Setup✓

Wi-Fi Protected Setup (WPS) uses an eight-digit PIN that is vulnerable to brute force because it is validated in two halves, so it should be disabled. Its convenience comes at a serious security cost. Turning WPS off removes this easily exploited weakness.

An attacker repeatedly sends spoofed management frames that kick clients off a wireless network, often to force reconnection to a rogue access point. This is a:

• a.Rainbow table attack
• b.SQL injection attack
• c.Deauthentication attack✓
• d.Cross-site scripting attack

A deauthentication attack forges management frames to disconnect wireless clients, which can cause denial of service or push victims onto an evil twin. Protected Management Frames mitigate it. Spoofing disconnect frames is the mechanism of the attack.

Before deploying access points in a new office, engineers map signal strength and interference to place APs and set power levels appropriately. This process is a:

• a.Business impact analysis
• b.Penetration test
• c.Wireless site survey✓
• d.Vulnerability scan

A wireless site survey measures signal coverage, interference, and capacity to plan access point placement and power settings. Good surveys prevent dead zones and rogue-AP opportunities from weak coverage. Mapping the RF environment is the purpose of the survey.

An administrator relies on allowing only known hardware addresses onto the Wi-Fi, but an attacker still gets on. Why is MAC filtering weak on its own?

• a.Because it requires every client to complete a certificate-based mutual handshake first
• b.Because it forces all of the devices on the network to share a single static pre-shared key
• c.Because MAC addresses can be sniffed and spoofed by an attacker✓
• d.Because MAC filtering encrypts the wireless traffic with an outdated and easily broken cipher

MAC addresses travel in cleartext and can be captured and spoofed, so an attacker can clone an allowed address to bypass filtering. It provides no real authentication or encryption. Being trivially forgeable is why MAC filtering is only a weak add-on.

A wireless network protects user passwords by wrapping the inner authentication inside a TLS tunnel established with only a server-side certificate. Which EAP method is this?

• a.EAP-TLS
• b.PEAP✓
• c.EAP-MD5
• d.PSK

Protected EAP (PEAP) builds a TLS tunnel using only a server certificate and then runs the inner authentication protected inside it. This shields credentials without requiring client certificates. Server-side certificate plus a protected inner method is the PEAP pattern.

A retail store offers customer Wi-Fi but must ensure guests cannot reach point-of-sale systems or each other. Which combination best achieves this?

• a.Placing the guests and the POS terminals together on one shared VLAN for simpler management
• b.Disabling all encryption on the guest network to reduce the processing overhead placed on the access points
• c.A separate guest VLAN with client isolation and firewall rules blocking internal access✓
• d.Publishing the POS network passphrase to guests so that support requests are easier to handle

A separate guest VLAN with client isolation stops guests from reaching each other, and firewall rules block access to internal systems like the POS. This layered segmentation protects cardholder systems from untrusted users. Isolating and restricting guest traffic is the correct design.

To defend against deauthentication and disassociation spoofing, a modern wireless standard cryptographically protects management frames. This feature is:

• a.SSID hiding
• b.Protected Management Frames✓
• c.MAC filtering, which restricts access to a preset list of hardware addresses
• d.Band steering

Protected Management Frames (802.11w) authenticate and protect management frames so attackers cannot forge deauthentication or disassociation messages. This directly counters common wireless denial-of-service tricks. Cryptographically protecting management frames is the defense.

In a zero-trust data center, an architect enforces security policies between individual workloads so even east-west traffic inside the same subnet is inspected and controlled. This granular approach is:

• a.Microsegmentation✓
• b.A flat network
• c.Perimeter security
• d.Port forwarding

Microsegmentation applies fine-grained policies between individual workloads, controlling east-west traffic that traditional perimeter firewalls never see. This limits lateral movement after a breach. Enforcing policy workload-to-workload is the zero-trust idea it implements.

Analysts receive an alert only after the SIEM links a failed VPN login, a privilege change, and a large data transfer from the same account within minutes. Which SIEM capability produced this insight?

• a.Log rotation
• b.Retention
• c.Compression, which reduces the on-disk storage footprint of the collected logs
• d.Correlation of events across multiple sources✓

Correlation links related events from different sources into a single meaningful alert that no individual log would reveal alone. It is what turns raw log volume into actionable detection. Connecting the dots across sources is the core value of a SIEM.

To investigate incidents efficiently, an organization forwards logs from firewalls, servers, and applications to one central collector. What is the main security value of this aggregation?

• a.It automatically encrypts every individual endpoint's local drive against physical theft
• b.It guarantees that no attacker can ever manage to breach the network's outer perimeter
• c.It preserves logs centrally even if an attacker deletes them on a host✓
• d.It replaces the need for any endpoint detection or antivirus software running on the hosts

Centralized log aggregation preserves evidence even when an attacker wipes local logs to cover their tracks, and it enables cross-system correlation. Logs left only on a compromised host are easily destroyed. Central, protected collection is what keeps them trustworthy and available.

Correlating events across systems only works if their log timestamps agree. Which practice ensures accurate cross-system timelines during an investigation?

• a.Storing every log only on the individual device that generated it for the sake of isolation
• b.Rotating logs frequently so that older timestamped entries are quickly discarded from disk
• c.Letting each device keep its own manually set local clock independently and indefinitely
• d.Synchronizing all devices to a common trusted time source✓

Synchronizing devices to a common trusted time source, such as NTP, keeps timestamps consistent so events can be ordered and correlated accurately. Drifting clocks make reconstruction unreliable or impossible. Consistent time is the backbone of any credible timeline.

A new detection rule floods analysts with alerts that turn out to be benign scheduled backups, causing real alerts to be missed. What should the team do?

• a.Escalate every single alert to executive management
• b.Ignore every alert produced by that rule permanently
• c.Disable logging on the backup servers
• d.Tune the rule to reduce false positives✓

Tuning the rule to exclude the known benign backup activity reduces false positives so analysts can focus on genuine threats. Disabling logging or blindly ignoring alerts would create blind spots. Refining detection logic preserves visibility while cutting noise.

A platform builds behavioral baselines for each account and flags when a user suddenly accesses systems at 3 a.m. from a new location and downloads gigabytes of data. Which capability is this?

• a.Signature-based antivirus
• b.A stateful firewall
• c.User and entity behavior analytics✓
• d.Data loss prevention on outbound email

User and entity behavior analytics (UEBA) baselines normal behavior and flags anomalies like odd hours, new locations, and abnormal data volumes. It catches account misuse and insider threats that signature tools miss. Deviation from a learned baseline is what triggers it.

Investigators want to see which hosts talked to which, how much, and when across the network over the past month without storing full packet payloads. Which data source fits?

• a.Full packet captures retained for months
• b.Endpoint antivirus quarantine logs
• c.SNMP polling
• d.NetFlow records✓

NetFlow records connection metadata such as source, destination, volume, and timing without storing payloads, making long retention practical. It answers who talked to whom and how much. Metadata-only capture is why it scales for historical analysis.

To reconstruct exactly what data an attacker exfiltrated, analysts need the actual payload contents of the suspicious session, not just flow summaries. Which tool provides this?

• a.A CMDB
• b.NetFlow, which records connection metadata but never the payload contents
• c.A vulnerability scanner
• d.A full packet capture✓

A full packet capture records complete payloads, letting analysts reconstruct exactly what was transmitted, including exfiltrated content. NetFlow shows that data moved but not what it contained. Payload-level detail is why packet capture is needed here.

A team debates installing software on each server versus polling devices remotely for monitoring. What is a key advantage of the agent-based approach?

• a.It requires absolutely no configuration on any of the monitored endpoints at any time
• b.It works identically on legacy devices that are unable to run any installed software agent
• c.It eliminates all network traffic between the monitored hosts and the central collector
• d.It can collect richer, real-time host data even when the network path is limited✓

Agents run on the host and can gather deep, real-time telemetry and continue collecting even when connectivity is intermittent. Agentless polling is lighter to deploy but sees less and depends on the network. Richer host visibility is the agent trade-off.

When a phishing email is reported, a system automatically extracts the URLs, checks them against threat intelligence, quarantines matching messages, and opens a ticket. Which platform orchestrates this?

• a.SOAR✓
• b.IPS
• c.EDR
• d.Certificate authority

Security orchestration, automation, and response (SOAR) runs playbooks that chain tools together to enrich, decide, and act automatically. Here it triages phishing end to end without manual steps. Coordinating tools through playbooks is the SOAR function.

Leadership asks why automating routine response steps with playbooks is worthwhile. Which is the strongest security justification?

• a.It responds faster and more consistently, reducing human error and dwell time✓
• b.Automation guarantees that the organization will never again experience a security breach of any kind
• c.Automation permanently removes any need for human analysts to remain on the security team at all going forward
• d.It makes all of the collected security logs entirely unnecessary because responses are now automatic

Automation executes response steps quickly and identically every time, reducing human error and shrinking the time attackers dwell. It augments analysts rather than replacing them or eliminating logs. Speed and consistency, cutting dwell time, is the real benefit.