CompTIA Security+ — All Questions

Which security model assumes no user or device is trusted by default, even inside the network perimeter?

• a.Zero trust✓
• b.Perimeter security
• c.Implicit trust
• d.Defense in depth

Zero trust removes automatic trust based on network location and continuously verifies every request. Access is granted per session based on identity, device posture, and context. It reduces lateral movement after a breach.

Layering multiple independent security controls so that one failure does not cause a breach is called:

• a.Air gapping
• b.Single sign-on
• c.Defense in depth✓
• d.Least privilege

Defense in depth stacks overlapping controls across people, process, and technology so no single failure is catastrophic. If one layer is bypassed, others still protect the asset. It reflects the assumption that any one control can fail.

Dividing a network into isolated zones to limit the spread of an attack is known as:

• a.Tunneling
• b.Segmentation✓
• c.Load balancing
• d.Port forwarding

Network segmentation separates systems into zones so a compromise in one cannot freely reach others. It limits lateral movement and contains breaches. VLANs, firewalls, and microsegmentation implement this principle.

Which network area sits between the internet and the internal network to host public-facing services?

• a.Screened subnet (DMZ)✓
• b.VPN concentrator
• c.Air gap
• d.Intranet

A screened subnet, historically called a DMZ, isolates public-facing servers from the internal network. If a public host is compromised, the internal network remains protected by an additional boundary. Firewalls control traffic on both sides.

Which cloud model gives the customer the most control over the operating system and applications while the provider manages the physical hardware?

• a.Software as a Service
• b.Platform as a Service
• c.Function as a Service
• d.Infrastructure as a Service✓

Infrastructure as a Service (IaaS) provides virtualized compute, storage, and networking while the customer manages the OS and applications. This maximizes customer control and responsibility. SaaS, by contrast, hands nearly everything to the provider.

In cloud computing, which concept defines who is responsible for securing which layers of the stack?

• a.Multitenancy
• b.Serverless
• c.Elasticity
• d.Shared responsibility model✓

The shared responsibility model divides security duties between the cloud provider and the customer. The provider secures the underlying infrastructure while the customer secures data, identities, and configurations. Misunderstanding the split is a common source of cloud breaches.

Which technology allows multiple isolated operating systems to run on a single physical host?

• a.Containerization
• b.Clustering
• c.Virtualization✓
• d.Load balancing

Virtualization uses a hypervisor to run multiple guest operating systems on one physical machine, each isolated in a virtual machine. It improves resource use and isolation. Hardening the hypervisor is critical because it is a high-value target.

Which approach packages an application with its dependencies to run consistently across environments while sharing the host OS kernel?

• a.Bare-metal deployment
• b.Full virtualization
• c.Containerization✓
• d.Air gapping

Containerization bundles an application and its dependencies into a lightweight, portable unit that shares the host kernel. Containers start quickly and use fewer resources than full VMs. Isolation is weaker than VMs, so kernel and image security matter.

Which principle grants users only the minimum access needed to perform their job?

• a.Least privilege✓
• b.Implicit deny
• c.Separation of duties
• d.Defense in depth

Least privilege limits each user or process to only the permissions required for its role. This shrinks the attack surface and limits damage from compromised accounts. Regular access reviews keep privileges aligned with need.

A firewall rule set ends with a rule that blocks anything not explicitly permitted. This is called:

• a.Explicit allow
• b.Implicit deny✓
• c.Stateful inspection
• d.Failover

Implicit deny blocks all traffic that no earlier rule explicitly allows. It ensures only intended traffic passes and unknowns are rejected by default. This deny-by-default posture is a core secure design principle.

Which design ensures a system has no single point of failure by duplicating critical components?

• a.Segmentation
• b.Redundancy✓
• c.Least functionality
• d.Tokenization

Redundancy duplicates critical components, such as power supplies or servers, so failure of one does not cause an outage. It supports high availability and resilience. Combined with failover, it keeps services running through faults.

Which term describes an isolated environment where suspicious code can be executed and analyzed safely?

• a.Sandbox✓
• b.Honeypot
• c.Bastion host
• d.Air gap

A sandbox is a contained, isolated environment for running untrusted code without risking the host or network. It is used to analyze malware behavior or test software safely. Escapes from the sandbox are a key security concern.

Which decoy system is deployed to attract attackers and study their techniques?

• a.Proxy server
• b.Load balancer
• c.Honeypot✓
• d.Jump server

A honeypot is a deliberately vulnerable-looking decoy that lures attackers away from real assets and gathers intelligence on their methods. Any interaction with it is suspicious by design. Honeynets extend the concept to entire fake networks.

Which hardened intermediary host is used to securely administer devices in a sensitive network segment?

• a.Web proxy
• b.Honeypot
• c.Jump server (bastion host)✓
• d.DNS resolver

A jump server, or bastion host, is a tightly controlled system that administrators connect through to reach protected segments. It centralizes and monitors administrative access. Hardening and logging on this host are essential because it is a gateway to sensitive systems.

Which control physically separates a highly sensitive network from all other networks and the internet?

• a.Air gap✓
• b.Screened subnet
• c.NAT
• d.VPN

An air gap isolates a system or network so it has no physical or logical connection to untrusted networks. It is used for critical systems like industrial controls. Data transfer requires manual, controlled processes, which reduces remote attack surface.

Which concept keeps availability high by automatically shifting workloads to a standby system when the primary fails?

• a.Segmentation
• b.Failover✓
• c.Load balancing
• d.Snapshotting

Failover automatically transfers operations to a redundant standby when the active component fails, minimizing downtime. It is a cornerstone of high-availability design. Regular testing ensures the standby will actually take over when needed.

Embedded systems in industrial equipment that monitor and control physical processes are collectively known as:

• a.IoT hubs
• b.ICS/SCADA✓
• c.Edge routers
• d.Thin clients

Industrial control systems (ICS), including SCADA, manage physical processes in utilities and manufacturing. They often run legacy software and prioritize availability over patching. Segmentation and strict access control are key because downtime and safety are critical.

Which design principle removes unnecessary services, ports, and software to reduce a system's attack surface?

• a.Least functionality✓
• b.Elasticity
• c.Multitenancy
• d.Redundancy

Least functionality configures a system to run only the services and features required for its purpose. Disabling unneeded components shrinks the attack surface. It complements least privilege by hardening the system itself, not just user access.

In a zero trust architecture, which component makes the access decision by evaluating policy against a request's context?

• a.The workload's data plane
• b.A perimeter firewall
• c.The policy engine in the control plane✓
• d.The end user's device, which self-certifies that it should be trusted

In zero trust, the control plane's policy engine evaluates identity, device posture, and context to decide whether to grant access. The data plane then enforces that decision on traffic. Separating decision from enforcement is central to the model.

Which zero trust component actually allows or blocks the connection once the policy decision is made?

• a.The policy administrator, which relays decisions and configures the session
• b.The policy engine
• c.The certificate authority
• d.The policy enforcement point✓

The policy enforcement point (PEP) sits in the data path and enforces the allow-or-deny decision produced by the policy engine and administrator. It is where access is physically granted or blocked. This division keeps decision logic separate from enforcement.

A zero trust design continuously re-evaluates trust and narrows what each authenticated session can reach. Which paired concepts describe this?

• a.Implicit trust zones combined with a single one-time login valid for the whole day
• b.Adaptive identity and threat scope reduction✓
• c.Perimeter-only defense combined with unrestricted lateral movement once already inside
• d.Flat network design combined with permanent, static access rights for all of the users

Adaptive identity adjusts trust based on real-time context, while threat scope reduction limits the blast radius of any single session. Together they minimize what a compromised session can do. Both are core zero trust concepts.

A customer assumes the cloud provider will encrypt their stored data, but a breach reveals the customer was responsible for that setting. Which document clarifies these boundaries?

• a.A service level agreement
• b.The cloud responsibility matrix✓
• c.A memorandum of understanding between two partner organizations
• d.A business impact analysis

The responsibility matrix documents which security duties belong to the provider versus the customer across the stack. Misreading it is a frequent cause of cloud breaches. Reviewing it prevents assumptions about who secures what.

A DevOps team defines its entire cloud network and firewall configuration in version-controlled template files that can be redeployed identically. What is this practice?

• a.Shadow IT
• b.Infrastructure as code✓
• c.Data sovereignty, which governs the jurisdiction whose laws apply
• d.A honeynet

Infrastructure as code (IaC) provisions and manages infrastructure through machine-readable definition files rather than manual configuration. It brings consistency, versioning, and repeatability, reducing configuration drift. Reviewing the code catches misconfigurations before deployment.

An architecture decomposes an application into many small, independently deployed services communicating over the network. Which security consideration grows most with this microservices approach?

• a.The removal of all logging requirements because each service is small and simple to run
• b.The complete elimination of any need for authentication between the internal services
• c.A larger attack surface from many exposed service interfaces requiring protection✓
• d.A guarantee that a compromise of one service can never affect any other service at all

Microservices multiply the number of network-exposed interfaces, enlarging the attack surface and the need for service-to-service authentication and monitoring. Each API must be secured. Consistent access control and observability across services are essential.

Over time, an organization accumulates hundreds of forgotten, unpatched virtual machines that no one actively manages. Which risk does this describe?

• a.Data sovereignty
• b.VM sprawl✓
• c.VM escape
• d.A screened subnet

VM sprawl is the uncontrolled growth of virtual machines beyond what can be tracked and maintained. Forgotten, unpatched VMs become vulnerable entry points. Lifecycle management and inventory controls keep sprawl in check.

Where should an organization place its public-facing web server so a compromise does not directly expose the internal network?

• a.In a screened subnet between the internet and the internal network✓
• b.Outside all firewalls with a public address and no filtering of inbound connections
• c.On the same segment as the domain controllers to simplify authentication traffic flow
• d.Directly on the internal LAN alongside employee workstations for easier management

A screened subnet isolates internet-facing servers so that compromising one does not grant direct access to the internal network. Firewalls control traffic on both sides of the zone. Proper device placement limits the blast radius of a public host breach.

Administrators must reach servers in a sensitive segment only through one hardened, heavily logged host. What is this host called?

• a.A load balancer
• b.A honeypot
• c.A reverse proxy
• d.A jump server✓

A jump server (bastion host) is a hardened intermediary through which administrators access protected segments. Centralizing and logging admin access there reduces exposure and aids monitoring. It must itself be tightly secured as a gateway.

A security appliance is configured so that if it stops functioning, all traffic is blocked rather than allowed through. This design choice is called:

• a.Port mirroring
• b.Fail-open
• c.Fail-closed✓
• d.Load balancing

A fail-closed (fail-secure) design denies traffic when the control fails, favoring security over availability. Fail-open does the opposite, allowing traffic to preserve availability. The choice depends on whether security or uptime is the priority.

A network sensor is deployed to receive a copy of traffic through a mirror port so it can observe without sitting in the traffic path. This deployment is:

• a.A fail-closed configuration
• b.An inline mode that can block malicious packets in the forwarding path
• c.A passive tap or monitor mode✓
• d.A proxy configuration

A tap or monitor (passive) deployment receives copied traffic and can observe or alert but cannot block, since it is not in the forwarding path. Inline devices, by contrast, can drop traffic. Passive placement avoids becoming a point of failure.

To protect a web application from SQL injection and cross-site scripting, which control inspects HTTP requests at the application layer?

• a.A web application firewall✓
• b.A load balancer
• c.A packet-filtering firewall
• d.A network tap

A web application firewall (WAF) inspects HTTP and HTTPS traffic at the application layer to block attacks like injection and cross-site scripting. It understands web request structure that a basic firewall does not. It complements, rather than replaces, network firewalls.

Which device combines stateful firewalling with integrated intrusion prevention, deep packet inspection, and application awareness in one platform?

• a.A passive network tap
• b.A next-generation firewall✓
• c.A layer 2 switch
• d.A stateless access control list applied on a router interface

A next-generation firewall (NGFW) integrates traditional firewalling with deep packet inspection, application awareness, and intrusion prevention. This consolidated visibility enables policy based on applications and content, not just ports. It is a common perimeter and segmentation control.

A site-to-site VPN must authenticate and encrypt IP traffic between two office networks at the network layer. Which protocol suite is designed for this?

• a.SNMPv1
• b.HTTP
• c.SMTP
• d.IPSec✓

IPSec secures IP communications by authenticating and encrypting packets at the network layer, making it well suited to site-to-site VPNs. It provides confidentiality, integrity, and authentication. It commonly uses IKE to negotiate keys and security associations.

An organization wants to converge networking and security, delivering firewall, secure web gateway, and zero trust access from the cloud to remote sites and users. Which model fits?

• a.Secure access service edge✓
• b.A single on-premises perimeter firewall
• c.A screened subnet
• d.An air-gapped network

Secure access service edge (SASE) converges networking and security functions into a cloud-delivered service close to users and sites. It combines capabilities like SD-WAN, secure web gateway, and zero trust access. This suits distributed workforces better than backhauling traffic.

Sensitive records are encrypted on disk but are decrypted into memory while an application processes them. Which data state is hardest to protect in this moment?

• a.Data at rest
• b.Data in use✓
• c.Data in transit
• d.Cold data

Data in use is the most challenging state to protect because the information must be decrypted in memory to be processed. Techniques like confidential computing and strict memory protections address it. At rest and in transit are more readily secured with encryption.

A support tool must display only the last four digits of a customer's card number while hiding the rest with asterisks. Which technique is this?

• a.Data masking✓
• b.Hashing
• c.Steganography
• d.Full-disk encryption

Data masking obscures parts of a value, showing only what is needed, such as the last four digits, while hiding the rest. It reduces exposure in interfaces and reports. Unlike tokenization, the original is not replaced with a separate stored token.

An organization labels information as public, internal, confidential, or restricted to drive how each is handled and protected. What is this practice called?

• a.Data remanence
• b.Tokenization
• c.Data classification✓
• d.Data sovereignty, which fixes the governing jurisdiction

Data classification assigns sensitivity levels so that handling, access, and protection can be applied proportionally. Higher classifications warrant stronger controls. Clear labels make policy enforcement and compliance consistent.

A multinational must ensure certain citizens' personal data is stored only on servers physically located within their home country. Which concept governs this requirement?

• a.Data sovereignty✓
• b.High availability
• c.Load balancing
• d.Data masking

Data sovereignty means data is subject to the laws of the country where it is stored, which can mandate keeping it within specific borders. Geographic storage decisions must satisfy these legal requirements. Provider region controls help enforce it.

Two database servers are configured so that if the active one fails, the standby immediately takes over with the same data. Which resilience concept is this?

• a.High-availability clustering with failover✓
• b.Data classification
• c.Load balancing
• d.Network segmentation, which isolates zones to contain the spread of an attack

High-availability clustering pairs systems so a standby assumes operation if the active node fails, minimizing downtime. Failover is the automatic transfer of service. This differs from load balancing, whose primary aim is distributing load.

A recovery facility has hardware and network connectivity in place but needs current data restored and some configuration before it can run operations. Which site type is this?

• a.A hot site
• b.A cold site
• c.A warm site✓
• d.A mobile site delivered on a trailer and positioned wherever it is temporarily needed

A warm site has equipment and connectivity but requires restoring data and some setup before taking over, balancing cost and recovery speed. A hot site is faster but pricier, and a cold site is cheaper but slower. The choice reflects the RTO.

To survive a regional disaster such as a hurricane, an organization replicates its data and systems to a facility hundreds of miles away. Which principle is applied?

• a.Geographic dispersion✓
• b.Least privilege
• c.Network segmentation used to contain lateral movement inside one data center
• d.Tokenization

Geographic dispersion places recovery capabilities far enough away that a single regional event cannot affect both sites. This protects against disasters that would take out a local backup. Distance must balance latency against risk isolation.

A company keeps encrypted backup copies at a separate location so a fire at the primary site cannot destroy every copy. Which two backup considerations are being applied?

• a.Load balancing and clustering to keep the production systems continuously available
• b.Snapshot frequency and journaling to capture every individual database transaction
• c.Onsite storage and plaintext retention for the fastest possible restore performance
• d.Offsite storage and encryption of the backups✓

Storing backups offsite protects against site-wide disasters, and encrypting them protects confidentiality if the media is lost or stolen. Both are key backup considerations. The 3-2-1 approach also emphasizes multiple copies and media types.

To validate disaster recovery without disrupting production, a team brings up the recovery systems and processes real transactions on them alongside the live systems. Which test is this?

• a.A full-interruption test that shuts production down to force a live failover
• b.A tabletop exercise
• c.A vulnerability scan
• d.A parallel processing test✓

A parallel test runs recovery systems alongside production to confirm they work without taking production offline. It provides strong assurance with limited risk. A full-interruption test is more realistic but disruptive.

During a brief power flicker, which device provides immediate battery power to keep servers running until a longer-term source engages?

• a.A surge protector
• b.A standby generator
• c.A power distribution unit, which only allocates power already being supplied
• d.An uninterruptible power supply✓

An uninterruptible power supply (UPS) delivers instantaneous battery power during outages or fluctuations, bridging the gap until a generator starts. It also conditions power against spikes and sags. UPS plus generator gives both immediate and sustained backup.

Before deploying new laptops, an organization applies a documented standard configuration that disables unneeded services and enforces security settings. What is this standard called?

• a.A secure baseline✓
• b.A screened subnet
• c.A honeypot
• d.A recovery point objective

A secure baseline is a documented, standard secure configuration applied consistently to systems before deployment. It reduces attack surface and drift by starting every device from a known-good state. Benchmarks like CIS guide baseline creation.

Which environment typically prioritizes availability and safety over frequent patching, requiring careful segmentation because downtime can halt physical processes?

• a.A public cloud web application that scales elastically behind a managed load balancer
• b.A standard corporate email server that can be patched and rebooted on a weekly cycle
• c.A developer's laptop used for writing and testing application source code locally each day
• d.Industrial control systems and SCADA networks✓

ICS and SCADA systems control physical processes where downtime affects safety and operations, so patching windows are constrained. Strong network segmentation and strict access control compensate. Their legacy nature makes isolation essential.

A medical infusion pump runs a real-time operating system with limited memory and cannot easily accept traditional antivirus software. Which category and challenge does this represent?

• a.A virtual machine that can be snapshotted and rolled back at any convenient time needed
• b.A cloud-native container that can be redeployed instantly from an immutable base image
• c.A general-purpose server that can run any standard endpoint protection agent very easily
• d.An embedded system whose constraints limit traditional security controls✓

Embedded systems and their real-time operating systems have limited resources and long lifecycles, making conventional controls like antivirus impractical. Compensating controls such as segmentation and strict network filtering protect them. Vendor patching is often slow or unavailable.

A traditional network trusts any device once it is inside the corporate perimeter. Which weakness does zero trust specifically aim to remove?

• a.The presence of redundant components that keep services available during a failure
• b.The use of encryption for data transmitted across the untrusted public internet backbone
• c.The requirement that users authenticate at least once before accessing any resource
• d.Implicit trust granted based solely on network location✓

Zero trust eliminates implicit trust based on network location, since an attacker inside the perimeter would otherwise move freely. Instead it verifies every request by identity and context. This limits lateral movement after an initial breach.

In a public cloud, multiple customers share the same underlying physical hardware. Which security property must the provider guarantee between them?

• a.That all customers can freely read each other's data to ease collaboration
• b.That every customer manages the provider's physical data center access
• c.Strong logical isolation between tenants✓
• d.That all tenants share one key

Multitenancy means customers share infrastructure, so the provider must enforce strong logical isolation so one tenant cannot access another's data or workloads. A failure in isolation, such as VM escape, is a serious risk. Tenant boundaries are a core cloud security concern.

To ensure only authenticated devices can use a wired switch port before gaining network access, which standard should be implemented?

• a.HTTPS, which encrypts web traffic but does not authenticate a device onto a port
• b.DHCP address assignment
• c.Network address translation
• d.IEEE 802.1X port-based network access control✓

IEEE 802.1X provides port-based network access control, requiring a device to authenticate, often via EAP and a RADIUS server, before the port forwards traffic. This blocks unauthorized devices at the edge. It is a foundational network access control.

A virtualization admin wants to capture a point-in-time state of a VM so it can be instantly rolled back if a patch fails. Which capability provides this?

• a.Network segmentation
• b.Snapshots✓
• c.Geographic dispersion
• d.RAID

A snapshot records a virtual machine's state at a point in time, enabling quick rollback if a change causes problems. It is ideal before risky updates. Snapshots are not a substitute for full backups but complement recovery workflows.