CompTIA Security+ — All Questions

Which is the correct order of the incident response process?

• a.Preparation, detection, containment, eradication, recovery, lessons learned✓
• b.Recovery, containment, detection, preparation, lessons learned
• c.Detection, preparation, recovery, containment, eradication
• d.Containment, detection, recovery, preparation, eradication

A standard incident response lifecycle proceeds through preparation, detection and analysis, containment, eradication, recovery, and lessons learned. Preparation comes first so the team is ready before an incident. Lessons learned closes the loop to improve future response.

During incident response, which step focuses on limiting the damage and preventing the threat from spreading?

• a.Containment✓
• b.Preparation
• c.Recovery
• d.Eradication

Containment isolates affected systems to stop the incident from spreading while preserving evidence. It buys time to plan eradication without further loss. Short-term and long-term containment strategies balance disruption and safety.

Which system aggregates and correlates log data from many sources to detect security events in near real time?

• a.IDS
• b.DLP
• c.SIEM✓
• d.VPN

A security information and event management (SIEM) system centralizes logs from across the environment and correlates them to surface incidents. It supports alerting, dashboards, and investigation. Effective tuning reduces alert fatigue and false positives.

Which control monitors network traffic and actively blocks detected malicious activity inline?

• a.IPS✓
• b.IDS
• c.Honeypot
• d.SIEM

An intrusion prevention system (IPS) sits inline and can automatically block or drop malicious traffic it detects. Unlike an IDS, which only alerts, an IPS takes preventive action. Tuning is important to avoid blocking legitimate traffic.

Which technology inspects data in motion and at rest to prevent unauthorized exfiltration of sensitive information?

• a.Firewall
• b.VPN
• c.Data loss prevention✓
• d.Load balancer

Data loss prevention (DLP) detects and blocks sensitive data from leaving the organization through email, uploads, or removable media. It uses content inspection and policy rules. DLP helps enforce compliance and protect intellectual property.

Which process applies vendor updates to fix known software vulnerabilities?

• a.Hardening
• b.Patch management✓
• c.Baselining
• d.Tokenization

Patch management is the disciplined process of testing and deploying vendor updates to remediate vulnerabilities. Timely patching closes known exploit paths. A formal cycle balances speed with stability testing.

Reducing a system's attack surface by disabling unneeded services and applying secure configurations is called:

• a.Segmentation
• b.Failover
• c.Federation
• d.Hardening✓

Hardening strengthens a system by removing unnecessary services, closing ports, and applying secure settings and baselines. It reduces the attack surface before deployment. Configuration benchmarks guide consistent hardening.

Which practice ensures evidence remains admissible by documenting who handled it and when?

• a.Legal hold
• b.Chain of custody✓
• c.Data retention
• d.Nondisclosure

Chain of custody documents every person who handled evidence and each transfer, preserving integrity for legal proceedings. Gaps can render evidence inadmissible. It is essential in digital forensics and investigations.

During forensic acquisition, why is a cryptographic hash taken of a disk image?

• a.To compress the image
• b.To encrypt the evidence
• c.To prove the copy was not altered✓
• d.To speed up analysis

Hashing the original and the forensic image proves they are identical and that the evidence was not modified. Matching hashes demonstrate integrity throughout the investigation. Any change to the data would produce a different hash.

Which type of backup captures only the data changed since the last full backup and does not clear the archive bit each time?

• a.Incremental
• b.Full
• c.Differential✓
• d.Snapshot

A differential backup copies all data changed since the last full backup, growing larger each day until the next full. Restores require the last full plus the latest differential. Incremental backups, by contrast, capture changes since the last backup of any type.

Which metric defines the maximum acceptable amount of data loss measured in time?

• a.RTO
• b.MTTR
• c.MTBF
• d.RPO✓

The recovery point objective (RPO) is the maximum tolerable data loss expressed as a time window, guiding backup frequency. An RPO of one hour means backups must occur at least hourly. It differs from RTO, which addresses restoration time.

Which metric defines the maximum acceptable time to restore a service after an outage?

• a.MTBF
• b.MTTF
• c.RPO
• d.RTO✓

The recovery time objective (RTO) is the target duration within which a service must be restored after disruption. It drives decisions about redundancy and recovery capability. Meeting the RTO limits business impact from downtime.

Which recovery site is fully equipped and can take over operations almost immediately?

• a.Hot site✓
• b.Cold site
• c.Mobile site
• d.Warm site

A hot site is fully provisioned with hardware, data, and connectivity so it can assume operations quickly. It offers the fastest recovery but the highest cost. Cold sites are cheaper but require significant setup time.

Which scan identifies known weaknesses in systems without actively exploiting them?

• a.Fuzzing
• b.Penetration test
• c.Red team exercise
• d.Vulnerability scan✓

A vulnerability scan enumerates known weaknesses using signatures and checks without exploiting them. It is broad and repeatable for routine assessment. A penetration test goes further by attempting actual exploitation.

An authorized simulated attack that attempts to exploit vulnerabilities to test defenses is a:

• a.Penetration test✓
• b.Tabletop exercise
• c.Vulnerability scan
• d.Compliance audit

A penetration test authorizes ethical hackers to actively exploit weaknesses to demonstrate real-world risk. It validates whether vulnerabilities are truly exploitable and how far an attacker could get. Rules of engagement define scope and limits.

Which detection method flags activity that deviates from an established normal pattern?

• a.Signature-based
• b.Anomaly-based✓
• c.Rule-based
• d.Whitelist-based

Anomaly-based detection builds a baseline of normal behavior and alerts on deviations, enabling detection of novel attacks. It can catch previously unseen threats but may produce more false positives. Signature-based detection, by contrast, matches known patterns.

Which endpoint solution continuously records activity and enables investigation and automated response to threats on hosts?

• a.Screen lock policy
• b.Antivirus signature file
• c.Host firewall
• d.EDR✓

Endpoint detection and response (EDR) continuously monitors endpoint behavior, records telemetry, and supports rapid investigation and automated containment. It goes beyond signature antivirus by detecting suspicious behavior. It is central to modern threat hunting and response.

Which practice ensures logs cannot be tampered with by centralizing them on a protected, write-once server?

• a.Log rotation
• b.Log integrity and centralization✓
• c.Log compression
• d.Log sampling

Centralizing logs on a hardened, tamper-resistant server preserves their integrity for investigations. Attackers often try to delete local logs to hide activity, so protected central storage defeats this. Techniques like write-once media and hashing further ensure integrity.

A discussion-based session where a team walks through their response to a hypothetical incident is called a:

• a.Vulnerability assessment
• b.Full interruption test
• c.Penetration test
• d.Tabletop exercise✓

A tabletop exercise is a discussion-based walkthrough of a scenario to validate plans and roles without touching production. It reveals gaps in the incident response or continuity plan at low cost. It complements more disruptive technical tests.

Which automation approach uses playbooks to coordinate tools and streamline security operations tasks?

• a.DLP
• b.SIEM
• c.SOAR✓
• d.EDR

Security orchestration, automation, and response (SOAR) uses playbooks to automate and coordinate actions across security tools. It accelerates repetitive response tasks and reduces analyst workload. It often works alongside a SIEM to act on alerts.

Which principle requires that two people perform a sensitive action together to prevent fraud?

• a.Mandatory vacation
• b.Least privilege
• c.Separation of duties✓
• d.Job rotation

Separation of duties splits a critical task so no single person controls it end to end, reducing fraud and error. For example, one person requests a payment and another approves it. It is a key internal control in security and finance.

Rotating employees through different roles helps detect fraud and reduce dependence on any one person. This control is:

• a.Least privilege
• b.Separation of duties
• c.Job rotation✓
• d.Onboarding

Job rotation moves staff through different duties, which can expose irregularities hidden by a single long-tenured employee. It also reduces single points of knowledge. Mandatory vacations serve a similar detective purpose.

Which secure disposal method makes data on a drive unrecoverable by destroying the media physically?

• a.Deletion
• b.Defragmentation
• c.Formatting
• d.Physical destruction✓

Physical destruction, such as shredding or degaussing, renders storage media and its data unrecoverable. Simple formatting or deletion can leave data recoverable. Destruction is preferred for highly sensitive media at end of life.

Which threat intelligence source consists of shared indicators of compromise that defenders can ingest to detect attacks?

• a.Firmware feed
• b.Marketing feed
• c.Threat feed✓
• d.Social media feed

A threat intelligence feed supplies indicators of compromise such as malicious IPs, domains, and file hashes. Ingesting these into detection tools helps identify known threats quickly. Feeds should be evaluated for relevance and timeliness to be useful.

Analysts receive an alert only after the SIEM links a failed VPN login, a privilege change, and a large data transfer from the same account within minutes. Which SIEM capability produced this insight?

• a.Log rotation
• b.Retention
• c.Compression, which reduces the on-disk storage footprint of the collected logs
• d.Correlation of events across multiple sources✓

Correlation links related events from different sources into a single meaningful alert that no individual log would reveal alone. It is what turns raw log volume into actionable detection. Connecting the dots across sources is the core value of a SIEM.

To investigate incidents efficiently, an organization forwards logs from firewalls, servers, and applications to one central collector. What is the main security value of this aggregation?

• a.It automatically encrypts every individual endpoint's local drive against physical theft
• b.It guarantees that no attacker can ever manage to breach the network's outer perimeter
• c.It preserves logs centrally even if an attacker deletes them on a host✓
• d.It replaces the need for any endpoint detection or antivirus software running on the hosts

Centralized log aggregation preserves evidence even when an attacker wipes local logs to cover their tracks, and it enables cross-system correlation. Logs left only on a compromised host are easily destroyed. Central, protected collection is what keeps them trustworthy and available.

Correlating events across systems only works if their log timestamps agree. Which practice ensures accurate cross-system timelines during an investigation?

• a.Storing every log only on the individual device that generated it for the sake of isolation
• b.Rotating logs frequently so that older timestamped entries are quickly discarded from disk
• c.Letting each device keep its own manually set local clock independently and indefinitely
• d.Synchronizing all devices to a common trusted time source✓

Synchronizing devices to a common trusted time source, such as NTP, keeps timestamps consistent so events can be ordered and correlated accurately. Drifting clocks make reconstruction unreliable or impossible. Consistent time is the backbone of any credible timeline.

A new detection rule floods analysts with alerts that turn out to be benign scheduled backups, causing real alerts to be missed. What should the team do?

• a.Escalate every single alert to executive management
• b.Ignore every alert produced by that rule permanently
• c.Disable logging on the backup servers
• d.Tune the rule to reduce false positives✓

Tuning the rule to exclude the known benign backup activity reduces false positives so analysts can focus on genuine threats. Disabling logging or blindly ignoring alerts would create blind spots. Refining detection logic preserves visibility while cutting noise.

A platform builds behavioral baselines for each account and flags when a user suddenly accesses systems at 3 a.m. from a new location and downloads gigabytes of data. Which capability is this?

• a.Signature-based antivirus
• b.A stateful firewall
• c.User and entity behavior analytics✓
• d.Data loss prevention on outbound email

User and entity behavior analytics (UEBA) baselines normal behavior and flags anomalies like odd hours, new locations, and abnormal data volumes. It catches account misuse and insider threats that signature tools miss. Deviation from a learned baseline is what triggers it.

Investigators want to see which hosts talked to which, how much, and when across the network over the past month without storing full packet payloads. Which data source fits?

• a.Full packet captures retained for months
• b.Endpoint antivirus quarantine logs
• c.SNMP polling
• d.NetFlow records✓

NetFlow records connection metadata such as source, destination, volume, and timing without storing payloads, making long retention practical. It answers who talked to whom and how much. Metadata-only capture is why it scales for historical analysis.

To reconstruct exactly what data an attacker exfiltrated, analysts need the actual payload contents of the suspicious session, not just flow summaries. Which tool provides this?

• a.A CMDB
• b.NetFlow, which records connection metadata but never the payload contents
• c.A vulnerability scanner
• d.A full packet capture✓

A full packet capture records complete payloads, letting analysts reconstruct exactly what was transmitted, including exfiltrated content. NetFlow shows that data moved but not what it contained. Payload-level detail is why packet capture is needed here.

A team debates installing software on each server versus polling devices remotely for monitoring. What is a key advantage of the agent-based approach?

• a.It requires absolutely no configuration on any of the monitored endpoints at any time
• b.It works identically on legacy devices that are unable to run any installed software agent
• c.It eliminates all network traffic between the monitored hosts and the central collector
• d.It can collect richer, real-time host data even when the network path is limited✓

Agents run on the host and can gather deep, real-time telemetry and continue collecting even when connectivity is intermittent. Agentless polling is lighter to deploy but sees less and depends on the network. Richer host visibility is the agent trade-off.

When a phishing email is reported, a system automatically extracts the URLs, checks them against threat intelligence, quarantines matching messages, and opens a ticket. Which platform orchestrates this?

• a.SOAR✓
• b.IPS
• c.EDR
• d.Certificate authority

Security orchestration, automation, and response (SOAR) runs playbooks that chain tools together to enrich, decide, and act automatically. Here it triages phishing end to end without manual steps. Coordinating tools through playbooks is the SOAR function.

Leadership asks why automating routine response steps with playbooks is worthwhile. Which is the strongest security justification?

• a.It responds faster and more consistently, reducing human error and dwell time✓
• b.Automation guarantees that the organization will never again experience a security breach of any kind
• c.Automation permanently removes any need for human analysts to remain on the security team at all going forward
• d.It makes all of the collected security logs entirely unnecessary because responses are now automatic

Automation executes response steps quickly and identically every time, reducing human error and shrinking the time attackers dwell. It augments analysts rather than replacing them or eliminating logs. Speed and consistency, cutting dwell time, is the real benefit.

A cloud team defines servers and firewall rules in version-controlled templates so every deployment is identical and reviewable. Which security benefit does infrastructure as code most directly provide?

• a.It guarantees that the deployed systems will never need to be patched after being provisioned
• b.It removes the requirement to monitor or log any activity occurring on the deployed resources
• c.It enforces consistent, auditable configurations and reduces configuration drift✓
• d.It encrypts all of the data at rest automatically without requiring any key management effort

Infrastructure as code produces repeatable, reviewable deployments so environments are consistent and drift is reduced, and changes are tracked in version control. Misconfigurations can be caught in review before deployment. Consistency and auditability are its core security value.

To stop developers from accidentally creating a publicly readable storage bucket, a cloud platform automatically blocks or flags such configurations at deployment. This automated preventive control is a:

• a.A honeypot
• b.A hot site
• c.Guardrail (policy-as-code)✓
• d.Annual security awareness training

A guardrail, often implemented as policy-as-code, automatically prevents or flags risky configurations like public buckets before they take effect. It bakes security policy into the deployment pipeline. Automated enforcement of policy at deploy time is what defines it.

A build pipeline automatically scans source code for vulnerabilities before each release is deployed. Testing the code without executing it, by examining the source directly, is called:

• a.Dynamic application security testing
• b.Penetration testing
• c.Static application security testing✓
• d.Fuzz testing of the running app

Static application security testing (SAST) analyzes source code without running it, catching flaws early in development. Dynamic testing, by contrast, requires a running application. Examining code at rest is what makes SAST static.

A security tool interacts with a deployed web application, sending crafted inputs to observe how the live system responds and reveal runtime flaws. This testing method is:

• a.Static analysis
• b.A software bill of materials listing every third-party component and version
• c.A tabletop exercise
• d.Dynamic application security testing✓

Dynamic application security testing (DAST) exercises a running application with crafted inputs to find runtime and configuration flaws that only appear during execution. It complements static analysis, which sees code but not runtime behavior. Testing the live app is the DAST approach.

After a widely-used logging library was found vulnerable, security teams scrambled to learn where it was embedded. Which artifact would have let them instantly identify affected software?

• a.A business impact analysis
• b.A data retention schedule
• c.A certificate revocation list
• d.A software bill of materials✓

A software bill of materials (SBOM) inventories every component in software, so teams can instantly find where a vulnerable library is used. Without it, locating affected systems is slow and error-prone. Component transparency is exactly what an SBOM provides.

During a breach, confusion arises over who declares an incident, who talks to regulators, and who leads technical containment. Which document should have defined these responsibilities in advance?

• a.An incident response plan✓
• b.A memorandum of understanding
• c.A service level agreement
• d.An acceptable use policy

An incident response plan defines roles, responsibilities, and procedures before an incident, so responders act decisively rather than improvising. Predefined ownership of decisions and communications prevents chaos. Preparing these roles in advance is the plan's purpose.

Regulations require notifying affected individuals within a set window after a data breach is confirmed. Which part of incident preparation ensures this happens correctly and on time?

• a.A disaster recovery hot site
• b.A network segmentation design
• c.A vulnerability scanning schedule that runs authenticated scans each quarter
• d.A predefined communication and notification plan✓

A communication and notification plan predefines who must be told, how, and by when, so legal and regulatory deadlines are met during the stress of an incident. Improvising notifications risks missed deadlines and penalties. Planned communications ensure timely, correct disclosure.

Two weeks after resolving a ransomware incident, the team meets to document what worked, what failed, and how to prevent recurrence. Which incident response phase is this?

• a.Eradication
• b.Lessons learned✓
• c.Preparation, in which tools, training, and playbooks are readied in advance
• d.Containment

The lessons learned phase reviews the incident after recovery to improve future response and close the gaps that were exposed. It feeds back into preparation, making the process cyclical. Turning experience into improvement is the point of this phase.

On discovering an actively compromised workstation still communicating with a command-and-control server, the responder's immediate priority is to:

• a.Notify every customer publicly before the actual scope of the compromise is even confirmed
• b.Immediately rebuild the workstation from scratch before capturing any forensic evidence
• c.Wait and passively observe the attacker for several more weeks before taking any action
• d.Isolate the host from the network to stop the attacker's communication✓

Containment through isolation immediately cuts the attacker's command-and-control channel and stops further damage or spread. Rebuilding first would destroy evidence, and public notice before scope is known is premature. Halting active harm is the first responder priority.

After recovering from repeated incidents caused by the same unpatched service, management insists the team identify and fix the underlying reason, not just the symptoms. This analysis is called:

• a.Chain of custody
• b.Root cause analysis✓
• c.A penetration test
• d.A business impact analysis

Root cause analysis finds the underlying reason an incident occurred so the fix prevents recurrence rather than treating symptoms. Repeated incidents signal an unaddressed root cause. Eliminating the source is what distinguishes it from a quick patch.

A threat report lists specific malicious file hashes, IP addresses, and domains associated with an active campaign so defenders can search their environment. These artifacts are called:

• a.Recovery point objectives
• b.Indicators of compromise✓
• c.Rules of engagement
• d.Service level objectives

Indicators of compromise (IOCs) are observable artifacts like hashes, IPs, and domains tied to malicious activity, used to hunt for and detect intrusions. Defenders match them against logs and endpoints. Concrete evidence of specific threats is what IOCs provide.

Rather than waiting for alerts, analysts proactively form a hypothesis about how an attacker might operate and search logs for evidence of it. This proactive practice is:

• a.Vulnerability scanning
• b.Signature-based detection
• c.Threat hunting✓
• d.Red teaming

Threat hunting is proactive, hypothesis-driven searching for adversaries that automated tools have not flagged. It assumes a breach may already exist and looks for subtle evidence. Actively seeking hidden threats is what separates it from passive alerting.

A SOC maps observed adversary behaviors to a standardized knowledge base of tactics and techniques to understand its coverage gaps. Which framework are they using?

• a.MITRE ATT&CK✓
• b.PCI DSS
• c.OWASP
• d.The NIST Cybersecurity Framework

MITRE ATT&CK is a knowledge base of real-world adversary tactics and techniques used to map detections and find coverage gaps. It gives teams a common language for attacker behavior. Behavior-based mapping is what makes it useful for measuring defensive coverage.

An analyst gathers freely available information about a threat actor from public reports, forums, and social media to enrich an investigation. This intelligence source is:

• a.Open-source intelligence✓
• b.Classified government intelligence
• c.Internal app logs
• d.A proprietary paid feed

Open-source intelligence (OSINT) is gathered from publicly available sources such as reports, forums, and social media. It is low-cost and broad but must be validated for reliability. Sourcing from public information is what makes it OSINT.

Anticipating litigation, counsel directs IT to suspend the routine deletion of certain emails and files so potential evidence is preserved. This directive is a:

• a.An SLA
• b.Data retention schedule
• c.Non-disclosure agreement
• d.Legal hold✓

A legal hold suspends normal data destruction to preserve information that may be relevant to litigation or investigation. Deleting data under hold can lead to spoliation penalties. Preserving potential evidence against routine deletion is its purpose.

To ensure any analyst handles a malware alert the same proven way, the SOC documents step-by-step response procedures for that specific scenario. This document is a:

• a.An incident response playbook✓
• b.A business continuity plan
• c.A memorandum of understanding
• d.A risk register

An incident response playbook gives step-by-step procedures for a specific scenario so responses are consistent and repeatable regardless of who responds. It reduces improvisation under pressure. Scenario-specific, repeatable steps are what define a playbook.