CompTIA Security+ — All Questions

During evidence collection on a live system, a forensic analyst captures the contents of RAM and running network connections before imaging the hard drive. Which principle drives this sequence?

• a.Chain of custody
• b.Dual control
• c.Order of volatility✓
• d.The recovery time objective

Order of volatility dictates collecting the most transient evidence first, such as memory and active connections, before more persistent data like disks. Volatile data disappears when power or state changes. Preserving fleeting evidence first is the principle at work.

Before analyzing a seized hard drive, an examiner connects it through a device that allows reading but physically prevents any writes to the original media. This device is a:

• a.A honeypot
• b.A write blocker✓
• c.A hardware security module
• d.A load balancer

A write blocker permits reading the original evidence media while preventing any writes, preserving its integrity so findings remain admissible. Any modification could taint the evidence and the investigation. Read-only access to the original is exactly what it guarantees.

Rather than copying visible files, a forensic tool creates an exact bit-for-bit duplicate of an entire drive, including deleted-file remnants and slack space. This copy is a:

• a.A differential backup
• b.A forensic image✓
• c.A snapshot
• d.A logical backup

A forensic image is a bit-for-bit copy capturing everything on the drive, including deleted data and slack space that ordinary backups omit. Analysts work from the image to protect the original. Complete, exact duplication is what makes it forensically sound.

Investigators recover a photo and examine its embedded creation time, GPS coordinates, and device model to establish where and when it originated. This embedded data is called:

• a.A digital signature
• b.Steganographic content
• c.A hash
• d.Metadata✓

Metadata is data about the file, such as timestamps, GPS coordinates, and device details, which can be crucial evidence. It reveals context the visible content does not. Extracting and interpreting embedded metadata is a standard forensic technique.

To understand an attack's sequence, an analyst combines timestamps from firewall, authentication, and endpoint logs into a single chronological reconstruction. Building this is called creating a:

• a.A BIA
• b.A penetration testing report
• c.A forensic timeline✓
• d.A software bill of materials

A forensic timeline merges timestamped events from many sources into one chronology, revealing the attacker's sequence of actions. It depends on synchronized clocks to be accurate. Ordering events across systems is what the timeline delivers.

A defense attorney challenges digital evidence, arguing it may have been altered after collection. Which combination best supports its admissibility in court?

• a.Storing the evidence on a shared drive that is freely accessible to the whole response team
• b.Analyzing the original drive directly and relying on the analyst's memory of the exact steps
• c.Deleting the intermediate copies quickly to avoid confusion over which copy is authoritative
• d.An unbroken chain of custody plus matching hashes of the original and the image✓

An unbroken chain of custody documents every handler, and matching hashes prove the image is identical to the original and unaltered. Together they demonstrate integrity for the court. Documented handling plus verifiable integrity is what supports admissibility.

Before signing with a cloud vendor, a company insists on contract language permitting it to review the vendor's security controls periodically. This provision is a:

• a.An RPO target
• b.Memorandum of understanding
• c.Right-to-audit clause✓
• d.An SLA uptime clause

A right-to-audit clause gives the customer the contractual ability to assess a vendor's security controls, which is vital when outsourcing sensitive functions. Without it, the customer cannot verify the vendor's claims. Securing that inspection right is the clause's purpose.

A vulnerability scan run with valid login credentials on target hosts finds far more issues than one run without. Why does the credentialed scan reveal more?

• a.Because it only checks the network perimeter and deliberately ignores internal host details
• b.Because it actively exploits each weakness it finds in order to confirm that it is realistic
• c.Because it runs considerably faster and therefore has enough time to test far more systems across the entire network
• d.Because it can inspect installed software, patches, and configurations from inside✓

A credentialed scan logs in and inspects installed software, patch levels, and configurations from the inside, revealing far more than an external view. Non-credentialed scans see only what is exposed on the network. Authenticated inside access is why it finds more.

A scan returns hundreds of findings, so the team prioritizes remediation using a standardized 0-10 severity score reflecting exploitability and impact. This scoring system is:

• a.CVSS✓
• b.CVE
• c.OSINT
• d.SIEM

The Common Vulnerability Scoring System (CVSS) rates severity on a 0-10 scale from factors like exploitability and impact, helping teams prioritize. A CVE only names a vulnerability; CVSS scores its seriousness. A standardized severity number is what CVSS contributes.

When discussing a specific flaw, engineers reference a standardized identifier assigned to each publicly known vulnerability so everyone means the same issue. This identifier is a:

• a.A CVE✓
• b.CVSS
• c.A false positive
• d.An indicator of compromise

A Common Vulnerabilities and Exposures (CVE) identifier gives each publicly known vulnerability a unique reference so tools and teams communicate unambiguously. It names the flaw, while CVSS scores its severity. A shared, unique name is what a CVE provides.

A scanner reports a critical vulnerability, but manual testing shows the affected feature is not even installed. Before spending effort patching, the analyst should:

• a.Immediately schedule emergency downtime and patch every single server across all of production
• b.Disable the vulnerability scanner permanently so that it stops generating any further reports
• c.Validate the finding to confirm whether it is a false positive✓
• d.Report the finding to executives as a confirmed breach requiring immediate customer notification

Validating a finding confirms whether it is real or a false positive before resources are spent remediating. Scanners can misreport based on version banners or inapplicable checks. Verifying before acting prevents wasted effort and false alarms.

A legacy application cannot be patched for a known vulnerability without breaking it, so the team adds strict network filtering and monitoring around it instead. This alternative is a:

• a.A compensating control✓
• b.A residual risk
• c.An acceptable use policy
• d.A false positive

A compensating control provides protection by alternative means when the primary fix, such as a patch, cannot be applied. Filtering and monitoring reduce the risk around the unpatched app. Substituting an equivalent safeguard is the essence of a compensating control.

A client hires testers and gives them no internal knowledge, network diagrams, or credentials, forcing them to discover everything as an outside attacker would. This engagement is:

• a.A white-box test
• b.A black-box (unknown environment) test✓
• c.A tabletop exercise
• d.A credentialed vulnerability scan run with valid logins on each target host

In a black-box or unknown-environment test, testers receive no inside information and must discover the environment like a real external attacker. This realistically simulates an outsider but takes longer. Zero prior knowledge is what defines the black-box approach.

A company invites independent researchers to find and report vulnerabilities in its products in exchange for rewards, under defined rules. This program is a:

• a.A penetration test
• b.A red team exercise run by the organization's own internal security staff
• c.A tabletop exercise
• d.A bug bounty program✓

A bug bounty program crowdsources vulnerability discovery from independent researchers who are rewarded for valid, responsibly disclosed findings. It scales testing beyond a single firm under clear rules. Paying external researchers for reported flaws is what defines it.

An organization wants to automate checking systems against security benchmarks using standardized, machine-readable content. Which protocol suite enables this automation?

• a.NetFlow
• b.SCAP✓
• c.Syslog
• d.SNMP

The Security Content Automation Protocol (SCAP) provides standardized, machine-readable content so tools can automatically assess systems against benchmarks and report compliance. This makes configuration and vulnerability checks repeatable and consistent. Automating standardized assessment is SCAP's role.

To harden new servers consistently, an admin applies a widely-recognized set of vendor-neutral configuration recommendations. These published hardening standards are known as:

• a.A certificate revocation list
• b.CIS Benchmarks✓
• c.An RTO
• d.A memorandum of understanding

CIS Benchmarks are consensus-based, vendor-neutral configuration guides that provide consistent secure baselines for operating systems and applications. Applying them reduces misconfiguration across a fleet. Recognized, repeatable hardening guidance is what they offer.

Monitoring flags that a production server's settings no longer match the approved secure template, indicating unauthorized changes over time. This deviation is called:

• a.A denial-of-service condition
• b.Configuration drift✓
• c.A zero-day
• d.A false positive

Configuration drift is the gradual divergence of a system from its approved baseline due to ad hoc changes over time. It reintroduces risk and inconsistency that hardening removed. Detecting and correcting drift keeps systems aligned to their secure template.

In a Windows domain, administrators enforce password rules, disable removable storage, and set firewall settings on thousands of machines from one place. Which mechanism applies these centrally?

• a.A host-based intrusion detection system
• b.A bastion
• c.A hardware security module
• d.Group Policy✓

Group Policy centrally enforces security settings across all domain-joined machines from a single point, ensuring consistent hardening at scale. Managing thousands of endpoints individually would be error-prone. Central, consistent policy enforcement is what Group Policy delivers.

A newly deployed web server is found listening on Telnet, FTP, and several other unused ports. Which hardening action most reduces its attack surface?

• a.Disabling the unnecessary services and closing their ports✓
• b.Installing additional monitoring agents while leaving all of the open ports still running
• c.Adding more RAM and CPU so the server can comfortably handle the extra listening services
• d.Assigning the server a public IP address so that administrators can reach it remotely

Disabling unneeded services and closing their ports removes entry points, directly shrinking the attack surface. Every running service is a potential vulnerability to exploit. Least functionality, running only what is needed, is the core hardening principle here.

A penetration tester gains admin access to a network switch simply by trying the manufacturer's documented username and password. Which hardening step was skipped?

• a.Scheduling a recurring credentialed vulnerability scan against the switch every month
• b.Changing the default administrative credentials✓
• c.Enabling full-disk encryption on the switch's internal configuration storage memory
• d.Placing the switch behind a web application firewall to inspect inbound HTTP requests

Default credentials are publicly documented, so failing to change them leaves a trivial path to full control. Changing them to strong, unique values is a basic hardening step. Removing known factory logins closes this obvious entry point.

To balance security with stability, an organization tests vendor updates and deploys them on a predictable monthly schedule, with emergency out-of-band patches for critical flaws. This disciplined approach is:

• a.Never patching the systems at all
• b.A structured patch management cadence✓
• c.Relying on antivirus alone
• d.Applying every update instantly, untested

A structured patch management cadence tests and deploys updates on a predictable schedule while allowing emergency patches for critical issues. This balances security with operational stability. Disciplined, tested, scheduled patching is the recommended practice.

A security tool automatically detonates suspicious email attachments in an isolated disposable environment to observe their behavior before delivery. This technique is:

• a.Sandboxing✓
• b.Full-disk encryption
• c.Blocklisting
• d.Hashing

Sandboxing runs suspicious files in an isolated, disposable environment to observe behavior without risking real systems, catching threats signatures miss. Malicious actions reveal themselves safely inside the sandbox. Behavioral analysis in isolation is what defines the technique.

Reviewing authentication logs, an analyst notices hundreds of failed logins for many accounts from one IP, followed by a single success. What does this pattern most likely indicate?

• a.A misconfigured time server causing the log timestamps to appear out of sequence
• b.A password-spraying or brute-force attack that ultimately succeeded✓
• c.A scheduled backup job authenticating with its own valid dedicated service account
• d.A normal user who simply forgot and slowly re-entered their own correct password once

Many failures across accounts from one source followed by a success is the signature of password spraying or brute forcing that eventually worked. Normal users do not generate hundreds of failures across many accounts. Recognizing this pattern enables early detection of credential attacks.

A compliance mandate requires that security logs be kept for at least one year for potential investigations. Which policy governs how long logs are stored before deletion?

• a.An AUP clause
• b.An RTO target
• c.A service level agreement
• d.A log retention policy✓

A log retention policy specifies how long logs are kept before deletion, balancing investigative and compliance needs against storage cost. Retaining logs too briefly can destroy evidence needed later. Defining storage duration is exactly what this policy governs.

During a risk workshop, someone confuses terms. A hurricane is the potential danger, an unbolted roof is the weakness, and the chance of damage combining both is the:

• a.Loss
• b.Risk✓
• c.The vulnerability
• d.The threat

Risk is the likelihood and impact of a threat exploiting a vulnerability, combining the two. The hurricane is the threat and the unbolted roof is the vulnerability. Distinguishing these terms is fundamental to accurate risk assessment.

By uninstalling unused software, closing ports, and disabling default accounts, an administrator shrinks the number of ways an attacker could get in. This overall reduction is described as minimizing the:

• a.Residual risk
• b.The recovery point objective
• c.Attack surface✓
• d.The false positive rate

The attack surface is the sum of all points where an attacker could attempt entry, and hardening reduces it by removing services, ports, and accounts. A smaller attack surface means fewer opportunities to exploit. Minimizing exposure is the goal of hardening.

A vendor integrates endpoint, email, network, and cloud telemetry into one platform that correlates detections across all of them for unified response. This extended approach is called:

• a.DLP
• b.SIEM
• c.EDR
• d.XDR✓

Extended detection and response (XDR) unifies telemetry from endpoints, email, network, and cloud, correlating across them for broader detection and coordinated response. EDR is limited to endpoints. Cross-domain correlation and response is what distinguishes XDR.

Defenders plant fake credentials and decoy files that no legitimate user should ever touch, so any access to them immediately signals an intruder. These tripwires are called:

• a.Compensating controls
• b.Honeytokens✓
• c.False positives
• d.IOCs

Honeytokens are decoy credentials or files that legitimate users never use, so any interaction is a high-confidence sign of intrusion. They generate very low false positives because there is no legitimate reason to touch them. Serving as tripwires for attackers is their purpose.

The SOC receives an alert that an employee attempted to upload a spreadsheet full of Social Security numbers to a personal cloud drive, and the transfer was blocked. Which control generated this?

• a.A network intrusion prevention system
• b.Data loss prevention✓
• c.A security orchestration platform
• d.A WAF

Data loss prevention inspects content and blocks sensitive data, like Social Security numbers, from leaving through channels such as personal cloud uploads. It enforces policy on data in motion. Recognizing and stopping sensitive data exfiltration is the DLP function.

A team continuously scans their cloud accounts for misconfigurations like open storage buckets, over-permissive roles, and disabled logging, alerting on drift from policy. This tooling is:

• a.A hardware security module
• b.Cloud security posture management✓
• c.A traditional network firewall that filters by source and destination address
• d.An intrusion detection sensor

Cloud security posture management (CSPM) continuously assesses cloud configurations against best practices, flagging risky settings like public buckets or excessive permissions. Misconfiguration is a leading cause of cloud breaches. Ongoing configuration assurance is what CSPM provides.

Before allowing container images into production, a pipeline scans them for vulnerable packages and embedded secrets and blocks images that fail policy. This practice most directly addresses risk in the:

• a.Container image supply chain✓
• b.Email authentication
• c.Wireless network authentication process
• d.Physical access control

Scanning images for vulnerable components and leaked secrets before deployment secures the container supply chain, where a bad base image can spread risk widely. Blocking non-compliant images prevents known flaws from reaching production. Vetting what enters the pipeline is the point.

After deploying automated playbooks, a SOC reports the average time from alert to containment dropped from hours to minutes. Which operational metric improved?

• a.The RPO
• b.The FAR
• c.The annualized loss expectancy
• d.Mean time to respond✓

Mean time to respond measures how quickly the team acts on and contains an incident after detection, and automation drives it down. Faster response limits attacker dwell time and damage. Reducing this metric is a core goal of security automation.

Facing more alerts than staff can handle, a SOC manager wants analysts to work the most dangerous alerts first. Which practice organizes work this way?

• a.Forwarding every alert to executives
• b.Risk-based alert triage and prioritization✓
• c.Working alerts in the order they arrive
• d.Auto-closing alerts not reviewed within five minutes

Risk-based triage ranks alerts by potential impact and likelihood so limited analyst time goes to the most serious threats first. Working in arrival order or auto-closing risks missing critical events. Prioritizing by risk is what makes finite resources effective.

When an alert fires, the SOC platform automatically adds context such as the source IP's reputation, geolocation, and past activity to help analysts decide faster. This automated context-adding is called:

• a.Triage
• b.Enrichment✓
• c.Log rotation
• d.Sandboxing

Enrichment automatically augments an alert with context like reputation, geolocation, and history so analysts can judge it quickly and accurately. It reduces manual lookups and speeds decisions. Adding decision-supporting context to raw alerts is what enrichment does.

Rather than scanning once a year, a mature program continuously discovers assets, scans them, prioritizes findings, remediates, and verifies in an ongoing cycle. This is best described as:

• a.A one-time penetration test
• b.An annual tabletop exercise
• c.Continuous vulnerability management✓
• d.A single baseline configuration applied only at deployment

Continuous vulnerability management is an ongoing cycle of discovery, assessment, prioritization, remediation, and verification rather than a periodic event. It keeps pace with new assets and new vulnerabilities. Treating it as a continuous loop is what makes the program mature.

An organization once deployed a patch that crashed a critical application fleet-wide. To prevent recurrence, patches should first be:

• a.Installed only on the systems that are already failing and are going to be rebuilt anyway
• b.Applied directly to every production system simultaneously in order to save time and effort
• c.Tested in a non-production environment before broad deployment✓
• d.Skipped entirely so that no future update can ever again disrupt the critical application

Testing patches in a non-production environment first catches breaking changes before they hit critical systems fleet-wide. Skipping patches leaves known vulnerabilities open, which is worse. Validating stability before broad rollout balances security and availability.

An analyst writes a script that queries the firewall's API to automatically add malicious IPs from a threat feed to a blocklist every hour. The primary benefit of this automation is:

• a.Faster, consistent blocking without manual effort✓
• b.It guarantees the organization can never again be targeted by a network attack
• c.It removes the need to keep logs
• d.It eliminates tuning the threat feed

Automating blocklist updates via the firewall API applies protection faster and more consistently than manual entry, reducing the window of exposure. It still requires logging and periodic tuning of the feed. Speed and consistency without manual toil is the real benefit.

Before issuing laptops, IT applies a standard secure image with encryption enabled, unneeded software removed, and logging turned on. Applying this consistent secure starting point is called establishing a:

• a.A recovery time objective
• b.Security baseline✓
• c.A memorandum of understanding
• d.A honeypot decoy

A security baseline is a standard secure configuration applied consistently so every system starts from a known hardened state. It prevents ad hoc, insecure builds and simplifies auditing. A repeatable secure starting point is what a baseline provides.

In endpoint logs, an analyst sees a standard user account suddenly added to the local administrators group minutes after a suspicious download. This sequence most likely represents:

• a.A misconfigured clock causing the log entries to appear in the wrong chronological order
• b.A routine software update that legitimately required elevated rights during its installation
• c.Privilege escalation following an initial compromise✓
• d.A scheduled backup service that authenticates using its own dedicated service account only

A normal user being elevated to local admin right after a suspicious download is a classic sign of privilege escalation after initial compromise. Attackers seek higher rights to expand control. Correlating the download with the elevation reveals the escalation.

Hunting through network logs, an analyst finds a host making small, regular connections to an unfamiliar external server at precise intervals around the clock. This pattern most likely indicates:

• a.A monthly update check
• b.Command-and-control beaconing✓
• c.Ordinary web browsing
• d.A backup job to approved offsite storage

Regular, small, precisely timed connections to an unknown server are characteristic of malware beaconing to a command-and-control host. The machine-like periodicity distinguishes it from human browsing. Spotting this rhythm is a staple of threat hunting.

After one workstation was compromised, logs show that account then authenticating to dozens of other machines it never normally touches. This activity is characteristic of:

• a.Lateral movement✓
• b.Single sign-on
• c.A credentialed vulnerability scan
• d.A load balancer

Lateral movement is an attacker using a compromised account to reach additional systems it normally would not touch, expanding their foothold. A sudden spread of authentications from one account is the tell. Detecting this early limits how far an intrusion spreads.

An analyst notices unusually large volumes of DNS queries to a single domain, with data encoded in the subdomain names. This technique for sneaking data out is called:

• a.Recursive resolution
• b.DNS tunneling exfiltration✓
• c.A cache-poisoning attack
• d.A distributed denial-of-service attack

DNS tunneling hides data inside DNS queries, often encoded in subdomain labels, to smuggle information past controls that permit DNS. High query volume to one domain with odd subdomains is the signature. Recognizing DNS as an exfiltration channel is the key insight.

After capturing a forensic image, the examiner stores it on protected media, restricts access, and records every handoff. The main reason for these precautions is to:

• a.Avoid computing hashes of the image
• b.Reduce the storage the evidence image consumes
• c.Let many analysts modify the image at once
• d.Preserve evidence integrity and admissibility✓

Restricting access and documenting handoffs preserve the evidence's integrity and its admissibility in legal proceedings. Any unlogged access or change could let opposing counsel challenge it. Protecting integrity and the chain of custody is the reason for these controls.

To detect a specific attack pattern reliably, an engineer writes logic in the SIEM that fires only when a defined sequence of events occurs together. This configured detection logic is a:

• a.A correlation rule✓
• b.A disaster recovery runbook
• c.A firewall access control list
• d.A backup schedule

A correlation rule defines conditions across multiple events that together indicate a threat, so the SIEM alerts only on the meaningful pattern. Well-crafted rules reduce noise and catch multi-step attacks. Encoding detection logic across events is what a correlation rule does.

When EDR detects ransomware behavior on a host, it automatically isolates that machine from the network within seconds without waiting for an analyst. This automated action is called:

• a.A quarterly vulnerability scan
• b.Automated host isolation (quarantine)✓
• c.A tabletop exercise
• d.A manual escalation to an on-call analyst

Automated host isolation quarantines a compromised machine from the network in seconds, stopping ransomware from spreading before a human can react. Speed is critical because encryption and lateral movement happen fast. Machine-speed containment is the value of this automation.

A security report highlights the average number of days an attacker remained undetected in the environment before discovery. Reducing this figure limits damage. This metric is:

• a.The RPO
• b.The annualized rate of occurrence
• c.Dwell time✓
• d.The false rejection rate

Dwell time is how long an attacker goes undetected in the environment, and shorter dwell time means less opportunity for damage and exfiltration. It reflects detection effectiveness. Minimizing time-to-detection is a central goal of security operations.

Many incidents began with users enabling macros in malicious Office documents. Which hardening policy most directly reduces this initial access vector?

• a.Requiring longer and more complex passwords on every single user account across the domain
• b.Disabling macros by default and blocking them from untrusted sources✓
• c.Encrypting the full disk on every endpoint so stored files are protected when powered off
• d.Deploying a load balancer in front of the mail servers to spread the inbound message load

Disabling macros by default and blocking them from untrusted sources removes a common malware delivery mechanism at its source. Password and disk controls do not address the macro vector. Targeting the specific initial access path is what makes this effective.

A team wants recurring scans but worries aggressive scanning could disrupt fragile production systems during business hours. The best practice is to:

• a.Scan continuously at maximum intensity regardless of the impact on production services
• b.Rely only on the vendor's assurance that the systems contain no vulnerabilities at all
• c.Schedule scans during maintenance windows and tune scan intensity✓
• d.Never scan the production systems at all so there is no possibility of any disruption

Scheduling scans during maintenance windows and tuning their intensity gets vulnerability visibility while minimizing operational disruption. Never scanning leaves blind spots; unrestrained scanning risks outages. Balancing coverage with safety is the practical approach.

Security operations periodically sends fake phishing emails to employees and tracks who clicks, using results to target additional training. This program is a:

• a.A tabletop exercise
• b.A business impact analysis
• c.Phishing simulation campaign✓
• d.A penetration test in which ethical hackers exploit technical vulnerabilities

A phishing simulation sends benign fake phishing to measure susceptibility and drive targeted awareness training. It turns human risk into a measurable, improvable metric. Testing and coaching users against real-looking lures is the program's aim.

So responders apply the right resources, an organization rates each incident by scope and impact, from a minor single-host event up to an enterprise-wide breach. This step is called:

• a.Recovery
• b.Chain of custody, documenting each person who handled a piece of evidence
• c.Incident classification and severity rating✓
• d.Eradication

Incident classification and severity rating gauges scope and impact so the response is proportionate and the right people and resources are engaged. A minor event and a major breach demand very different responses. Sizing the incident early guides everything that follows.