CompTIA Security+ Q & A

0 questions
Q1 Which of the following ensures that a sender cannot deny sending a message? Encryption Hashing Digital Signature Symmetric Key Exchange
Answer
C) Digital Signature
Explanation: Digital signatures ensure non-repudiation — proving who sent the data. A2.
Q2 Which type of threat actor is MOST likely to have the greatest resources and patience for an extended attack? Insider Nation-State Script Kiddie Hacktivist
Answer
B) Nation-State
Explanation: Nation-state actors have the highest resources, skills, and patience for prolonged attacks. A3.
Q3 What type of attack involves inserting malicious code into a legitimate web application to steal information from users? Phishing SQL Injection Cross-Site Scripting (XSS) DNS Spoofing
Answer
C) Cross-Site Scripting (XSS)
Explanation: XSS injects malicious scripts into web apps to steal session cookies, data, etc. A4.
Q4 Firewall VPN NAC (Network Access Control) IDS
  • A company needs to prevent unauthorized devices from connecting to its internal network. What technology should be used?
Answer
C) NAC (Network Access Control)
Explanation: NAC checks device health and enforces policies before allowing network access. A5.
Q5 Which backup type saves only the changes made since the last full backup? Incremental Differential Full Snapshot
Answer
A) Incremental
Explanation: Incremental backup captures only changes since the last full backup. A6.
Q6 What control type is a biometric fingerprint scanner? Technical Administrative Physical Compensating
Answer
C) Physical
Explanation: Biometric scanners are physical controls that authenticate users. A7.
Q7 Which wireless security protocol is the most secure for corporate environments? WEP WPA WPA2-PSK WPA3-Enterprise
Answer
D) WPA3-Enterprise
Explanation: WPA3-Enterprise is the most secure option for business wireless networks. A8.
Q8 Which of the following would BEST help mitigate risks associated with phishing attacks? IDS Security Awareness Training Firewall Rules Password Complexity Requirements
Answer
B) Security Awareness Training
Explanation: Training users helps them recognize phishing attempts and avoid falling victim. AG.
Q9 Which risk response involves buying cyber insurance? Accept Mitigate Transfer Avoid
Answer
C) Transfer
Explanation: Buying insurance transfers the financial risk to another party. A1O.
Q10 Which concept is being applied when access to files is based on job roles such as HR, IT, or Accounting? MAC DAC RBAC ABAC
Answer
C) RBAC
Explanation: Role-Based Access Control (RBAC) assigns permissions based on user job roles. Questions 11–2O Q11. Which term describes an attack where an unauthorized device connects to a corporate wireless network? Rogue AP Evil Twin Bluejacking MAC Spoofing Q12. What type of malware disguises itself as a legitimate program but delivers a malicious payload? Worm Ransomware Trojan Rootkit Q13. Which process helps ensure that only needed ports and services are running on a server? Network segmentation Baseline configuration Change management Hardening Q14. A database administrator is setting access so that users only have permission to view certain data. Which principle is being applied? Separation of Duties Need-to-Know Non-repudiation Risk Transference Q15. Which option BEST describes a warm site in disaster recovery planning? Fully operational copy of the production environment Facility with basic hardware but not real-time data Empty building with power and Internet only Vendor-provided cloud backup solution Q16. Which technology would a company use to detect unauthorized changes to critical system files? DLP File Integrity Monitoring (FIM) SIEM HIDS Q17. A phishing attack led to a ransomware infection. Which two controls would have BEST prevented the incident? (Choose two.) Data Encryption Email Filtering Security Awareness Training RAID 5 Q18. Which type of access control is enforced by system policies rather than user discretion? DAC RBAC ABAC MAC Q1G. What is the primary purpose of a honeypot? Encrypt sensitive data Divert attackers away from real systems Patch vulnerabilities Enforce firewall rules Q2O. Which incident response phase involves learning lessons and updating the incident response plan after a security event? Detection Containment Recovery Lessons Learned
Q11 Which term describes an attack where an unauthorized device connects to a corporate wireless network? Rogue AP Evil Twin Bluejacking MAC Spoofing
Answer
B) Evil Twin
Explanation: An evil twin is a rogue Wi-Fi access point set up to mimic a legitimate network. A12.
Q12 What type of malware disguises itself as a legitimate program but delivers a malicious payload? Worm Ransomware Trojan Rootkit
Answer
C) Trojan
Explanation: A trojan appears legitimate but delivers malicious code once executed. A13.
Q13 Which process helps ensure that only needed ports and services are running on a server? Network segmentation Baseline configuration Change management Hardening
Answer
D) Hardening
Explanation: Hardening reduces attack surface by disabling unnecessary services. A14.
Q14 Separation of Duties Need-to-Know Non-repudiation Risk Transference
  • A database administrator is setting access so that users only have permission to view certain data. Which principle is being applied?
Answer
B) Need-to-Know
Explanation: Need-to-know restricts data access to only necessary users. A15.
Q15 Which option BEST describes a warm site in disaster recovery planning? Fully operational copy of the production environment Facility with basic hardware but not real-time data Empty building with power and Internet only Vendor-provided cloud backup solution
Answer
B) Facility with basic hardware but not real-time data
Explanation: Warm sites have equipment ready but need configuration and data loading. A16.
Q16 Which technology would a company use to detect unauthorized changes to critical system files? DLP File Integrity Monitoring (FIM) SIEM HIDS
Answer
B) File Integrity Monitoring (FIM)
Explanation: FIM detects unauthorized changes to files. A17.
Q17 Data Encryption Email Filtering Security Awareness Training RAID 5
  • A phishing attack led to a ransomware infection. Which two controls would have BEST prevented the incident? (Choose two.)
Answer
B) Email Filtering and C) Security Awareness Training
Explanation: Filtering blocks phishing emails; training teaches users to recognize them. A18.
Q18 Which type of access control is enforced by system policies rather than user discretion? DAC RBAC ABAC MAC
Answer
D) MAC
Explanation: Mandatory Access Control (MAC) strictly enforces security policies. A1G.
Q19 What is the primary purpose of a honeypot? Encrypt sensitive data Divert attackers away from real systems Patch vulnerabilities Enforce firewall rules
Answer
B) Divert attackers away from real systems
Explanation: Honeypots attract attackers to fake systems to study them. A2O.
Q20 Which incident response phase involves learning lessons and updating the incident response plan after a security event? Detection Containment Recovery Lessons Learned
Answer
D) Lessons Learned
Explanation: Post-incident analysis improves future responses. Questions 21–3O Q21. Which of the following BEST describes a risk mitigation strategy? Ignoring a low-probability event Purchasing cyber insurance Installing a firewall to block threats Documenting a risk acceptance form Q22. An attacker is trying multiple passwords against many different user accounts. What is this called? Dictionary Attack Brute Force Attack Password Spraying Rainbow Table Attack Q23. What is the purpose of a disaster recovery plan (DRP)? Prevent data breaches Maintain operations during an attack Restore critical business systems after disruption Identify vulnerabilities before attacks occur Q24. Which concept ensures that sensitive data is only accessible to authorized individuals? Integrity Confidentiality Availability Authentication Q25. Which of the following BEST describes a vulnerability scanner? Blocks malicious traffic at the network perimeter Actively exploits vulnerabilities Passively identifies potential weaknesses Encrypts sensitive communications Q26. Which of the following technologies uses security groups and microsegmentation to enhance cloud security? VPNs Infrastructure as Code Cloud-native firewalls Software-Defined Networking (SDN) Q27. A system administrator wants to monitor failed login attempts centrally. Which system should be deployed? SIEM NAC DLP SOAR Q28. Which attack occurs when a malicious actor manipulates a DNS server to redirect traffic to fraudulent websites? DNS Poisoning Domain Hijacking IP Spoofing ARP Poisoning Q2G. A company requires users to authenticate once and then have access to multiple systems without re-entering credentials. Which solution BEST meets this requirement? Federation LDAP Multifactor Authentication VPN Q3O. Which backup strategy would provide the QUICKEST recovery time in case of a server failure? Full Backup Differential Backup Incremental Backup Snapshot Backup
Q21 Which of the following BEST describes a risk mitigation strategy? Ignoring a low-probability event Purchasing cyber insurance Installing a firewall to block threats Documenting a risk acceptance form
Answer
C) Installing a firewall to block threats
Explanation: Mitigation adds controls to reduce risk likelihood or impact. A22.
Q22 An attacker is trying multiple passwords against many different user accounts. What is this called? Dictionary Attack Brute Force Attack Password Spraying Rainbow Table Attack
Answer
C) Password Spraying
Explanation: Password spraying tries common passwords across many accounts to avoid lockout. A23.
Q23 What is the purpose of a disaster recovery plan (DRP)? Prevent data breaches Maintain operations during an attack Restore critical business systems after disruption Identify vulnerabilities before attacks occur
Answer
C) Restore critical business systems after disruption
Explanation: DRP focuses on system recovery after disaster events. A24.
Q24 Which concept ensures that sensitive data is only accessible to authorized individuals? Integrity Confidentiality Availability Authentication
Answer
B) Confidentiality
Explanation: Confidentiality ensures sensitive data isn't disclosed to unauthorized users. A25.
Q25 Which of the following BEST describes a vulnerability scanner? Blocks malicious traffic at the network perimeter Actively exploits vulnerabilities Passively identifies potential weaknesses Encrypts sensitive communications
Answer
C) Passively identifies potential weaknesses
Explanation: Vulnerability scanners find weaknesses but don’t exploit them. A26.
Q26 Which of the following technologies uses security groups and microsegmentation to enhance cloud security? VPNs Infrastructure as Code Cloud-native firewalls Software-Defined Networking (SDN)
Answer
D) Software-Defined Networking (SDN)
Explanation: SDN uses segmentation and programmable security in cloud environments. A27.
Q27 SIEM NAC DLP SOAR
  • A system administrator wants to monitor failed login attempts centrally. Which system should be deployed?
Answer
A) SIEM
Explanation: SIEM collects and analyzes logs, including login failures. A28.
Q28 Which attack occurs when a malicious actor manipulates a DNS server to redirect traffic to fraudulent websites? DNS Poisoning Domain Hijacking IP Spoofing ARP Poisoning
Answer
A) DNS Poisoning
Explanation: DNS poisoning manipulates DNS to redirect users to malicious sites. A2G.
Q29 systems without re-entering credentials. Which solution BEST meets this requirement? Federation LDAP Multifactor Authentication VPN
  • A company requires users to authenticate once and then have access to multiple
Answer
A) Federation
Explanation: Federation allows single authentication across multiple domains or systems. A3O.
Q30 Which backup strategy would provide the QUICKEST recovery time in case of a server failure? Full Backup Differential Backup Incremental Backup Snapshot Backup
Answer
D) Snapshot Backup
Explanation: Snapshots allow rapid rollback to a known good system state. Questions 31–4O Q31. Which principle ensures that users are granted only the access necessary to perform their job functions? Separation of Duties Need-to-Know Least Privilege Role-Based Access Control Q32. An attacker captures data from a public Wi-Fi network without connecting to it. Which attack is being performed? Evil Twin On-Path Attack (MITM) Passive Eavesdropping Session Hijacking Q33. What is the PRIMARY goal of a business impact analysis (BIA)? Identify and prioritize critical business functions Analyze threats against network security Determine security control effectiveness Perform a penetration test Q34. What type of backup method would you use if you want to store only the changes made since the last full backup AND you want fast recovery? Incremental Full Differential Snapshot Q35. Which of the following technologies BEST protects against on-path (Man-in-the-Middle) attacks? VLAN IPS VPN RAID Q36. During which incident response phase would you isolate a compromised server? Recovery Containment Lessons Learned Identification Q37. What security principle is enforced when employees are required to use two different passwords for administrative and non-administrative accounts? Separation of Duties Least Privilege Defense in Depth Dual Control Q38. Which cloud model allows the customer the MOST control over the operating system and applications? SaaS PaaS IaaS FaaS Q3G. What is a PRIMARY security concern with Infrastructure as Code (IaC)? Outdated server hardware Rapid spread of misconfigurations Vendor lock-in Poor network performance Q4O. An attacker sends unsolicited Bluetooth messages to nearby devices. What attack is this? Bluesnarfing Bluebugging Bluejacking Bluespoofing
Q31 Which principle ensures that users are granted only the access necessary to perform their job functions? Separation of Duties Need-to-Know Least Privilege Role-Based Access Control
Answer
C) Least Privilege
Explanation: Least privilege gives users only necessary access rights to do their jobs. A32.
Q32 An attacker captures data from a public Wi-Fi network without connecting to it. Which attack is being performed? Evil Twin On-Path Attack (MITM) Passive Eavesdropping Session Hijacking
Answer
C) Passive Eavesdropping
Explanation: Passive eavesdropping listens to network traffic without active interception. A33.
Q33 What is the PRIMARY goal of a business impact analysis (BIA)? Identify and prioritize critical business functions Analyze threats against network security Determine security control effectiveness Perform a penetration test
Answer
A) Identify and prioritize critical business functions
Explanation: BIA identifies essential processes and their recovery priorities. A34.
Q34 What type of backup method would you use if you want to store only the changes made since the last full backup AND you want fast recovery? Incremental Full Differential Snapshot
Answer
C) Differential
Explanation: Differential backups capture changes since last full backup and restore faster than incremental. A35.
Q35 Which of the following technologies BEST protects against on-path (Man-in-the-Middle) attacks? VLAN IPS VPN RAID
Answer
C) VPN
Explanation: VPNs encrypt traffic, preventing interception and tampering in on-path attacks. A36.
Q36 During which incident response phase would you isolate a compromised server? Recovery Containment Lessons Learned Identification
Answer
B) Containment
Explanation: Containment limits the spread of the incident, like isolating a server. A37.
Q37 What security principle is enforced when employees are required to use two different passwords for administrative and non-administrative accounts? Separation of Duties Least Privilege Defense in Depth Dual Control
Answer
A) Separation of Duties
Explanation: Separating credentials for admin and user accounts supports separation of duties. A38.
Q38 Which cloud model allows the customer the MOST control over the operating system and applications? SaaS PaaS IaaS FaaS
Answer
C) IaaS
Explanation: In Infrastructure as a Service (IaaS), the customer manages OS, apps, and configurations. A3G.
Q39 What is a PRIMARY security concern with Infrastructure as Code (IaC)? Outdated server hardware Rapid spread of misconfigurations Vendor lock-in Poor network performance
Answer
B) Rapid spread of misconfigurations
Explanation: IaC errors can quickly replicate insecure settings across environments. A4O.
Q40 An attacker sends unsolicited Bluetooth messages to nearby devices. What attack is this? Bluesnarfing Bluebugging Bluejacking Bluespoofing
Answer
C) Bluejacking
Explanation: Bluejacking involves sending unsolicited Bluetooth messages to devices. Questions 41–5O Q41. Which of the following BEST describes a cold site? Operational data center ready for immediate use Empty facility with basic infrastructure like power and HVAC Fully equipped center with real-time data replication Offsite cloud backup provider Q42. Which access control method enforces strict policies based on security labels such as “Confidential” or “Top Secret”? DAC RBAC MAC ABAC Q43. An employee plugs a personal USB drive into a company workstation without approval. What risk does this primarily represent? Insider Threat Phishing Attack Supply Chain Attack Business Email Compromise Q44. Which protocol secures email communication by digitally signing and encrypting messages? TLS S/MIME SSH SSL Q45. Which type of control is implementing a security awareness training program? Physical Technical Preventive Administrative Q46. What is the MOST appropriate tool to use when wanting to aggregate, correlate, and analyze logs from multiple systems? VPN Firewall SIEM NAC Q47. Which of the following would MOST help prevent unauthorized physical access to a data center? IDS Biometric Access Controls VPN Anti-Malware Q48. What security concept involves separating services and functions into isolated containers to minimize the attack surface? Microsegmentation Defense in Depth Least Privilege Data Sovereignty Q4G. An attacker successfully tricks a user into giving up login credentials via a fake login page. What attack technique was used? Spear Phishing Vishing Smishing Pharming Q5O. Which phase of the incident response process involves finding and removing malware from infected systems? Preparation Containment Eradication Lessons Learned
Q41 Which of the following BEST describes a cold site? Operational data center ready for immediate use Empty facility with basic infrastructure like power and HVAC Fully equipped center with real-time data replication Offsite cloud backup provider
Answer
B) Empty facility with basic infrastructure like power and HVAC
Explanation: A cold site is ready with essentials but needs equipment and data to become operational. A42.
Q42 Which access control method enforces strict policies based on security labels such as “Confidential” or “Top Secret”? DAC RBAC MAC ABAC
Answer
C) MAC
Explanation: Mandatory Access Control uses labels like “Top Secret” to strictly control access. A43.
Q43 An employee plugs a personal USB drive into a company workstation without approval. What risk does this primarily represent? Insider Threat Phishing Attack Supply Chain Attack Business Email Compromise
Answer
A) Insider Threat
Explanation: Unauthorized devices plugged into company systems pose insider risks. A44.
Q44 Which protocol secures email communication by digitally signing and encrypting messages? TLS S/MIME SSH SSL
Answer
B) S/MIME
Explanation: S/MIME secures email with digital signatures and encryption. A45.
Q45 Which type of control is implementing a security awareness training program? Physical Technical Preventive Administrative
Answer
D) Administrative
Explanation: Security training programs are administrative controls (policy/procedure related). A46.
Q46 What is the MOST appropriate tool to use when wanting to aggregate, correlate, and analyze logs from multiple systems? VPN Firewall SIEM NAC
Answer
C) SIEM
Explanation: A SIEM collects and analyzes logs from across the enterprise. A47.
Q47 Which of the following would MOST help prevent unauthorized physical access to a data center? IDS Biometric Access Controls VPN Anti-Malware
Answer
B) Biometric Access Controls
Explanation: Biometrics (like fingerprints) are effective physical security measures. A48.
Q48 What security concept involves separating services and functions into isolated containers to minimize the attack surface? Microsegmentation Defense in Depth Least Privilege Data Sovereignty
Answer
A) Microsegmentation
Explanation: Microsegmentation isolates workloads to minimize lateral movement risk. A4G.
Q49 An attacker successfully tricks a user into giving up login credentials via a fake login page. What attack technique was used? Spear Phishing Vishing Smishing Pharming
Answer
A) Spear Phishing
Explanation: Spear phishing targets individuals with highly customized fake login pages. A5O.
Q50 Which phase of the incident response process involves finding and removing malware from infected systems? Preparation Containment Eradication Lessons Learned
Answer
C) Eradication
Explanation: Eradication is when you remove malware or vulnerabilities after containment. Questions 51–6O Q51. Which security tool uses signatures and anomaly detection to identify malicious network traffic? Firewall SIEM IDS DLP Q52. A company wants to ensure that employees can recover their files after a ransomware attack without paying the ransom. Which control BEST achieves this? IDS Regular Offline Backups VPN Access Email Filtering Q53. Which of the following is MOST critical to maintain when preserving digital evidence? Full Disk Encryption Legal Hold Chain of Custody Incident Triage Q54. A company configures a cloud storage bucket and mistakenly leaves it open to the public. What type of vulnerability is this? Zero-Day Misconfiguration Insider Threat Malware Infection Q55. Which layer of the OSI model does a firewall operate primarily at? Application Transport Network Data Link Q56. What security concept is enforced when two employees are required to approve a wire transfer above a certain dollar amount? Dual Control Least Privilege Discretionary Access Control Federation Q57. Which cryptographic concept is used to ensure message integrity? Symmetric Encryption Asymmetric Encryption Hashing Key Exchange Q58. What is the purpose of tokenization in data security? Encrypt sensitive data Replace sensitive data with non-sensitive placeholders Hash sensitive data Create a secure communication channel Q5G. Which type of backup provides the FASTEST full system recovery after a catastrophic failure? Incremental Full Backup Differential Cloud Backup Q6O. A team uses a sandbox environment to open suspicious files. What type of control is this? Preventive Detective Corrective Compensating
Q51 Which security tool uses signatures and anomaly detection to identify malicious network traffic? Firewall SIEM IDS DLP
Answer
C) IDS
Explanation: An IDS detects threats by matching signatures or identifying anomalies. A52.
Q52 IDS Regular Offline Backups VPN Access Email Filtering
  • A company wants to ensure that employees can recover their files after a ransomware attack without paying the ransom. Which control BEST achieves this?
Answer
B) Regular Offline Backups
Explanation: Offline backups protect against ransomware by providing safe recovery data. A53.
Q53 Which of the following is MOST critical to maintain when preserving digital evidence? Full Disk Encryption Legal Hold Chain of Custody Incident Triage
Answer
C) Chain of Custody
Explanation: Chain of custody ensures evidence integrity for legal use. A54.
Q54 Zero-Day Misconfiguration Insider Threat Malware Infection
  • A company configures a cloud storage bucket and mistakenly leaves it open to the public. What type of vulnerability is this?
Answer
B) Misconfiguration
Explanation: Leaving a cloud bucket public is a classic misconfiguration vulnerability. A55.
Q55 Which layer of the OSI model does a firewall operate primarily at? Application Transport Network Data Link
Answer
C) Network
Explanation: Firewalls operate mainly at Layer 3 (Network layer) — managing IP addresses and traffic. A56.
Q56 What security concept is enforced when two employees are required to approve a wire transfer above a certain dollar amount? Dual Control Least Privilege Discretionary Access Control Federation
Answer
A) Dual Control
Explanation: Dual control requires two people to authorize a sensitive action. A57.
Q57 Which cryptographic concept is used to ensure message integrity? Symmetric Encryption Asymmetric Encryption Hashing Key Exchange
Answer
C) Hashing
Explanation: Hashing ensures data integrity by generating a fixed fingerprint of data. A58.
Q58 What is the purpose of tokenization in data security? Encrypt sensitive data Replace sensitive data with non-sensitive placeholders Hash sensitive data Create a secure communication channel
Answer
B) Replace sensitive data with non-sensitive placeholders
Explanation: Tokenization replaces real data with fake tokens to protect sensitive information. A5G.
Q59 Which type of backup provides the FASTEST full system recovery after a catastrophic failure? Incremental Full Backup Differential Cloud Backup
Answer
B) Full Backup
Explanation: Full backups allow the quickest recovery without relying on incremental data restoration. A6O.
Q60 Preventive Detective Corrective Compensating
  • A team uses a sandbox environment to open suspicious files. What type of control is this?
Answer
A) Preventive
Explanation: Sandboxes are preventive, isolating suspicious files before damage can occur. Questions 61–7O Q61. Which of the following is a PRIMARY characteristic of a rootkit? Encrypts files and demands ransom Hides its existence by manipulating the OS Replicates itself across the network Sends unsolicited messages via Bluetooth Q62. An organization wants to minimize data loss during a disaster. Which metric defines the maximum amount of data loss acceptable? RTO MTD RPO ALE Q63. Which wireless security protocol is considered obsolete and should NOT be used? WPA2 WPA WPA3 WEP Q64. A system administrator is deploying security patches to all systems automatically after testing. This is an example of: Change Management Patch Management Hardening Incident Response Q65. What type of malware restricts access to a system until payment is made? Trojan Worm Spyware Ransomware Q66. Which term describes isolating different departments in a network to improve security? Subnetting Virtualization Network Segmentation Packet Filtering Q67. What concept does the principle of "never trust, always verify" relate to? VPN Zero Trust Single Sign-On Role-Based Access Control Q68. Which tool is specifically designed to discover vulnerabilities in a system but NOT exploit them? Penetration Test Exploit Framework Vulnerability Scanner SIEM Q6G. An employee receives a fake call pretending to be IT support asking for a password. What attack is this? Phishing Vishing Smishing Spear Phishing Q7O. A user logs into an internal website using a badge and PIN. What authentication factors are being used? Something you know and something you are Something you know and something you have Something you have and something you are Two instances of something you know
Q61 Which of the following is a PRIMARY characteristic of a rootkit? Encrypts files and demands ransom Hides its existence by manipulating the OS Replicates itself across the network Sends unsolicited messages via Bluetooth
Answer
B) Hides its existence by manipulating the OS
Explanation: Rootkits hide their presence by modifying OS functions to avoid detection. A62.
Q62 An organization wants to minimize data loss during a disaster. Which metric defines the maximum amount of data loss acceptable? RTO MTD RPO ALE
Answer
C) RPO
Explanation: Recovery Point Objective defines the maximum acceptable data loss. A63.
Q63 Which wireless security protocol is considered obsolete and should NOT be used? WPA2 WPA WPA3 WEP
Answer
D) WEP
Explanation: WEP is outdated and insecure — easily cracked in minutes. A64.
Q64 testing. This is an example of: Change Management Patch Management Hardening Incident Response
  • A system administrator is deploying security patches to all systems automatically after
Answer
B) Patch Management
Explanation: Patch management involves scheduling and deploying updates systematically. A65.
Q65 What type of malware restricts access to a system until payment is made? Trojan Worm Spyware Ransomware
Answer
D) Ransomware
Explanation: Ransomware encrypts systems/files and demands payment for access. A66.
Q66 Which term describes isolating different departments in a network to improve security? Subnetting Virtualization Network Segmentation Packet Filtering
Answer
C) Network Segmentation
Explanation: Segmentation isolates different parts of the network for better control and security. A67.
Q67 What concept does the principle of "never trust, always verify" relate to? VPN Zero Trust Single Sign-On Role-Based Access Control
Answer
B) Zero Trust
Explanation: Zero Trust always requires verification, regardless of network location. A68.
Q68 Which tool is specifically designed to discover vulnerabilities in a system but NOT exploit them? Penetration Test Exploit Framework Vulnerability Scanner SIEM
Answer
C) Vulnerability Scanner
Explanation: Vulnerability scanners detect weaknesses without active exploitation. A6G.
Q69 An employee receives a fake call pretending to be IT support asking for a password. What attack is this? Phishing Vishing Smishing Spear Phishing
Answer
B) Vishing
Explanation: Vishing is phishing conducted over the telephone. A7O.
Q70 Something you know and something you are Something you know and something you have Something you have and something you are Two instances of something you know
  • A user logs into an internal website using a badge and PIN. What authentication factors are being used?
Answer
B) Something you know and something you have
Explanation: PIN = something you know; Badge = something you have. Questions 71–8O Q71. Which technology allows secure remote access to a corporate network by encrypting all traffic? VLAN IDS VPN Proxy Server Q72. An employee leaves a confidential document on a shared printer. What kind of risk is this? Insider Threat Physical Security Risk Supply Chain Risk Malware Infection Q73. Which of the following would MOST effectively prevent malware from executing on endpoints? Application Allowlisting IDS Deployment SSL/TLS Encryption Role-Based Access Control Q74. A company requires that users verify their identity using a username, password, and fingerprint scan. This is an example of: Multi-Factor Authentication Federation SSO Kerberos Authentication Q75. Which security principle ensures that critical functions are divided among multiple people to prevent fraud? Least Privilege Separation of Duties Job Rotation Dual Control Q76. What technique is used by attackers to overload a server with requests, causing service disruption? SQL Injection DNS Poisoning DDoS Attack ARP Spoofing Q77. Which of the following devices inspects and filters packets based on application-level data? Traditional Firewall Proxy Server Next-Generation Firewall (NGFW) Router Q78. Which method ensures that a user cannot deny performing an action, such as sending an email? Non-Repudiation Availability Encryption Role-Based Access Control Q7G. An attacker exploits a race condition in a web application. What is this an example of? Improper Input Handling Application Logic Flaw Secure Coding Practice Race Attack Vulnerability Q8O. Which of the following is a benefit of implementing Infrastructure as Code (IaC) securely? Manual configuration of servers Consistent and repeatable deployments Physical separation of networks Encrypted communication tunnels
Q71 Which technology allows secure remote access to a corporate network by encrypting all traffic? VLAN IDS VPN Proxy Server
Answer
C) VPN
Explanation: A VPN encrypts data between remote users and corporate networks. A72.
Q72 An employee leaves a confidential document on a shared printer. What kind of risk is this? Insider Threat Physical Security Risk Supply Chain Risk Malware Infection
Answer
B) Physical Security Risk
Explanation: Leaving sensitive documents in shared spaces risks unauthorized access. A73.
Q73 Which of the following would MOST effectively prevent malware from executing on endpoints? Application Allowlisting IDS Deployment SSL/TLS Encryption Role-Based Access Control
Answer
A) Application Allowlisting
Explanation: Only approved apps can run, blocking unknown malware. A74.
Q74 Multi-Factor Authentication Federation SSO Kerberos Authentication
  • A company requires that users verify their identity using a username, password, and fingerprint scan. This is an example of:
Answer
A) Multi-Factor Authentication
Explanation: Using two or more different authentication types (password + fingerprint). A75.
Q75 Which security principle ensures that critical functions are divided among multiple people to prevent fraud? Least Privilege Separation of Duties Job Rotation Dual Control
Answer
B) Separation of Duties
Explanation: No one person controls all parts of a critical process, preventing fraud. A76.
Q76 What technique is used by attackers to overload a server with requests, causing service disruption? SQL Injection DNS Poisoning DDoS Attack ARP Spoofing
Answer
C) DDoS Attack
Explanation: Distributed Denial of Service floods a server with traffic. A77.
Q77 Which of the following devices inspects and filters packets based on application-level data? Traditional Firewall Proxy Server Next-Generation Firewall (NGFW) Router
Answer
C) Next-Generation Firewall (NGFW)
Explanation: NGFWs inspect packets deeply, including application-level data. A78.
Q78 Which method ensures that a user cannot deny performing an action, such as sending an email? Non-Repudiation Availability Encryption Role-Based Access Control
Answer
A) Non-Repudiation
Explanation: Non-repudiation ensures proof of actions like sending emails. A7G.
Q79 An attacker exploits a race condition in a web application. What is this an example of? Improper Input Handling Application Logic Flaw Secure Coding Practice Race Attack Vulnerability
Answer
D) Race Attack Vulnerability
Explanation: Race conditions exploit timing issues in applications. A8O.
Q80 Which of the following is a benefit of implementing Infrastructure as Code (IaC) securely? Manual configuration of servers Consistent and repeatable deployments Physical separation of networks Encrypted communication tunnels
Answer
B) Consistent and repeatable deployments
Explanation: IaC enables secure, automated, consistent infrastructure setup. Questions 81–GO Q81. Which of the following BEST describes the primary benefit of implementing a SIEM system? Blocking unauthorized access attempts Preventing malware infections Aggregating and analyzing security logs centrally Encrypting sensitive data at rest Q82. What is the MAIN purpose of a DLP (Data Loss Prevention) system? Detect malware signatures Monitor unauthorized data transfers Block phishing emails Scan networks for vulnerabilities Q83. An attacker tricks a user into resetting their password by spoofing a legitimate password reset page. What kind of attack is this? Phishing SQL Injection Session Hijacking Privilege Escalation Q84. Which backup method copies only the files that have changed since the last backup, no matter what type it was? Full Incremental Differential Snapshot Q85. What does the principle of Defense in Depth emphasize? Using multiple layers of security controls Deploying only firewalls at the network perimeter Using two-factor authentication for all logins Relying primarily on SIEM alerts Q86. Which of the following is an example of an administrative control? Fire extinguisher in server room Firewall rules Security awareness policy Encryption of data at rest Q87. A SOC analyst notices large outbound traffic to an unknown IP. What is the BEST immediate action? Shut down all network switches Disconnect affected systems Reboot affected systems Call the ISP Q88. Which term describes unauthorized commands sent from a user’s browser to a trusted website? Cross-Site Scripting (XSS) SQL Injection Command Injection Cross-Site Request Forgery (CSRF) Q8G. Which of the following technologies enables a single identity to access multiple applications across different domains? Multifactor Authentication Federation VPN Zero Trust QGO. What is the FIRST action to take when you detect an active ransomware infection? Pay the ransom Disconnect infected systems from the network Run antivirus scan Contact cloud backup provider
Q81 Which of the following BEST describes the primary benefit of implementing a SIEM system? Blocking unauthorized access attempts Preventing malware infections Aggregating and analyzing security logs centrally Encrypting sensitive data at rest
Answer
C) Aggregating and analyzing security logs centrally
Explanation: SIEM systems collect logs from multiple sources for centralized analysis. A82.
Q82 What is the MAIN purpose of a DLP (Data Loss Prevention) system? Detect malware signatures Monitor unauthorized data transfers Block phishing emails Scan networks for vulnerabilities
Answer
B) Monitor unauthorized data transfers
Explanation: DLP systems prevent sensitive data from leaving the network. A83.
Q83 An attacker tricks a user into resetting their password by spoofing a legitimate password reset page. What kind of attack is this? Phishing SQL Injection Session Hijacking Privilege Escalation
Answer
A) Phishing
Explanation: Spoofed password reset pages are classic phishing attacks. A84.
Q84 Which backup method copies only the files that have changed since the last backup, no matter what type it was? Full Incremental Differential Snapshot
Answer
B) Incremental
Explanation: Incremental backups save changes since the last backup (full or incremental). A85.
Q85 What does the principle of Defense in Depth emphasize? Using multiple layers of security controls Deploying only firewalls at the network perimeter Using two-factor authentication for all logins Relying primarily on SIEM alerts
Answer
A) Using multiple layers of security controls
Explanation: Defense in Depth means no single point of failure. A86.
Q86 Which of the following is an example of an administrative control? Fire extinguisher in server room Firewall rules Security awareness policy Encryption of data at rest
Answer
C) Security awareness policy
Explanation: Administrative controls include policies and procedures. A87.
Q87 Shut down all network switches Disconnect affected systems Reboot affected systems Call the ISP
  • A SOC analyst notices large outbound traffic to an unknown IP. What is the BEST immediate action?
Answer
B) Disconnect affected systems
Explanation: Disconnect immediately to prevent further data exfiltration. A88.
Q88 Which term describes unauthorized commands sent from a user’s browser to a trusted website? Cross-Site Scripting (XSS) SQL Injection Command Injection Cross-Site Request Forgery (CSRF)
Answer
D) Cross-Site Request Forgery (CSRF)
Explanation: CSRF tricks users into executing unwanted actions. A8G.
Q89 Which of the following technologies enables a single identity to access multiple applications across different domains? Multifactor Authentication Federation VPN Zero Trust
Answer
B) Federation
Explanation: Federation allows single login across multiple organizations/systems. AGO.
Q90 What is the FIRST action to take when you detect an active ransomware infection? Pay the ransom Disconnect infected systems from the network Run antivirus scan Contact cloud backup provider
Answer
B) Disconnect infected systems from the network
Explanation: Isolate first to stop the spread of ransomware. Questions G1–1OO QG1. Which of the following terms describes preventing unauthorized access by forcing a user to authenticate again after a period of inactivity? Session Lock Password Complexity Single Sign-On Federation QG2. What type of test involves assessing the physical, administrative, and technical safeguards without exploiting vulnerabilities? Vulnerability Scan Penetration Test Risk Assessment Business Impact Analysis QG3. Which component is critical for ensuring confidentiality when sending sensitive data across the Internet? Hashing Encryption Load Balancing IDS QG4. What is the purpose of implementing redundant power supplies in servers? Improve encryption performance Increase network bandwidth Enhance system availability Provide faster processing QG5. Which of the following MOST accurately defines tokenization? Encrypting all data in a database Replacing sensitive data elements with a unique identifier Hashing user passwords before storage Obfuscating source code to protect intellectual property QG6. An attacker uses a vulnerability in a software program that has not yet been patched. What kind of attack is this? Zero-Day Man-in-the-Middle Cross-Site Scripting Phishing QG7. What is the BEST method to mitigate the impact of social engineering attacks? Install firewalls Security Awareness Training Regular Penetration Testing Conduct Full Backups QG8. Which type of malware is specifically designed to provide persistent, hidden access to a compromised system? Ransomware Trojan Rootkit Worm QGG. A backup strategy uses the Grandfather-Father-Son method. What is this primarily designed to achieve? Ensure zero data loss Maintain multiple historical versions of backups Accelerate disaster recovery Improve real-time replication Q1OO. What security tool intercepts and controls traffic between a user and the Internet to enforce company policies? Firewall VPN Proxy Server Load Balancer
Q91 Which of the following terms describes preventing unauthorized access by forcing a user to authenticate again after a period of inactivity? Session Lock Password Complexity Single Sign-On Federation
Answer
A) Session Lock
Explanation: Session locks require reauthentication after inactivity to prevent unauthorized access. AG2.
Q92 What type of test involves assessing the physical, administrative, and technical safeguards without exploiting vulnerabilities? Vulnerability Scan Penetration Test Risk Assessment Business Impact Analysis
Answer
C) Risk Assessment
Explanation: Risk assessments evaluate safeguards without actively exploiting vulnerabilities. AG3.
Q93 Which component is critical for ensuring confidentiality when sending sensitive data across the Internet? Hashing Encryption Load Balancing IDS
Answer
B) Encryption
Explanation: Encryption protects data confidentiality during transmission. AG4.
Q94 What is the purpose of implementing redundant power supplies in servers? Improve encryption performance Increase network bandwidth Enhance system availability Provide faster processing
Answer
C) Enhance system availability
Explanation: Redundant power supplies help keep servers running during power failures. AG5.
Q95 Which of the following MOST accurately defines tokenization? Encrypting all data in a database Replacing sensitive data elements with a unique identifier Hashing user passwords before storage Obfuscating source code to protect intellectual property
Answer
B) Replacing sensitive data elements with a unique identifier
Explanation: Tokenization swaps real data for safe, meaningless tokens. AG6.
Q96 An attacker uses a vulnerability in a software program that has not yet been patched. What kind of attack is this? Zero-Day Man-in-the-Middle Cross-Site Scripting Phishing
Answer
A) Zero-Day
Explanation: Zero-day attacks exploit unknown or unpatched vulnerabilities. AG7.
Q97 What is the BEST method to mitigate the impact of social engineering attacks? Install firewalls Security Awareness Training Regular Penetration Testing Conduct Full Backups
Answer
B) Security Awareness Training
Explanation: Training users helps them recognize and avoid social engineering. AG8.
Q98 Which type of malware is specifically designed to provide persistent, hidden access to a compromised system? Ransomware Trojan Rootkit Worm
Answer
C) Rootkit
Explanation: Rootkits maintain hidden, persistent access by deeply integrating with systems. AGG.
Q99 Ensure zero data loss Maintain multiple historical versions of backups Accelerate disaster recovery Improve real-time replication
  • A backup strategy uses the Grandfather-Father-Son method. What is this primarily designed to achieve?
Answer
B) Maintain multiple historical versions of backups
Explanation: Grandfather-Father-Son rotation ensures backup version history. A1OO.
Q100 What security tool intercepts and controls traffic between a user and the Internet to enforce company policies? Firewall VPN Proxy Server Load Balancer
Answer
C) Proxy Server
Explanation: Proxies filter, control, and log user Internet traffic to enforce policies.